Cloudflare cut origin handshake retries from 52% to 3.7% by probing
Serguey Asael Shinder2 min readTLS 1.3 is faster than its predecessor partly because the client commits to a key agreement algorithm in the first packet it sends, before the server has said anything about itself. Get it right and the handshake finishes in one round trip. Get it wrong and the server answers with a HelloRetryRequest, the exchange restarts, and the connection costs two.
Cloudflare sits on the client side of that bet several tens of billions of times a day — the post puts the figure at 45 billion daily connections to origin servers. For years the bet was the same for every origin on the internet: X25519. Its own measurements now say that choice was wrong for roughly 30% of those connections.
The fix, published at https://blog.cloudflare.com/automatic-key-exchange-for-origins/, is to stop guessing. Automatic Key Exchange probes each origin to find out which key agreement algorithms it supports and which it prefers, then leads with that one — favouring the post-quantum hybrid X25519MLKEM768 wherever the origin can speak it. Across the rollout, HelloRetryRequests fell from about 52% to 3.7%, taking more than 150 ms off handshake latency at p90, and hundreds of thousands of domains acquired post-quantum origin connections without anyone configuring anything.
What it means
The interesting move is replacing an assumption with a measurement, and it is available to anyone. X25519 was a reasonable default and it stayed reasonable for years after the population it described had changed. Nobody was wrong; the number simply drifted, and there was no instrument pointed at it. Any system that holds a default about its counterparties — a timeout, a compression choice, a batch size, a retry budget — has the same problem, and usually the same absence of an instrument.
Second: a 52% retry rate was invisible because it was not an error. Every one of those handshakes succeeded. HelloRetryRequest is the protocol working as designed, which is exactly why it can sit in the p90 for years without anyone opening a ticket. The failures you find are the ones that page you; the expensive ones are correct, slow, and silent.
Third: post-quantum arriving as a side effect is the durable part of this. The motivation given is harvest-now-decrypt-later — traffic recorded today against a future ability to read it — and the honest constraint is that the migration cannot depend on millions of operators each becoming cryptographers. A default that upgrades itself where the far end can cope is the only mechanism that reaches the long tail, and it is worth separating from the milliseconds, which are the smaller half of this announcement.