GoKawiilCloudflare's Automatic Key Exchange slashes origin handshake retries to 3.7%
Cloudflare launched Automatic Key Exchange, a feature that probes origin servers to detect which key agreement algorithms they support before committing to one, rather than always guessing X25519 as before. This measurement-based approach reduced HelloRetryRequest occurrences from about 52% to 3.7% and cut roughly 150ms off connection latency at the 90th percentile, while also enabling post-quantum key exchange (X25519MLKEM768) automatically wherever origins support it.
GoKawiil's interpretation of the reporting above, not reported fact.
Beyond the latency savings, the automatic rollout of post-quantum cryptography addresses 'harvest-now, decrypt-later' attacks, where adversaries capture encrypted traffic today to decrypt once quantum computers mature. Cloudflare frames this as essential progress toward securing the internet before 'Q-Day,' the anticipated point when classical encryption becomes breakable, arguing that widespread quantum-safe adoption must happen automatically rather than depend on site operators manually configuring cryptography.
- HelloRetryRequests dropped from ~52% to 3.7% after deploying Automatic Key Exchange.
- The feature cuts about 150ms off p90 handshake latency by probing origin server capabilities first.
- Hundreds of thousands of domains now automatically use post-quantum key exchange without manual setup.
Source: blog.cloudflare.com, 2026-09-14
Published there as: “Cloudflare AKE cuts origin HelloRetryRequests from 52% to 3.7%”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.