· Nov 6, 2026
Cloudflare’s Bas Westerbaan outlines a path to post-quantum private web credentials
Markdown · JSON · Original source
’s Bas Westerbaan argues that post-quantum anonymous credentials for the web may be moving from cryptography design toward protocol engineering. Privacy Pass tokens can protect users’ privacy, he explains, but their classical cryptography could let a quantum attacker forge tokens and bypass protections such as rate limiting. The proposed MOLE system would also hide which trusted anchor issued an endorsement, so moderators could treat clients equally without learning that identity. Westerbaan presents VOLE-in-the-Head combined with multivariate cryptography as a possible basis for building several kinds of credentials, including MOLE endorsements. He says early cost estimates are larger than classical counterparts, but sees them as potentially workable: one redemption might need to be amortized across multiple requests. That is a proposed engineering response, not a demonstrated deployment benefit. Important work remains. The authors still need security proofs, and further cryptanalysis could change UOV parameters and increase costs. Some optimizations also rely on assumptions that need more study; a break in one could affect token forgery, while another proposed direction could threaten client privacy. Westerbaan’s case is that these risks warrant development and scrutiny now, not that the schemes are ready: the estimates may change, and the security of the proposed
Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.
Original source
Blog · Article
Source details
Original source date: Nov 6, 2026 (2026-11-06T14:00:00.000Z).
Date basis: Date stated by the publisher.
Added to Escape Meridian: 2026-11-08T01:19:30.673Z. First observed: 2026-11-06T14:03:33.661Z. Retrieved: 2026-11-08T01:18:45.669Z.
Referenced by
Recorded citations and public file attachments. A reference alone does not establish agreement or influence.
No public references recorded here yet.
Limits
The article describes candidate schemes and current cost estimates, not a demonstrated deployment; it says the estimates may change. The article says security proofs for the protocols and further cryptanalysis of UOV remain outstanding. The article warns that one proposed multivariate commitment approach may threaten client privacy and needs more study. The article’s estimates use UOV parameters and VOLEitH parameters specified in the post; changed parameters could affect costs.
Open question
What will security proofs and further cryptanalysis show about whether VOLE-IHAT and VOLE-ACT are secure with the proposed UOV parameters?
Source-stated
Westerbaan says Privacy Pass relies on classical cryptography that a quantum attacker could use to forge tokens, while token privacy against linking is a separate property.
This means that a quantum attacker will be able to forge tokens at will and use them to bypass whatever security mechanism the site operator wants to implement
Source-stated
MOLE endorsements are designed to hide which trusted anchor issued them, supporting equal treatment of clients regardless of their type.
This guarantees equal treatment regardless of the type of client, making it easier for more clients to participate.
Source-stated
Westerbaan presents VOLE-in-the-Head and multivariate cryptography as building blocks for several post-quantum credential systems.
Multivariate cryptography looks to be a promising basis for easily building a variety of anonymous tokens and credentials.
Source-stated
The article gives preliminary cost estimates for VOLE-IHAT and VOLE-ACT and says those estimates may change as the constructions are analyzed and developed.
Our current cost estimates for these are shown in the table below. The numbers here are subject to change as we analyze and develop these constructions.
Source-stated
The authors say security proofs and further cryptanalysis are still needed before the proposed schemes are ready.
First, we need to make sure our protocols are sound, in particular by producing security proofs for them that show they are secure as long as UOV is secure. Second, we need to wait a bit for cryptanalysis of UOV to catch up.
Source-stated
Westerbaan proposes amortizing a redemption across multiple requests as one way to address the higher costs compared with classical blind signatures.
we'll have to figure out how to amortize a single redemption over multiple requests.
Source and contributor context
Cloudflare · Publisher
The publisher is identified here. No individual author has been inferred.
Source media
Media declared by the original publisher; availability checked separately from the editorial reading.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Cloudflare
Cloudflare provides networking, security and computing services that help run websites and applications.
Editorial provenance
Version 1. Publication ID: 9016faea-8ddc-4a23-8a11-74f2787c67e6.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-08T01:19:30.673Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 7fc8db8c5bfdb59ed03220ca9fcd45334c3e1a85771de0a9cd17efaaf9c7f2df. Source text hash: 49804b6cdf0924724ef5be5fe61acd2b8e4b856f7bcad938070a5039abe49765.
Revision and source-check history
Version 1 · 2026-11-08T01:19:30.673Z
Cloudflare’s Bas Westerbaan outlines a path to post-quantum private web credentials
’s Bas Westerbaan argues that post-quantum anonymous credentials for the web may be moving from cryptography design toward protocol engineering. Privacy Pass tokens can protect users’ privacy, he explains, but their classical cryptography could let a quantum attacker forge tokens and bypass protections such as rate limiting. The proposed MOLE system would also hide which trusted anchor issued an endorsement, so moderators could treat clients equally without learning that identity. Westerbaan presents VOLE-in-the-Head combined with multivariate cryptography as a possible basis for building several kinds of credentials, including MOLE endorsements. He says early cost estimates are larger than classical counterparts, but sees them as potentially workable: one redemption might need to be amortized across multiple requests. That is a proposed engineering response, not a demonstrated deployment benefit. Important work remains. The authors still need security proofs, and further cryptanalysis could change UOV parameters and increase costs. Some optimizations also rely on assumptions that need more study; a break in one could affect token forgery, while another proposed direction could threaten client privacy. Westerbaan’s case is that these risks warrant development and scrutiny now, not that the schemes are ready: the estimates may change, and the security of the proposed
Original source
Blog · Article
Source details
Original source date: Nov 6, 2026 (2026-11-06T14:00:00.000Z).
Date basis: Date stated by the publisher.
Added to Escape Meridian: 2026-11-08T01:19:30.673Z. First observed: 2026-11-06T14:03:33.661Z. Retrieved: 2026-11-08T01:18:45.669Z.
Limits
The article describes candidate schemes and current cost estimates, not a demonstrated deployment; it says the estimates may change. The article says security proofs for the protocols and further cryptanalysis of UOV remain outstanding. The article warns that one proposed multivariate commitment approach may threaten client privacy and needs more study. The article’s estimates use UOV parameters and VOLEitH parameters specified in the post; changed parameters could affect costs.
Open question
What will security proofs and further cryptanalysis show about whether VOLE-IHAT and VOLE-ACT are secure with the proposed UOV parameters?
Source-stated
Westerbaan says Privacy Pass relies on classical cryptography that a quantum attacker could use to forge tokens, while token privacy against linking is a separate property.
This means that a quantum attacker will be able to forge tokens at will and use them to bypass whatever security mechanism the site operator wants to implement
Source-stated
MOLE endorsements are designed to hide which trusted anchor issued them, supporting equal treatment of clients regardless of their type.
This guarantees equal treatment regardless of the type of client, making it easier for more clients to participate.
Source-stated
Westerbaan presents VOLE-in-the-Head and multivariate cryptography as building blocks for several post-quantum credential systems.
Multivariate cryptography looks to be a promising basis for easily building a variety of anonymous tokens and credentials.
Source-stated
The article gives preliminary cost estimates for VOLE-IHAT and VOLE-ACT and says those estimates may change as the constructions are analyzed and developed.
Our current cost estimates for these are shown in the table below. The numbers here are subject to change as we analyze and develop these constructions.
Source-stated
The authors say security proofs and further cryptanalysis are still needed before the proposed schemes are ready.
First, we need to make sure our protocols are sound, in particular by producing security proofs for them that show they are secure as long as UOV is secure. Second, we need to wait a bit for cryptanalysis of UOV to catch up.
Source-stated
Westerbaan proposes amortizing a redemption across multiple requests as one way to address the higher costs compared with classical blind signatures.
we'll have to figure out how to amortize a single redemption over multiple requests.
Source and contributor context
Cloudflare · Publisher
The publisher is identified here. No individual author has been inferred.
Source media
Media declared by the original publisher; availability checked separately from the editorial reading.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Cloudflare
Cloudflare provides networking, security and computing services that help run websites and applications.
Editorial provenance
Version 1. Publication ID: 9016faea-8ddc-4a23-8a11-74f2787c67e6.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-08T01:19:30.673Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 7fc8db8c5bfdb59ed03220ca9fcd45334c3e1a85771de0a9cd17efaaf9c7f2df. Source text hash: 49804b6cdf0924724ef5be5fe61acd2b8e4b856f7bcad938070a5039abe49765.
uncertain · 2026-11-08T01:19:30.673Z · anthropic/claude-opus-5.5
Publication: 9016faea-8ddc-4a23-8a11-74f2787c67e6
attribution — pass: The page names Bas Westerbaan of Cloudflare, so attributing the argument to him is reasonable. The draft keeps claims attributed to him or the article and does not present them as established fact. It switches between 'Westerbaan' and 'the authors', but this matches the post's 'we' voice and is not a misattribution.
Bas Westerbaan
summary — uncertain: The summary is cut off mid-sentence: 'and the security of the proposed'. Smallest repair: complete or remove that clause. Central terms are not explained in plain language: post-quantum, VOLE-in-the-Head, multivariate cryptography, UOV, anchor, moderator and endorsement. A non-specialist cannot tell what these mean. Suggested term-library tooltips: VOLE-in-the-Head, UOV, MOLE anchor/moderator. Otherwise the summary faithfully captures the forgery-versus-privacy distinction and the issuer-hiding goal. It also keeps the conditional milestone claim ('If these numbers hold').
If these numbers hold, then we've already reached an important milestone: the transition to PQ anonymous credentials for the web can now shift from cryptography design to protocol engineering.
date — pass: originalPublished is 2026-11-06T14:00Z, based on the publisher page. It matches the feed entry and comes before first observation. Nothing indicates an earlier first publication.
support — pass: Each claim's excerpt supports it. The draft correctly frames amortization as a proposed engineering response and the estimates as subject to change. The risk statements match the source: a break would affect forgery, not privacy, and the multivariate commitments carry a privacy risk. 'Develop now' is supported by the source's statement that now is the time to develop alternatives. No unsupported benefits are implied.
Notably, the risk here is not just to unforgeability, but also to client privacy. A lot more study is needed.
media — pass: The selected media is the verified direct link to the original Cloudflare article. This gives readers the easiest access to the source.
Challenge or correct this reading
Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.
Cloudflare provides networking, security and computing services that help run websites and applications.
Explore CloudflareCloudflare provides networking, security and computing services that help run websites and applications.
Explore CloudflareCloudflare provides networking, security and computing services that help run websites and applications.
Explore CloudflareCloudflare provides networking, security and computing services that help run websites and applications.
Explore CloudflareCloudflare provides networking, security and computing services that help run websites and applications.
Explore Cloudflare