Cloudflare Reduces TLS Handshake Retries from 52% to 3.7% with Per-Origin Measurement

Improved TLS Handshake Efficiency

Cloudflare has implemented a new system that measures the preferred TLS key agreement algorithms for each origin, moving away from a static assumption. This change has significantly reduced the occurrence of HelloRetryRequests during TLS 1.3 handshakes on scanned origins, dropping from approximately 52% to 3.7%. The improvement also resulted in a reduction of over 150 ms in p90 handshake latency.

Addressing TLS 1.3 Handshake Challenges

TLS 1.3 requires clients to commit to a key agreement algorithm in their initial packet. If the client's guess is incorrect, the origin server issues a HelloRetryRequest, forcing the client to send a second ClientHello and incurring an additional round trip. Cloudflare's previous static assumption, which guessed X25519 for all origins, was suboptimal for about 30% of connections, as some origins prefer P-256 or P-384.

Automatic Key Exchange Implementation

The new feature, called Automatic Key Exchange, is an extension of Automatic SSL/TLS. It actively probes each origin to determine its supported and preferred key agreement algorithms. This probing occurs outside the production traffic path and is conducted daily to adapt to changes in load balancers and TLS libraries. Cloudflare prioritizes X25519MLKEM768 where an origin supports this post-quantum hybrid keyshare.

Discovery of Hidden Post-Quantum Support

Active probing revealed thousands of origins with post-quantum support that was not evident through passive traffic. Many origins accept a classical keyshare without issuing a retry, even when they support stronger algorithms. This discovery highlights the limitations of passive observation compared to active measurement in identifying optimal TLS configurations.

Considerations for Post-Quantum Keyshares

A constraint with post-quantum keyshares like X25519MLKEM768 is their larger size (1,216 bytes compared to X25519's 32 bytes), which can cause the ClientHello to exceed a single network packet. While the TLS standard permits multi-packet segments, some legacy middleboxes and origin servers may fail when a ClientHello is split across TCP segments. Cloudflare's earlier studies showed that approximately 0.34% of scanned origins failed to complete handshakes when initially sent a post-quantum keyshare.