Cloudflare swapped a years-old TLS guess for a daily probe of every origin

An X25519MLKEM768 keyshare is 1,216 bytes. An X25519 keyshare is 32 ^[8]. Thirty-eight times larger ^[1], and large enough to push the ClientHello past a single network packet. The TLS standard permits a ClientHello split across TCP segments; some legacy middleboxes and origin servers fail on it, and Cloudflare's earlier study found around 0.34% of scanned origins would not complete a handshake when the post-quantum keyshare came first ^[8][9]. One origin in 294 ^[2].

So from September 2023 Cloudflare advertised post-quantum support but led with classical X25519, requiring capable origins to ask for the upgrade with a HelloRetryRequest ^[10]. A broken handshake is worse than a slow one, and in 2023 only 0.5% of origins supported post-quantum key exchange ^[11], so the retry cost a round trip on 0.5% of origins. Origin support is now 12.8% ^[11]. That is a roughly 25-fold rise ^[3], and the breakage rate stayed at 0.34% ^[9].

Among the cohort scanned so far, 33% moved to X25519MLKEM768 ^[13]. That is 2.6 times the 12.8% support figure ^[4]. Two readings fit. The scanned cohort may skew toward capable origins, or passive measurement was undercounting: Cloudflare says active probing found thousands of origins whose post-quantum support never appeared in passive traffic, because many accept a classical keyshare without issuing a retry even when they support something stronger ^[7]. Note also that the 30% of origin connections Cloudflare calls suboptimal under the old guess ^[4] is not the same measurement as the 36% of the scanned cohort that changed algorithm ^[5].

The 150 ms is one origin round trip at p90 ^[7]. It transfers to your stack only if your origin prefers something other than X25519, as more than 6% do ^[5], your edge-to-origin path is long enough that a round trip costs that much, and you open new origin connections often enough for handshake latency to reach p90 at all. If you keep a warm pool of persistent origin connections, the retry amortises down to noise.

The probe design is the part I would copy. Probes run outside the production traffic path, one key agreement group at a time, and origins are rescanned daily so the preference follows changes to load balancers and TLS libraries ^[6]. The assumption it replaces had been in place for years, according to InfoQ ^[18], and the guess was defensible on its own terms: over 95% of origins do support X25519 ^[3].

Post-quantum origin traffic across the scanned cohort grew from roughly 25 billion connections a day to 45 billion, which Cloudflare attributes in part to Automatic Key Exchange upgrading classical connections ^[15].