# Cloudflare’s Bas Westerbaan outlines a path to post-quantum private web credentials [Canonical reading](https://escapemeridian.com/readings/cloudflare-s-bas-westerbaan-outlines-a-path-to-post-quantum-3d156972) Cloudflare’s Bas Westerbaan argues that post-quantum anonymous credentials for the web may be moving from cryptography design toward protocol engineering. Privacy Pass tokens can protect users’ privacy, he explains, but their classical cryptography could let a quantum attacker forge tokens and bypass protections such as rate limiting. The proposed MOLE system would also hide which trusted anchor issued an endorsement, so moderators could treat clients equally without learning that identity. Westerbaan presents VOLE-in-the-Head combined with multivariate cryptography as a possible basis for building several kinds of credentials, including MOLE endorsements. He says early cost estimates are larger than classical counterparts, but sees them as potentially workable: one redemption might need to be amortized across multiple requests. That is a proposed engineering response, not a demonstrated deployment benefit. Important work remains. The authors still need security proofs, and further cryptanalysis could change UOV parameters and increase costs. Some optimizations also rely on assumptions that need more study; a break in one could affect token forgery, while another proposed direction could threaten client privacy. Westerbaan’s case is that these risks warrant development and scrutiny now, not that the schemes are ready: the estimates may change, and the security of the proposed Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source Cloudflare Blog · Article Original source date: Nov 6, 2026 (2026-11-06T14:00:00.000Z). Date basis: Date stated by the publisher. Added to Escape Meridian: 2026-11-08T01:19:30.673Z. First observed: 2026-11-06T14:03:33.661Z. Retrieved: 2026-11-08T01:18:45.669Z. - [The post-quantum future of web privacy](https://blog.cloudflare.com/vole-mole/) ## Limits The article describes candidate schemes and current cost estimates, not a demonstrated deployment; it says the estimates may change. The article says security proofs for the protocols and further cryptanalysis of UOV remain outstanding. The article warns that one proposed multivariate commitment approach may threaten client privacy and needs more study. The article’s estimates use UOV parameters and VOLEitH parameters specified in the post; changed parameters could affect costs. ## Open question What will security proofs and further cryptanalysis show about whether VOLE-IHAT and VOLE-ACT are secure with the proposed UOV parameters? ## Source-stated Westerbaan says Privacy Pass relies on classical cryptography that a quantum attacker could use to forge tokens, while token privacy against linking is a separate property. > This means that a quantum attacker will be able to forge tokens at will and use them to bypass whatever security mechanism the site operator wants to implement - [Supporting source](https://blog.cloudflare.com/vole-mole/) ## Source-stated MOLE endorsements are designed to hide which trusted anchor issued them, supporting equal treatment of clients regardless of their type. > This guarantees equal treatment regardless of the type of client, making it easier for more clients to participate. - [Supporting source](https://blog.cloudflare.com/vole-mole/) ## Source-stated Westerbaan presents VOLE-in-the-Head and multivariate cryptography as building blocks for several post-quantum credential systems. > Multivariate cryptography looks to be a promising basis for easily building a variety of anonymous tokens and credentials. - [Supporting source](https://blog.cloudflare.com/vole-mole/) ## Source-stated The article gives preliminary cost estimates for VOLE-IHAT and VOLE-ACT and says those estimates may change as the constructions are analyzed and developed. > Our current cost estimates for these are shown in the table below. The numbers here are subject to change as we analyze and develop these constructions. - [Supporting source](https://blog.cloudflare.com/vole-mole/) ## Source-stated The authors say security proofs and further cryptanalysis are still needed before the proposed schemes are ready. > First, we need to make sure our protocols are sound, in particular by producing security proofs for them that show they are secure as long as UOV is secure. Second, we need to wait a bit for cryptanalysis of UOV to catch up. - [Supporting source](https://blog.cloudflare.com/vole-mole/) ## Source-stated Westerbaan proposes amortizing a redemption across multiple requests as one way to address the higher costs compared with classical blind signatures. > we'll have to figure out how to amortize a single redemption over multiple requests. - [Supporting source](https://blog.cloudflare.com/vole-mole/) ## Source and contributor context Cloudflare · Publisher The publisher is identified here. No individual author has been inferred. ## Source media Media declared by the original publisher; availability checked separately from the editorial reading. - [image · Cloudflare Blog](https://blog.cloudflare.com/_image?href=https%3A%2F%2Fblog.cloudflare.com%2F_emdash%2Fapi%2Fmedia%2Ffile%2F01M6RNKQ9RKEJ9CKY6DGNF44RV.01M6RNKRJAQTN05BV66646AM7Z.png&w=1280&h=720&f=webp&fit=cover&position=center) ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Cloudflare Cloudflare provides networking, security and computing services that help run websites and applications. - [Explore this context](/entities/cloudflare) - [Reference](https://blog.cloudflare.com/) ## Editorial provenance Version 1. Publication ID: 9016faea-8ddc-4a23-8a11-74f2787c67e6. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-08T01:19:30.673Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 7fc8db8c5bfdb59ed03220ca9fcd45334c3e1a85771de0a9cd17efaaf9c7f2df. Source text hash: 49804b6cdf0924724ef5be5fe61acd2b8e4b856f7bcad938070a5039abe49765. ## Revision and source-check history ### Version 1 — 2026-11-08T01:19:30.673Z Cloudflare’s Bas Westerbaan argues that post-quantum anonymous credentials for the web may be moving from cryptography design toward protocol engineering. Privacy Pass tokens can protect users’ privacy, he explains, but their classical cryptography could let a quantum attacker forge tokens and bypass protections such as rate limiting. The proposed MOLE system would also hide which trusted anchor issued an endorsement, so moderators could treat clients equally without learning that identity. Westerbaan presents VOLE-in-the-Head combined with multivariate cryptography as a possible basis for building several kinds of credentials, including MOLE endorsements. He says early cost estimates are larger than classical counterparts, but sees them as potentially workable: one redemption might need to be amortized across multiple requests. That is a proposed engineering response, not a demonstrated deployment benefit. Important work remains. The authors still need security proofs, and further cryptanalysis could change UOV parameters and increase costs. Some optimizations also rely on assumptions that need more study; a break in one could affect token forgery, while another proposed direction could threaten client privacy. Westerbaan’s case is that these risks warrant development and scrutiny now, not that the schemes are ready: the estimates may change, and the security of the proposed ## Original source Cloudflare Blog · Article Original source date: Nov 6, 2026 (2026-11-06T14:00:00.000Z). Date basis: Date stated by the publisher. Added to Escape Meridian: 2026-11-08T01:19:30.673Z. First observed: 2026-11-06T14:03:33.661Z. Retrieved: 2026-11-08T01:18:45.669Z. - [The post-quantum future of web privacy](https://blog.cloudflare.com/vole-mole/) ## Limits The article describes candidate schemes and current cost estimates, not a demonstrated deployment; it says the estimates may change. The article says security proofs for the protocols and further cryptanalysis of UOV remain outstanding. The article warns that one proposed multivariate commitment approach may threaten client privacy and needs more study. The article’s estimates use UOV parameters and VOLEitH parameters specified in the post; changed parameters could affect costs. ## Open question What will security proofs and further cryptanalysis show about whether VOLE-IHAT and VOLE-ACT are secure with the proposed UOV parameters? ## Source-stated Westerbaan says Privacy Pass relies on classical cryptography that a quantum attacker could use to forge tokens, while token privacy against linking is a separate property. > This means that a quantum attacker will be able to forge tokens at will and use them to bypass whatever security mechanism the site operator wants to implement - [Supporting source](https://blog.cloudflare.com/vole-mole/) ## Source-stated MOLE endorsements are designed to hide which trusted anchor issued them, supporting equal treatment of clients regardless of their type. > This guarantees equal treatment regardless of the type of client, making it easier for more clients to participate. - [Supporting source](https://blog.cloudflare.com/vole-mole/) ## Source-stated Westerbaan presents VOLE-in-the-Head and multivariate cryptography as building blocks for several post-quantum credential systems. > Multivariate cryptography looks to be a promising basis for easily building a variety of anonymous tokens and credentials. - [Supporting source](https://blog.cloudflare.com/vole-mole/) ## Source-stated The article gives preliminary cost estimates for VOLE-IHAT and VOLE-ACT and says those estimates may change as the constructions are analyzed and developed. > Our current cost estimates for these are shown in the table below. The numbers here are subject to change as we analyze and develop these constructions. - [Supporting source](https://blog.cloudflare.com/vole-mole/) ## Source-stated The authors say security proofs and further cryptanalysis are still needed before the proposed schemes are ready. > First, we need to make sure our protocols are sound, in particular by producing security proofs for them that show they are secure as long as UOV is secure. Second, we need to wait a bit for cryptanalysis of UOV to catch up. - [Supporting source](https://blog.cloudflare.com/vole-mole/) ## Source-stated Westerbaan proposes amortizing a redemption across multiple requests as one way to address the higher costs compared with classical blind signatures. > we'll have to figure out how to amortize a single redemption over multiple requests. - [Supporting source](https://blog.cloudflare.com/vole-mole/) ## Source and contributor context Cloudflare · Publisher The publisher is identified here. No individual author has been inferred. ## Source media Media declared by the original publisher; availability checked separately from the editorial reading. - [image · Cloudflare Blog](https://blog.cloudflare.com/_image?href=https%3A%2F%2Fblog.cloudflare.com%2F_emdash%2Fapi%2Fmedia%2Ffile%2F01M6RNKQ9RKEJ9CKY6DGNF44RV.01M6RNKRJAQTN05BV66646AM7Z.png&w=1280&h=720&f=webp&fit=cover&position=center) ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Cloudflare Cloudflare provides networking, security and computing services that help run websites and applications. - [Explore this context](/entities/cloudflare) - [Reference](https://blog.cloudflare.com/) ## Editorial provenance Version 1. Publication ID: 9016faea-8ddc-4a23-8a11-74f2787c67e6. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-08T01:19:30.673Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 7fc8db8c5bfdb59ed03220ca9fcd45334c3e1a85771de0a9cd17efaaf9c7f2df. Source text hash: 49804b6cdf0924724ef5be5fe61acd2b8e4b856f7bcad938070a5039abe49765. ### uncertain — 2026-11-08T01:19:30.673Z — anthropic/claude-opus-5.5 Publication: 9016faea-8ddc-4a23-8a11-74f2787c67e6 attribution — pass: The page names Bas Westerbaan of Cloudflare, so attributing the argument to him is reasonable. The draft keeps claims attributed to him or the article and does not present them as established fact. It switches between 'Westerbaan' and 'the authors', but this matches the post's 'we' voice and is not a misattribution. > Bas Westerbaan summary — uncertain: The summary is cut off mid-sentence: 'and the security of the proposed'. Smallest repair: complete or remove that clause. Central terms are not explained in plain language: post-quantum, VOLE-in-the-Head, multivariate cryptography, UOV, anchor, moderator and endorsement. A non-specialist cannot tell what these mean. Suggested term-library tooltips: VOLE-in-the-Head, UOV, MOLE anchor/moderator. Otherwise the summary faithfully captures the forgery-versus-privacy distinction and the issuer-hiding goal. It also keeps the conditional milestone claim ('If these numbers hold'). > If these numbers hold, then we've already reached an important milestone: the transition to PQ anonymous credentials for the web can now shift from cryptography design to protocol engineering. date — pass: originalPublished is 2026-11-06T14:00Z, based on the publisher page. It matches the feed entry and comes before first observation. Nothing indicates an earlier first publication. support — pass: Each claim's excerpt supports it. The draft correctly frames amortization as a proposed engineering response and the estimates as subject to change. The risk statements match the source: a break would affect forgery, not privacy, and the multivariate commitments carry a privacy risk. 'Develop now' is supported by the source's statement that now is the time to develop alternatives. No unsupported benefits are implied. > Notably, the risk here is not just to unforgeability, but also to client privacy. A lot more study is needed. media — pass: The selected media is the verified direct link to the original Cloudflare article. This gives readers the easiest access to the source. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/3d1569726d7cafaae9981a6245a46ff9f3bb0b094d057704996d36ac2e81c6fd/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/cloudflare-s-bas-westerbaan-outlines-a-path-to-post-quantum-3d156972.json)