Cloudflare MOLE: post-quantum Privacy Pass design with 4.3KB to 12KB tokens, not yet deployed
Cloudflare researchers propose MOLE, a post-quantum framework for anonymous rate-limiting tokens, with estimated sizes far below a 2023 attempt but no proofs or standard yet.
· 5 min read
Written by AI from the sources linked below. How we use AI
On this page
Cloudflare researchers have published an early design for a post-quantum version of Privacy Pass, the system that lets a website rate-limit visitors without CAPTCHAs, accounts or fingerprinting. Their framework, provisionally called MOLE, aims to keep tokens unlinkable while making them safe against a future quantum computer, and the authors say each operation takes only a few milliseconds in their implementation. It is not a standard and is not deployed, but the size figures are far smaller than a 2023 attempt, which makes it worth understanding if you follow privacy or post-quantum work.
Key points
- Cloudflare's Bas Westerbaan published "The post-quantum future of web privacy" on 6 November 2026, describing the MOLE framework (Moderation Of unLinkable Endorsements) and two instantiations, VOLE-IHAT and VOLE-ACT.
- Privacy Pass today uses classical cryptography (RSA and elliptic curves), so a quantum attacker could forge tokens and bypass rate limits. Cloudflare says privacy, in contrast, is "unconditionally private" and does not depend on quantum-vulnerable assumptions.
- The estimated sizes for redemption or spending are 4.3KB (PoMFRIT with UOV), 6.5KB (VOLE-IHAT) and 12.0KB (VOLE-ACT), with public keys of 46.6KB.
- Cloudflare says each operation takes a few milliseconds in its implementation, and that the figures are subject to change.
- This is research: the security proofs are still to be done, and the underlying UOV and MAYO signature schemes have had less cryptanalysis than RSA.
What happened
Cloudflare's research team posted the article on its blog, with an implementation at github.com/cloudflareresearch/vole-mole. It is written for cryptographers and protocol engineers, but its problem statement is plain. Privacy Pass lets a client collect tokens that a site can later accept as proof the client passed some check, without being able to tell which issuance produced which token. The RFC that defines the architecture, RFC 9576, lists the roles (client, origin, issuer, attester) and the unlinkability goals, including that an origin cannot connect a redemption to its issuance even if issuer and attester collude.
The trouble is the signatures that make those tokens. A quantum computer could forge RSA or elliptic-curve signatures, and with them tokens, letting an attacker skip rate limits. Simply swapping in a standard post-quantum signature is costly: Cloudflare notes an ML-DSA-44 signature is 2,420 bytes against 64 bytes for ECDSA-P256, and Privacy Pass needs more than a plain signature: the issuer must not be able to link a token to its issuance.
MOLE's answer is to let a client prove that an endorsement came from one of a set of trusted issuers ("anchors") without revealing which one, then receive a credential for the session from the moderator. Credentials need not be publicly verifiable, so many kinds can be plugged in, such as blind signatures, anonymous credit tokens or anonymous rate-limited credentials.
How it works
Blind signatures. The client commits to its message, the issuer signs the commitment without seeing the message, and the client later proves it knows a valid signature and the opening. Issuance and presentation show different objects, which keeps them unlinkable.
VOLE-in-the-Head. The proof system underneath is VOLE-in-the-Head (VOLEitH), a zero-knowledge technique from Baum et al. (Crypto 2023). It is simple to implement and efficient for statements built from equations over small binary fields, but it is not succinct, so proofs grow with the size of what is being proved.
Multivariate signatures. Cloudflare pairs it with two multivariate signature schemes. Unbalanced Oil and Vinegar (UOV) has signatures of about 135 bytes but public keys of 46.6KB. MAYO has smaller keys and slightly larger signatures. A related blind signature, PoMFRIT (Baum et al., USENIX Security 2026), is built on VOLEitH and MAYO; swapping MAYO for UOV brings its signature to about 4.3KB.
Hash choice. The design uses Keccak (through TurboSHAKE) because its bitwise operations map naturally to VOLEitH constraints. Cloudflare also discusses cheaper variants: fewer hashes, 12 rounds instead of 24, and an 800-bit state instead of 1600. Some of these rely on assumptions the post says may be too optimistic, such as a "one-more-UOV" assumption.
The numbers
Cloudflare's estimates, all using the UOV parameter set uov-Ip and FAEST-EM-128s for the proofs:
| Scheme | Issuance | Presentation |
|---|---|---|
| PoMFRIT (with UOV) | under 1KB | 4.3KB (redemption) |
| VOLE-IHAT | 5.6KB | 6.5KB (redemption) |
| VOLE-ACT | 5.4KB | 12.0KB (spend) |
For comparison, the 2023 paper "Post-Quantum Privacy Pass via Post-Quantum Anonymous Credentials" by Policharla, Westerbaan, Faz-Hernandez and Wood reported tokens of 85 to 175KB, generation times of 0.3 to 5 seconds and verification of 20 to 30ms, trading token size against generation time. Cloudflare's new estimates are an order of magnitude or more smaller, though the figures compare different designs and are not a like-for-like benchmark. The post says replacing RSA blind signatures with PoMFRIT would carry overhead comparable to replacing ECDSA with ML-DSA.
Where it fits
Cloudflare has been moving other parts of its stack to post-quantum cryptography; we covered its post-quantum Geo Key Manager beta earlier. That work protects key exchange against harvest-now, decrypt-later attacks. MOLE addresses a different problem, the authenticity of anonymous tokens, where a future quantum computer would forge rather than eavesdrop. The two are separate efforts, and one does not depend on the other.
What it means
For site operators. Nothing changes today. Privacy Pass has around ten years of deployment behind it, including iCloud Private Relay and Privacy Gateway, according to Cloudflare. MOLE is a path to keeping that privacy and rate limiting once quantum forgery is a realistic worry.
For protocol engineers. Cloudflare says that if the numbers hold, the work shifts from designing cryptography to engineering a protocol. One open problem it names is amortising a single redemption across several requests, since 4 to 12KB per request would be heavy.
For privacy. The post stresses that a quantum break of the signature would let an attacker forge tokens, not unmask users: Privacy Pass's privacy does not depend on quantum-vulnerable assumptions.
What we don't know yet
- Whether the security proofs go through. Cloudflare says they are still needed, showing security as long as UOV is secure.
- How UOV and MAYO fare under further cryptanalysis. Parameters may change and add cost; for UOV, NIST Level 3 parameters may be preferable to Level 1, the post says.
- Whether the optimisation assumptions are valid. A break there would allow token forgery but not privacy violations, according to the post.
- When, or whether, MOLE becomes a standard. The post says it is a collaboration with others including Mozilla, but it is not a standard or a deployed system.
- How 46.6KB public keys would be distributed in practice.
What to watch next
Security proofs and third-party analysis of UOV and MAYO, any move to bring MOLE to the standards bodies that handle Privacy Pass, and the results of the open work on amortising redemptions.
Sources
Written by
The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.
Read next
Harvard breach added to Have I Been Pwned: 850,500 alumni and donor emails, what to do
Have I Been Pwned has added the Harvard alumni and fundraising breach, with about 850,500 addresses and details such as donations and family members.
audiotale.net team6 min read
Kaspersky: Lazarus malware in Operation FlashHole uses ML-KEM-1024 post-quantum encryption against South Korean firms
Kaspersky's 21 October 2026 report says a Lazarus campaign against South Korean software, construction and telecom-equipment firms uses NIST's ML-KEM-1024 to hide later malware payloads.
audiotale.net team7 min read
CVE-2026-19868: SonicWall SonicOS SSL-VPN SAML MFA bypass exploited, upgrade now
CISA added the SonicOS SSL-VPN flaw to its exploited-vulnerabilities list on 6 November. It matters only where VPN logins use SAML, and SonicWall lists no workaround.
audiotale.net team5 min read