Cloudflare opens closed beta of post-quantum GeoKey Manager
Original title: Bringing post-quantum cryptography to geographically fenced key management
Hybrid ML-KEM-768 and X25519 keep TLS private keys unwrappable only in a chosen region; general availability is planned for Q1 2027.
Cloudflare launched a post-quantum geographically restricted key manager in closed beta for its Data Localization Suite. Wrapped decryption keys can be unwrapped only by servers in the customer-selected region, using hybrid ML-KEM-768 and X25519 because Cloudflare says no production-ready post-quantum attribute-based encryption scheme exists. The edge key service fails closed if a required regional root key is missing. General availability is planned for Q1 2027.
- A regional root key is a symmetric secret tied to one region.
- Application-specific key pairs are derived for one service, such as Gateway or Tunnel.
- GeoKey Manager does not control routing, tunnel termination, or where inspection happens.
- A Germany request attempting decryption in Spain or France would fail.
- Most regions will be selectable, with possible product-specific caveats.
- Vendors
- Cloudflare
From the original article
11 min read at blog.cloudflare.com
Cloudflare's new post-quantum GeoKey Manager protects geographically fenced decryption keys from harvest now, decrypt later attacks. Learn how we redesigned our cryptography stack to support strict data sovereignty in a post-quantum world.
By Chetan Agrawal · blog.cloudflare.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.