RSA and elliptic-curve cryptography have underpinned internet security for decades, but both are vulnerable to sufficiently powerful quantum computers. Those machines do not exist yet, though the timeline is compressing faster than many expected. The good news is that standardized replacements are already available: ML-KEM for encryption and ML-DSA for digital signatures, both finalized by NIST in 2024 after an eight-year international competition.
Cloudflare reports that the majority of its traffic already uses ML-KEM encryption, addressing the so-called harvest-now-decrypt-later threat. The harder problem is authentication. The company is targeting full post-quantum security by 2029, which requires deploying post-quantum signatures across authentication systems before quantum computers capable of breaking classical cryptography become a reality.
The Case for ML-DSA Now
ML-DSA is the best all-around post-quantum signature scheme standardized today, but it carries real costs. Its public key runs to 1,312 bytes and its signature to 2,420 bytes, compared with 32 and 64 bytes respectively for Ed25519. Several optimization techniques common with RSA and ECC are also not applicable. Despite those drawbacks, Cloudflare’s position is direct: better algorithms are coming, but they will not be ready in time for the first migration. ML-DSA is available now, and deployment cannot wait.
What Is Still on the Horizon
NIST recently announced that nine post-quantum signature schemes have advanced to the third round of its signatures on-ramp process. A draft standard for FN-DSA (previously known as Falcon), selected in an earlier competition round, is also expected soon. Cloudflare has tracked this space closely for several years and published analysis in 2021, 2022, 2024, and 2025.
Comparing the candidate algorithms highlights a fundamental challenge. Ed25519 remains the best all-around performer on nearly every metric, including key size, signature size, and signing speed. No single post-quantum scheme matches it across the board. The field instead splits into two rough groups:
- Specialists that approach elliptic-curve performance on one or two metrics but have significant weaknesses elsewhere, making them well suited to specific deployment scenarios.
- Generalists such as ML-DSA that do not match elliptic curves on any individual metric but are broadly usable without major constraints.
Notable candidates in the third round include HAWK, MAYO, SNOVA, SQIsign, and several proof-of-knowledge schemes such as MQOM, SDitH, and FAEST. Each involves trade-offs across public key size, signature size, signing speed, and verification speed. SQIsign, for example, achieves a remarkably compact 65-byte public key and 148-byte signature, but signing is slow and the implementation is difficult to make timing-side-channel safe. Multivariate schemes like UOV offer fast signing but carry public keys measured in tens of kilobytes.
Why the Search Still Matters
Even though these next-generation algorithms will not be ready for the initial post-quantum migration, the research is not wasted effort. Future protocol updates, constrained environments, and use cases where ML-DSA’s size overhead is prohibitive will all benefit from smaller, faster, or more flexible options. Cloudflare describes the continued investment in NIST’s evaluation process as the best use of its limited resources, even given the immediate pressure to ship ML-DSA deployments today.
For WordPress site owners and hosting operators, the practical takeaway is straightforward. TLS connections to Cloudflare-fronted sites are already gaining post-quantum encryption protection. Signature-layer protection across authentication and certificate infrastructure is the next frontier, and ML-DSA is the algorithm that will carry that migration forward, imperfect as it is.