Cloudflare Researchers Sketch Post-Quantum Web Privacy Tokens: PoMFRIT Blind Signatures of 4.3 KB With 46.6 KB Public Keys and MOLE Candidates of 6.5 to 12.0 KB, but These Are Estimates for Unfinished Schemes, Security Proofs Are Pending and the Cited IETF Draft Is Expired

On November 6, 2026, Cloudflare researchers Christopher Patton, Tianyu Zhang and Bas Westerbaan published a research post on how privacy tokens on the web could survive quantum computers. This is a follow-up to the November 5 position paper on agents and sites that we covered on November 6, which named MOLE, a design for the next generation of Privacy Pass-style tokens. That paper described the plan; this post is the cryptography behind it, with the first size estimates. Nothing here is shipped. The numbers are Cloudflare's estimates for schemes still under development.

The post separates two risks. Privacy Pass today uses classical cryptography, RSA and elliptic curves, so a quantum attacker could forge tokens at will and slip past rate limits. But Privacy Pass is unconditionally private, which means no attacker, quantum or not, can link a token's redemption to its issuance. Cloudflare says the new capabilities it is designing can keep that guarantee. For existing Privacy Pass the immediate quantum pressure is on forgery resistance; experimental commitments in new schemes still need separate privacy analysis. The obstacle is size: an ML-DSA-44 signature is 2,420 bytes, while an ECDSA-P256 signature is 64 bytes.

MOLE stands for Moderation Of unLinkable Endorsements. An endorsement is issued by an anchor and redeemed by a moderator. The two sides agree on an anchor set, the public keys of the anchors the moderator trusts, and the client proves that one anchor in the set issued its endorsement without saying which one. The moderator then issues a credential that governs the client's later interaction. Hiding the issuer is the point: a site cannot treat tokens differently by who issued them, so more kinds of clients can take part. Credentials can be blind signatures, anonymous credit tokens or anonymous rate-limited credentials.

The proposed building block combines two ideas. One is VOLE-in-the-Head, a zero-knowledge proof system that is concretely efficient for statements over small binary fields. The other is multivariate signatures, in particular Unbalanced Oil and Vinegar (UOV), which has signatures of 135 bytes but public keys of 46.6 KB. A recent blind signature called PoMFRIT, published at USENIX Security 2026, reached 6.7 KB for the signature with only a few hundred bytes for issuance. The Cloudflare authors say swapping MAYO for UOV brings the signature to 4.3 KB, using NIST round 3 parameters for UOV and FAEST-EM-128s, and that this is competitive with lattice-based designs.

The post then gives estimates for the schemes it is building. With UOV, every public key is 46.6 KB. PoMFRIT with UOV costs under 1 KB at issuance and 4.3 KB at redemption. VOLE-IHAT, a candidate for MOLE endorsements, costs 5.6 KB at issuance and 6.5 KB at redemption. VOLE-ACT, a candidate for MOLE credentials, costs 5.4 KB at issuance and 12.0 KB per spend. Each operation takes a few milliseconds in the authors' implementation. These are much larger than classical equivalents, and the authors say replacing RSA blind signatures with PoMFRIT has overhead comparable to replacing ECDSA with ML-DSA. They note that a classical token might be cheap enough to redeem on every request, but a post-quantum redemption will probably have to be spread over several requests.

The caveats are the substance of the post. Cryptanalysis of multivariate schemes is still young. UOV and MAYO have held up, but parameters may change and add cost. The smallest sizes use an optimization that rests on a stronger assumption, called one-more-UOV, and the post notes that researchers from UC San Diego and INRIA recently forged a 1024-bit RSA signature by using a Privacy Pass issuer as a signing oracle, while Privacy Pass itself uses 2048-bit RSA. That forgery-only conclusion is specific to the one-more-UOV optimization. Security proofs showing the new schemes are as strong as UOV are still to be written. Ideas such as multivariate commitments and low-degree pseudorandom generators could shrink proofs further but are not yet known to be secure. The separate multivariate-commitment experiment has unresolved parameter security, and the authors explicitly say it could also put client privacy at risk.

A check on the standards side adds a limit. The post cites the Anonymous Rate-Limited Credentials draft at the IETF. The datatracker page for that draft, draft-ietf-privacypass-arc-crypto-01, lists it as an expired Internet-Draft, last revised on March 2, 2026, in a working group document marked dead. That is the status of this cited revision only. We did not check all successor drafts or other standards, so it does not establish that no active standard exists for the field.

Our reading: this is research. The roughly 4–12 KB estimates apply to presentation operations such as redemption or spend; PoMFRIT issuance is under 1 KB, with a 46.6 KB public key. If these numbers hold, the work could move from cryptographic design toward protocol engineering, but security proofs and further cryptanalysis remain. It is not a product, RFC or deployment date. Site operators should watch token size, amortized redemption and parameter changes.