Using AI to chart a course for our post-quantum migration
Source
blog.cloudflare.com
Date
Key takeaways · AI-distilled
Cloudflare says grepping algorithm names overcounts, by matching unused code, and undercounts, by missing defaults, dependencies and config. Nor can it tell whether an ECDSA signature sits in JWT, IPsec, TLS or SSH, each with a different migration path.
CryptoLabe scans in two stages: discovery yields raw observations, then analysis re-checks each against the code, traces runtime use and dependencies, and labels weak cases More evidence needed, External dependency or Unknown rather than guessing.
Each scan snapshots the repo at an exact commit into R2 and restores it into a fresh, short-lived sandboxAn isolated environment where AI-generated code or agent actions run without being able to touch anything real.Full definition →, where the model uses read-only tools. Model calls go through AI Gateway to open weightsA model whose trained parameters are published for anyone to download and run — unlike API-only models you can access but never possess.Full definition → models on Workers AI to control cost.
When parallel scans triggered HTTP 429 rate limits and independent retries made bursts worse, Cloudflare added one global Durable Object that paces all model requests, so every scan backs off together after a limit is hit.
A simpler prompt run across all repositories with ticketing and docs context windowThe maximum amount of text a model can consider at once — its working memory for the current conversation or task.Full definition → worked better for hard cases, such as a certificate in an HTTP header that larger PQ signatures could break. Cloudflare says it lacks a ground-truth dataset to compare prompts.
Terms in this piece · Glossary
sandbox — An isolated environment where AI-generated code or agent actions run without being able to touch anything real.
open weights — A model whose trained parameters are published for anyone to download and run — unlike API-only models you can access but never possess.
context window — The maximum amount of text a model can consider at once — its working memory for the current conversation or task.
Why it matters
Shows an infrastructure team applying AI to inventory cryptographic usage across a large platform. It is a practical pattern for AI-assisted codebase auditing ahead of a migration deadline.
