Cloudflare adds beta downgrade protection to IPsec services

Cloudflare says customers can request beta protection against cryptographic downgrade attacks for IPsec connections in Cloudflare WAN and Magic Transit. The change implements an extension developed with the IETF that helps endpoints detect an attacker trying to force a connection away from post-quantum key exchange during setup. IPsec encrypts network traffic, and both ends of a connection must support the extension for the protection to work. Customers must ask an account manager to enable it. Cloudflare says the quantum attack addressed by the change would require computation during the connection handshake.