Intel / blog

Using AI to chart a course for our post-quantum migration

Source: blog.cloudflare.com
Date: Published Sep 29, 2026

Context

Cloudflare is using AI to investigate where cryptography appears in its systems and what must change for a post-quantum migration. Its CryptoLabe account explains why searching for algorithm names is insufficient: references may belong to unused code, while active cryptography can be hidden in dependencies or configuration, and a search cannot say how an algorithm is used. CryptoLabe classifies how each operation is used, and groups findings that share a prerequisite, such as missing post-quantum support in a library or protocol, helping teams identify work that must happen before individual products can migrate. Engineers still review the findings; the team says it has no ground-truth dataset and is not convinced it has complete coverage of cryptography use.

Key takeaways · AI-distilled

Cloudflare says grepping algorithm names overcounts, by matching unused code, and undercounts, by missing defaults, dependencies and config. Nor can it tell whether an ECDSA signature sits in JWT, IPsec, TLS or SSH, each with a different migration path.
CryptoLabe scans in two stages: discovery yields raw observations, then analysis re-checks each against the code, traces runtime use and dependencies, and labels weak cases More evidence needed, External dependency or Unknown rather than guessing.
Each scan snapshots the repo at an exact commit into R2 and restores it into a fresh, short-lived , where the model uses read-only tools. Model calls go through AI Gateway to models on Workers AI to control cost.
When parallel scans triggered HTTP 429 rate limits and independent retries made bursts worse, Cloudflare added one global Durable Object that paces all model requests, so every scan backs off together after a limit is hit.
A simpler prompt run across all repositories with ticketing and docs worked better for hard cases, such as a certificate in an HTTP header that larger PQ signatures could break. Cloudflare says it lacks a ground-truth dataset to compare prompts.

Terms in this piece · Glossary

sandbox — An isolated environment where AI-generated code or agent actions run without being able to touch anything real.
open weights — A model whose trained parameters are published for anyone to download and run — unlike API-only models you can access but never possess.
context window — The maximum amount of text a model can consider at once — its working memory for the current conversation or task.

Read the source blog.cloudflare.com