Preventing quantum downgrade attacks against IPsec

Cloudflare describes a design flaw in IPsec/IKEv2 that permits a quantum-capable on-path attacker to perform a downgrade attack during parameter negotiation, enabling real-time decryption of traffic by forcing classical key agreement and exploiting the protocol’s lack of full transcript authentication; Cloudflare and the IETF developed an IKEv2 extension (IKE_SA_INIT_FULL_TRANSCRIPT_AUTH) to provide full transcript authentication as a downgrade-resistant mitigation, which Cloudflare has implemented in beta for customers.