Cloudflare’s 6 November 2026 research update describes candidate protocols called VOLE-IHAT and VOLE-ACT. They explore anonymous tokens with resistance to future quantum forgery. This is an update on work in progress, not a production rollout.
Separate privacy from counterfeit resistance
As Christopher Patton’s IETF presentation explains, existing blind-RSA and VOPRF Privacy Pass tokens already have information-theoretic unlinkability between issuance and redemption. A sufficiently capable quantum attacker could forge tokens without thereby learning which earlier issuance matched a redemption. That narrow guarantee does not make all browsing activity untraceable.
A useful analogy is an admission ticket: hiding where a ticket was obtained and stopping someone from manufacturing a counterfeit are separate requirements. A privacy-preserving service needs to ask about both.
What the two candidates add
- VOLE-IHAT lets a client demonstrate an endorsement from a trusted issuer set without identifying the particular issuer. Its current draft still lists unfinished security proofs.
- VOLE-ACT explores anonymous credentials carrying an updatable balance. Its draft does not provide reductions establishing unlinkability or unforgeability. Both drafts are dated 3 November and remain work in progress.
A research library, not a deployment checklist
The vole-mole repository explicitly warns that it is experimental, unaudited and unsuitable for production. Interfaces and wire formats will change. Applications must separately prevent double spending by tracking the library’s returned nullifiers, identifiers used to detect reuse.
Our practical takeaway is to follow the research without treating a working prototype as deployment approval. For an evaluation, document the privacy guarantee being tested, who maintains replay state, and what happens when that state is unavailable. Ask for reviewed security arguments and interoperable specifications before considering a migration.
These are proposed review questions. We have not run the implementation, independently measured its performance or validated its cryptographic security.