# Cloudflare explores post-quantum blind signatures for private rate limiting

published: 2026-11-06T16:06:02.531Z
topic: identity
source: https://blog.cloudflare.com/vole-mole/
url: https://aiagentnews.io/stories/cloudflare-explores-post-quantum-blind-signatures-for-private-rate-limiting

Cloudflare is developing MOLE, a successor to Privacy Pass that aims to rate limit agentic traffic without tying clients to accounts or fingerprints, and it proposes a post-quantum design built on VOLE-in-the-Head and UOV. The design is still research, and the company says open questions about multivariate cryptanalysis and security assumptions need more study.

Privacy Pass lets site operators rate limit clients with tokens that cannot be linked back to the client that received them, avoiding CAPTCHAs and accounts. Cloudflare says the current version relies on RSA and elliptic curves, so a quantum attacker could forge tokens and bypass rate limits, although the privacy guarantee would hold against any attacker.

MOLE, short for Moderation Of unLinkable Endorsements, extends this by hiding which issuer created a token, so sites cannot treat clients differently based on the issuer. Cloudflare outlines a construction that combines VOLE-in-the-Head zero-knowledge proofs with the UOV multivariate signature scheme, derived from the PoMFRIT blind signature. It estimates a blind signature of 4.3KB with UOV, compared with the 6.7KB PoMFRIT record that uses MAYO.

The post flags open risks. Multivariate cryptanalysis is still maturing, and one optimization depends on a one-more-UOV assumption that the authors say may be overly optimistic. Researchers at UC San Diego and INRIA recently forged a 1024-bit RSA signature using a Privacy Pass issuer as a signing oracle, while Privacy Pass uses 2048-bit RSA, and Cloudflare says more study is required.

## Why it matters if you build agents

Agent builders may eventually get rate-limit admission through tokens that do not tie requests to an account or a device fingerprint. Nothing described here is deployed, so current integrations should keep relying on existing rate limiting and challenge mechanisms. Watch how the larger signature sizes and the issuer-hiding design affect which clients sites are willing to admit.