--- title: Preventing quantum downgrade attacks against IPsec description: Cloudflare and the IETF's IPSECME Working Group developed a new IKEv2 extension, IKE_SA_INIT_FULL_TRANSCRIPT_AUTH, to close a decade-old design flaw in IPsec... canonical: https://daily.dev/posts/preventing-quantum-downgrade-attacks-against-ipsec-r3iie1prt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Preventing quantum downgrade attacks against IPsec | daily.dev og:description: Cloudflare and the IETF's IPSECME Working Group developed a new IKEv2 extension, IKE_SA_INIT_FULL_TRANSCRIPT_AUTH, to close a decade-old design flaw in IPsec... og:url: https://daily.dev/posts/preventing-quantum-downgrade-attacks-against-ipsec-r3iie1prt og:image: https://api.daily.dev/og/posts/r3IiE1PrT.png og:image:alt: Preventing quantum downgrade attacks against IPsec og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Preventing quantum downgrade attacks against IPsec **[Cloudflare](https://daily.dev/sources/cloudflare)** · 15 min read · 0 upvotes · 0 comments ## Summary Cloudflare and the IETF's IPSECME Working Group developed a new IKEv2 extension, IKE_SA_INIT_FULL_TRANSCRIPT_AUTH, to close a decade-old design flaw in IPsec that lets a quantum-capable attacker downgrade post-quantum tunnels to classical cryptography and decrypt traffic. Because IKEv2 endpoints previously signed only their own outbound messages rather than the full handshake transcript, an on-path attacker could create a split view of the conversation and force a fallback to classical Diffie-Hellman key agreement, which a quantum computer could then break in real time. The new extension has both parties sign the entire transcript and uses unconditional notification so any attempt to strip the extension causes authentication to fail. Cloudflare has rolled out beta support for this protection in Cloudflare WAN and Magic Transit, enabled via an opt-in feature flag, and the extension is on track to become an RFC. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the quantum downgrade attack against IPsec and how does it work? It exploits an IKEv2 design flaw where each endpoint signs only its own outbound handshake messages rather than the full transcript, letting an on-path attacker create a split view of the conversation. The attacker forces both sides to fall back to classical Diffie-Hellman key agreement, then uses a quantum computer in real time during the handshake to recover the encryption key and decrypt traffic between otherwise post-quantum-capable endpoints. _Teams hardening IPsec tunnels against emerging threats can track protocol security research like this on daily.dev._ ### How does the IKE_SA_INIT_FULL_TRANSCRIPT_AUTH extension prevent IPsec downgrade attacks? It has both the initiator and responder sign the entire handshake transcript instead of only their own outbound messages, so any tampering causes a signature mismatch and authentication failure. Support is signaled unconditionally in the initial exchange by both parties, meaning an attacker who strips the notification from either side breaks the handshake rather than silently downgrading it, closing the split-view vulnerability that enabled the attack. _Engineers rolling out post-quantum IKEv2 support can follow implementation details like these through daily.dev._ ### How can I enable full transcript authentication for IPsec on Cloudflare WAN or Magic Transit? Customers can request their account team enable the ipsec_downgrade_protection feature flag on their account, which is currently in beta. Once enabled, the IKE_SA_INIT_FULL_TRANSCRIPT_AUTH notification is sent during the IKE_SA_INIT response; the flag exists to guard against the unlikely case that a customer's IKEv2 initiator mishandles the new notification, and it will be enabled broadly after sufficient beta testing. _Admins planning this rollout can stay on top of vendor-specific beta flags and configs via daily.dev._ ## Similar posts on daily.dev - [Post-quantum encryption for Cloudflare IPsec is generally available](https://daily.dev/posts/post-quantum-encryption-for-cloudflare-ipsec-is-generally-available-bafxrwzks) · Cloudflare · 0 upvotes · 0 comments - [Standardizing Post-Quantum IPsec: Cloudflare Adopts Hybrid ML-KEM to Replace Ciphersuite Bloat](https://daily.dev/posts/standardizing-post-quantum-ipsec-cloudflare-adopts-hybrid-ml-kem-to-replace-ciphersuite-bloat-72husfcdu) · InfoQ · 0 upvotes · 0 comments - [Mutual Post-Quantum Auth over IKEv2 – IPsec Series, Part 8](https://daily.dev/posts/mutual-post-quantum-auth-over-ikev2-ipsec-series-part-8-xm1etcoxb) · Cisco · 1 upvotes · 0 comments - [Cloudflare One is the first SASE offering modern post-quantum encryption across the full platform](https://daily.dev/posts/cloudflare-one-is-the-first-sase-offering-modern-post-quantum-encryption-across-the-full-platform-sdtu6amge) · Cloudflare · 0 upvotes · 0 comments - [Why Standard Encryption Isn’t Enough: The Case for Post-Quantum AI Infrastructure Security](https://daily.dev/posts/why-standard-encryption-isn-t-enough-the-case-for-post-quantum-ai-infrastructure-security-sa9yfmonj) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#quantum-computing](https://daily.dev/tags/quantum-computing), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/preventing-quantum-downgrade-attacks-against-ipsec-r3iie1prt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Preventing quantum downgrade attacks against IPsec","url":"https://daily.dev/posts/preventing-quantum-downgrade-attacks-against-ipsec-r3iie1prt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/preventing-quantum-downgrade-attacks-against-ipsec-r3iie1prt"},"datePublished":"2026-09-29T13:06:41.978Z","dateModified":"2026-09-29T13:07:08.198Z","description":"Cloudflare and the IETF's IPSECME Working Group developed a new IKEv2 extension, IKE_SA_INIT_FULL_TRANSCRIPT_AUTH, to close a decade-old design flaw in IPsec...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/847ebea5b4959abf1a82045ad0be78e7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/847ebea5b4959abf1a82045ad0be78e7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Cloudflare","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Cloudflare","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/38522e1d11354cd6b7af66f9d4316735","url":"https://daily.dev/sources/cloudflare"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/preventing-quantum-downgrade-attacks-against-ipsec-r3iie1prt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"quantum-computing,cryptography","timeRequired":"PT15M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Cloudflare","item":"https://daily.dev/sources/cloudflare"},{"@type":"ListItem","position":3,"name":"Preventing quantum downgrade attacks against IPsec"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/preventing-quantum-downgrade-attacks-against-ipsec-r3iie1prt#faq","mainEntity":[{"@type":"Question","name":"What is the quantum downgrade attack against IPsec and how does it work?","acceptedAnswer":{"@type":"Answer","text":"It exploits an IKEv2 design flaw where each endpoint signs only its own outbound handshake messages rather than the full transcript, letting an on-path attacker create a split view of the conversation. The attacker forces both sides to fall back to classical Diffie-Hellman key agreement, then uses a quantum computer in real time during the handshake to recover the encryption key and decrypt traffic between otherwise post-quantum-capable endpoints. Teams hardening IPsec tunnels against emerging threats can track protocol security research like this on daily.dev."}},{"@type":"Question","name":"How does the IKE_SA_INIT_FULL_TRANSCRIPT_AUTH extension prevent IPsec downgrade attacks?","acceptedAnswer":{"@type":"Answer","text":"It has both the initiator and responder sign the entire handshake transcript instead of only their own outbound messages, so any tampering causes a signature mismatch and authentication failure. Support is signaled unconditionally in the initial exchange by both parties, meaning an attacker who strips the notification from either side breaks the handshake rather than silently downgrading it, closing the split-view vulnerability that enabled the attack. Engineers rolling out post-quantum IKEv2 support can follow implementation details like these through daily.dev."}},{"@type":"Question","name":"How can I enable full transcript authentication for IPsec on Cloudflare WAN or Magic Transit?","acceptedAnswer":{"@type":"Answer","text":"Customers can request their account team enable the ipsec_downgrade_protection feature flag on their account, which is currently in beta. Once enabled, the IKE_SA_INIT_FULL_TRANSCRIPT_AUTH notification is sent during the IKE_SA_INIT response; the flag exists to guard against the unlikely case that a customer's IKEv2 initiator mishandles the new notification, and it will be enabled broadly after sufficient beta testing. Admins planning this rollout can stay on top of vendor-specific beta flags and configs via daily.dev."}}]} ```