MOLE explores post-quantum privacy for web access credentials
Post-quantum planning for the web extends beyond the key-agreement mechanisms used in TLS. Privacy Pass, which sites can use to moderate traffic without tying token use to a user’s identity, also relies on classical cryptography. Cloudflare says quantum-capable attackers could eventually forge its tokens, potentially bypassing controls such as rate limits. A proposed system called MOLE aims to preserve privacy while creating a path toward post-quantum credentials.
Privacy Pass tokens let a client obtain credentials from an issuer and later redeem them with a site. The protocol’s blind-signature design prevents the issuer from seeing the token’s underlying message during issuance, making it difficult to link that event to redemption. Cloudflare says it has used Privacy Pass for about a decade in applications including privacy proxies such as iCloud Private Relay and relays such as Privacy Gateway.
The current approach has a limitation: token verification can reveal which issuer created a token. That information can be useful in some settings, but other applications need only to know that a credential came from a trusted source. MOLE, short for “Moderation Of unLinkable Endorsements,” is intended to hide the identity of the issuing party as well.
Hiding the issuer
In the MOLE model, a trusted entity called an anchor issues an endorsement. A client later presents it to a moderator, which checks that it came from one of a set of trusted anchors without learning which one. If the endorsement is accepted, the moderator issues a MOLE credential for the client’s subsequent interaction with a site.
That separation could help sites treat eligible clients consistently, rather than making decisions based on the identity of the issuer. The design is also intended to support different credential types, including anonymous credit tokens and rate-limited credentials. Cloudflare says these capabilities could help manage automated or agentic traffic that consumes site resources, while making it easier for different kinds of clients to participate.
Cloudflare characterizes Privacy Pass’s unlinkability as unconditional: an observer, including a quantum attacker, cannot connect a token’s redemption to its issuance. That privacy property does not prevent token forgery. Because the existing protocol uses classical cryptography, the organization says a sufficiently capable quantum attacker could forge tokens and evade a site’s controls. MOLE’s proposed newer capabilities, it says, can be built to retain privacy after cryptographically relevant quantum computers become available. This does not mean that a complete post-quantum replacement is already deployed.
Cryptographic trade-offs
One obstacle is size. Cloudflare compares a 2,420-byte ML-DSA-44 signature with a 64-byte ECDSA-P256 signature, illustrating why post-quantum components may impose greater bandwidth and processing costs. The organization argues that systems will need to be redesigned around those costs rather than relying on direct, drop-in substitutions.
A candidate approach combines VOLE-in-the-Head (VOLEitH), a zero-knowledge proof system, with multivariate cryptography. VOLEitH lets a prover demonstrate knowledge of a secret satisfying a public condition without disclosing the secret. Its proofs can be efficient for computations expressed as equations over small binary fields. The method has also been used in FAEST, a signature scheme based on proving a relationship involving AES, and in work on multivariate signatures.
Cloudflare discusses PoMFRIT, a blind-signature construction published by Baum and colleagues at USENIX Security 2026. It reports that PoMFRIT’s blind signature is 6.7 kilobytes, with issuance requiring a few hundred bytes. Replacing its MAYO component with UOV, using the specified NIST Round 3 parameters, could reduce the signature to 4.3 kilobytes, at the cost of larger public keys. The article says this construction can be adapted to MOLE endorsements and other credential designs.
The approach uses commitments and zero-knowledge proofs so that a client can obtain a signature without exposing the message to the issuer, then later demonstrate possession without creating a link between issuance and presentation. In the proposed issuer-hiding version, the proof would also conceal which trusted anchor signed the endorsement. Cloudflare says the main proof cost comes from evaluating the Keccak permutation used in SHAKE and TurboSHAKE.
Research remains active
These results are a research direction, not evidence that the cryptographic transition is complete. Cloudflare notes that cryptanalysis of multivariate cryptography remains relatively immature and that future attacks could require changes to parameters, increasing costs. It also describes efficiency and adaptability as competing goals: MOLE is meant to support multiple kinds of credentials, but that flexibility makes careful cryptographic design essential.
For defenders, the broader takeaway is that post-quantum readiness includes privacy-preserving authentication and abuse controls, not only encrypted connections. Organizations evaluating such systems will need to consider how larger cryptographic objects affect performance, how issuer identity is handled, and what security assumptions underpin each credential. MOLE is presented as a potential framework for that work, with further research and engineering still required.
