Cloudflare outlines post-quantum Privacy Pass design: MOLE endorsements built on VOLE-in-the-Head and UOV blind signatures
Cloudflare describes a possible post-quantum future for Privacy Pass. Today it relies on classical RSA and elliptic curves, so a quantum attacker could forge tokens and bypass controls such as rate limiting. Privacy Pass is unconditionally private, so a quantum attacker still could not link a token's redemption to its issuance. The post presents MOLE ("Moderation Of unLinkable Endorsements"), a next-generation scheme that hides the issuer's identity. It would be built on VOLE-in-the-Head (VOLEitH) zero-knowledge proofs and multivariate signatures (UOV/MAYO), following the PoMFRIT blind signature (Baum et al., USENIX Security 2026). This is design and research news, not an incident. The post names no vulnerability, exploitation or CVE.
Detalhes técnicos
- PoMFRIT blind signatures are about 6.7KB with MAYO. Swapping in UOV (NIST round 3 parameters uov-Ip, with FAEST-EM-128s) reduces this to about 4.3KB. The trade-off is larger public keys (UOV's are 46.6KB).
- For comparison, ML-DSA-44 signatures are 2,420 bytes and ECDSA-P256 signatures are 64 bytes.
- Proof size is dominated by Keccak evaluations. Proposed reductions are TurboSHAKE (12 rounds) and a smaller 800-bit Keccak state. Multivariate commitments and an MQ-friendly PRG are also being explored.
- The post says cryptanalysis of multivariate cryptography is still immature. Some optimizations rely on a stronger "one-more-UOV" assumption, and parameters may need to grow (for example NIST Level 3).
- A break of these assumptions would affect token forgery, not client privacy. The post notes that researchers at UCSD and INRIA recently forged a 1024-bit RSA signature using a Privacy Pass issuer as a signing oracle. Privacy Pass uses 2048-bit RSA, which leaves a security margin.
Remediação
None is required. The post says an alternative to classical Privacy Pass will be needed soon, and that more study is required before relying on the aggressive optimizations.
Linha do tempo
-
Cloudflare outlines post-quantum Privacy Pass design: MOLE endorsements built on VOLE-in-the-Head and UOV blind signatures
ler a análise desta fonte ocultar
Cloudflare describes a possible post-quantum future for Privacy Pass. Today it relies on classical RSA and elliptic curves, so a quantum attacker could forge tokens and bypass controls such as rate limiting. Privacy Pass is unconditionally private, so a quantum attacker still could not link a token's redemption to its issuance. The post presents MOLE ("Moderation Of unLinkable Endorsements"), a next-generation scheme that hides the issuer's identity. It would be built on VOLE-in-the-Head (VOLEitH) zero-knowledge proofs and multivariate signatures (UOV/MAYO), following the PoMFRIT blind signature (Baum et al., USENIX Security 2026). This is design and research news, not an incident. The post names no vulnerability, exploitation or CVE.
Technical Details
- PoMFRIT blind signatures are about 6.7KB with MAYO. Swapping in UOV (NIST round 3 parameters uov-Ip, with FAEST-EM-128s) reduces this to about 4.3KB. The trade-off is larger public keys (UOV's are 46.6KB).
- For comparison, ML-DSA-44 signatures are 2,420 bytes and ECDSA-P256 signatures are 64 bytes.
- Proof size is dominated by Keccak evaluations. Proposed reductions are TurboSHAKE (12 rounds) and a smaller 800-bit Keccak state. Multivariate commitments and an MQ-friendly PRG are also being explored.
- The post says cryptanalysis of multivariate cryptography is still immature. Some optimizations rely on a stronger "one-more-UOV" assumption, and parameters may need to grow (for example NIST Level 3).
- A break of these assumptions would affect token forgery, not client privacy. The post notes that researchers at UCSD and INRIA recently forged a 1024-bit RSA signature using a Privacy Pass issuer as a signing oracle. Privacy Pass uses 2048-bit RSA, which leaves a security margin.
Remediation
None is required. The post says an alternative to classical Privacy Pass will be needed soon, and that more study is required before relying on the aggressive optimizations.