| ALPN |
Application-Layer Protocol Negotiation. The TLS extension that picks HTTP/2 or HTTP/1.1. pqdoctor offers h2 and http/1.1, and leaves it out for mail. |
| Automatic key exchange |
Cloudflare’s default for connections to origins: it uses post-quantum key agreement when the origin supports it. |
| CBOM |
Cryptography Bill of Materials. An inventory of the cryptography a system uses. Flarebox exports one in CycloneDX 1.6 format. |
| Cause code |
pqdoctor’s stable, machine-readable reason for a verdict, e.g. no-mlkem. See Causes and fixes. |
| CNSA 2.0 |
The NSA’s Commercial National Security Algorithm Suite 2.0, for US national security systems. It requires ML-KEM-1024; hybrid ML-KEM-768 doesn’t meet it. |
| Custom Origin Trust Store |
A Cloudflare zone’s list of CAs it trusts for origin certificates. Needed for Cloudflare to accept an ML-DSA origin certificate from your own CA. Requires Advanced Certificate Manager. |
| Dual certificates |
A server configured with two certificates, e.g. ECDSA and ML-DSA, that picks one per client from what the client supports. |
| Full (strict) |
Cloudflare’s encryption mode that requires a valid certificate on the origin. An invalid one gives error 526. |
| Harvest now, decrypt later |
Recording encrypted traffic today to decrypt it once a large quantum computer exists. Why key exchange is the urgent half of the migration. |
| HelloRetryRequest (HRR) |
A TLS 1.3 server reply asking the client to retry with a key share for a different group. pqdoctor uses it to tell “supports” from “prefers” post-quantum. |
| Hybrid key exchange |
Running a classical and a post-quantum key exchange together and combining both secrets, so the result is safe if either holds. |
| Key share |
A client’s public key for one group, sent in the ClientHello so the server can answer in one round trip. |
| Middlebox |
A device between client and server that inspects traffic: a load balancer, firewall or TLS-inspecting proxy. Old ones can break on large or unfamiliar ClientHellos. |
| ML-DSA |
Module-Lattice-Based Digital Signature Algorithm, FIPS 204. The post-quantum signature standard. ML-DSA-44 is the size Cloudflare recommends for origins. TLS codepoints 0x0904 to 0x0906. |
| ML-KEM |
Module-Lattice-Based Key-Encapsulation Mechanism, FIPS 203. The post-quantum key exchange standard, formerly Kyber. |
| Origin |
The server behind a CDN that actually serves your site. |
| Origin CA |
Cloudflare’s own certificate authority for origin certificates. Trusted by Cloudflare only. |
| Ossification |
When middleboxes come to depend on what a protocol looked like in the past, so new but valid messages, like large post-quantum ClientHellos, get dropped. |
| Probe |
One of pqdoctor’s seven ClientHellos. See Probes and wire format. |
| sntrup761 |
Streamlined NTRU Prime, the post-quantum part of OpenSSH’s sntrup761x25519-sha512 key exchange, its default from 9.0 to 9.9. |
| STARTTLS |
Upgrading a plaintext mail connection (SMTP, IMAP, POP3) to TLS. |
| Tranco |
A research-oriented ranking of popular domains. The study used its top 10,000. |
| X25519 |
The classical elliptic-curve key exchange most TLS connections use today. Codepoint 0x001D. |
| X25519Kyber768Draft00 |
The pre-standard hybrid of X25519 and Kyber. Browsers have dropped it. Codepoint 0x6399. |
| X25519MLKEM768 |
The standard hybrid of X25519 and ML-KEM-768 for TLS 1.3. Codepoint 0x11EC. What “post-quantum” means in pqdoctor’s verdicts. |
