Cloudflare explores post-quantum blind signatures for private rate limiting

Privacy Pass lets site operators rate limit clients with tokens that cannot be linked back to the client that received them, avoiding CAPTCHAs and accounts. Cloudflare says the current version relies on RSA and elliptic curves, so a quantum attacker could forge tokens and bypass rate limits, although the privacy guarantee would hold against any attacker.

MOLE, short for Moderation Of unLinkable Endorsements, extends this by hiding which issuer created a token, so sites cannot treat clients differently based on the issuer. Cloudflare outlines a construction that combines VOLE-in-the-Head zero-knowledge proofs with the UOV multivariate signature scheme, derived from the PoMFRIT blind signature. It estimates a blind signature of 4.3KB with UOV, compared with the 6.7KB PoMFRIT record that uses MAYO.

The post flags open risks. Multivariate cryptanalysis is still maturing, and one optimization depends on a one-more-UOV assumption that the authors say may be overly optimistic. Researchers at UC San Diego and INRIA recently forged a 1024-bit RSA signature using a Privacy Pass issuer as a signing oracle, while Privacy Pass uses 2048-bit RSA, and Cloudflare says more study is required.

Agent builders may eventually get rate-limit admission through tokens that do not tie requests to an account or a device fingerprint. Nothing described here is deployed, so current integrations should keep relying on existing rate limiting and challenge mechanisms. Watch how the larger signature sizes and the issuer-hiding design affect which clients sites are willing to admit.