你的浏览器在使用后量子 TLS 吗？

Why key exchange is the urgent part

Every TLS connection starts with a key exchange that agrees on the keys protecting the rest of the conversation. For a decade that has been elliptic-curve Diffie–Hellman, usually X25519 — which a large enough quantum computer could break. Nobody has such a machine yet, but traffic can be recorded today and decrypted later ("harvest now, decrypt later"), so the exchange has to be quantum-safe long before the machine exists. Signatures and certificates can wait until it does; key exchange cannot.

The answer browsers and CDNs deployed is a hybrid: X25519MLKEM768, standardized in RFC 10024, combines X25519 with ML-KEM-768 from NIST's FIPS 203, so the connection stays secure if either part holds. Chrome and Edge 131, Firefox 132 (and 135 inside HTTP/3), Safari on iOS and macOS 26 offer it by default, and large sites such as Cloudflare, Google and Amazon accept it — an earlier pre-standard Kyber hybrid, X25519Kyber768, was replaced along the way. How the hybrid fits into the TLS 1.3 handshake (RFC 9846) is shown step by step in the illustrated post-quantum handshake.

How the check knows

A browser does not tell a web page which key exchange it negotiated, but the server it talked to knows. Cloudflare publishes a small diagnostic page, /cdn-cgi/trace, that answers in plain text with facts about the connection the request arrived on: the TLS version, the HTTP version, whether the server name was encrypted (Encrypted Client Hello), and in kex the key-exchange group. When you press the button, your browser fetches that page from two hosts: pq.cloudflareresearch.com, which your browser reaches over TLS on TCP, and www.cloudflare.com, which advertises HTTP/3 and is usually reached over QUIC. The two matter separately because browsers have switched the hybrid on at different times for TLS and for QUIC — Firefox did it three releases apart. The page then names the group the trace reports, looks it up in the IANA registry of TLS groups, and says whether it is post-quantum, a pre-standard draft or classical.

What your browser should do

Next to the measurement the page puts an expectation: from the user agent string in the trace it recognises the browser and its version and says what that version does by default, with the release that changed it and a source. When the two disagree, the reason is usually outside the browser: a policy or flag that turned the hybrid off, an antivirus or corporate proxy that terminates TLS itself (Cloudflare reports Gateway and browser-isolation connections, and the page then makes no comparison), an old operating system library under an app, or a network middlebox that cannot handle the larger ClientHello. Command-line tools and libraries depend on the TLS library they were built with — paste their trace into the second tab; curl with OpenSSL 3.5 or newer, for example, uses the hybrid, while curl with LibreSSL does not.

What leaves your browser

Nothing happens until you press the button. Then your browser makes two plain GET requests to Cloudflare, without cookies or referrer, and nothing from this page goes with them; Cloudflare sees the visit like any other request to its sites, including your IP address. Its answer contains that address on an ip= line: the page drops the line before showing anything, never puts it in a link, and removes it from traces you paste. ecdsa.com's servers are not involved.

To see the rest of your browser's handshake — the cipher suites, extensions and groups it offers, summarised as a JA4 fingerprint — use the TLS fingerprint tool. To make your own servers offer the hybrid, generate a configuration with the TLS configuration generator; the background is in X25519MLKEM768 explained and Post-quantum migration in 2026.