Cloudflare Puts Post-Quantum Lock on Regional Keys

Cloudflare has put a new version of its GeoKey Manager into closed beta, wrapping customers’ private keys with post-quantum encryption so that only its servers inside a region the customer picks can unwrap and use them. The company described the system in a blog post on Friday 23 October and said general availability is planned for the first quarter of 2027.

The product sits where two compliance demands meet. Governments, banks and healthcare providers handle data that can stay sensitive for years or decades, and many data-sovereignty rules require some of it to be processed only inside a given region. Encrypted data intercepted today could also be decrypted by a future quantum computer. Cloudflare’s answer is to make the regional fence itself quantum-resistant, using a NIST standard, while keeping its global network intact.

Keys travel everywhere but open only inside the fence

Cloudflare runs a global network, and for speed and resilience it copies customer configuration, including encrypted private keys, to servers around the world. Customers bound by sovereignty rules need their traffic decrypted only inside their region. GeoKey Manager squares the two by separating the wrapped key, which goes everywhere, from the regional root key needed to unwrap it, which is delivered only to authorised servers in that region.

The idea is not new. Cloudflare first offered geo-restricted TLS keys in 2017, and in December 2022 it put a second version into closed beta that used attribute-based encryption, describing regions with labels such as “region = European Union”. That scheme has no post-quantum equivalent: “No production-ready post-quantum ABE scheme is available today,” Cloudflare writes. Because customers need only a handful of regions, it chose a simpler design that can be made quantum-resistant.

A server earns a region’s keys by proving its identity. Its Trusted Platform Module, a hardware security chip, shows it holds a registered identity; Cloudflare’s inventory system maps that identity to a data centre and location; and a provisioning service then issues a token for only that region’s keys. The keys are held in the Linux kernel’s keyring rather than on disk, so a restart wipes them and the server must authenticate again.

Cloudflare pairs a new NIST standard with a proven algorithm

The key wrapping uses Hybrid Public Key Encryption with a hybrid mechanism that combines ML-KEM-768 and X25519. ML-KEM is the lattice-based key-encapsulation scheme NIST published as FIPS 203 in August 2024; X25519 is a widely used elliptic-curve method. “Combining post-quantum and classical components preserves confidentiality as long as at least one component remains secure,” Cloudflare says, so the scheme is protected if either half later proves weak.

The target is “harvest now, decrypt later”: an attacker records encrypted material today and waits for a quantum computer able to break classical public-key cryptography. As TSN reported this week, Australian start-up Iceberg Quantum now claims RSA-2048 could fall to fewer than 100,000 qubits, a simulated estimate for a machine nobody has built. Other large platforms have been moving their own encryption over, such as Google Meet’s switch to post-quantum cryptography for calls, and governments are drafting standards, as with Vietnam’s three draft post-quantum standards.

The system fails closed, by design

Cloudflare stresses that the system refuses rather than guesses. If a server is missing a regional root key it is configured to hold, its key service does not start. If a request needs a key for a region the server does not serve, the request is rejected. In Cloudflare’s example, a request for Germany that somehow reached Spain or France would fail, because neither holds Germany’s root key. “Failing open would mean unwrapping a customer’s private key outside its allowed region rather than rejecting the request. We never do that,” the company writes.

The design also supports key rotation. A “soft” rotation lets older wrapped keys keep working for a limited period while new ones use the latest key generation; a “hard” rotation re-wraps affected keys so the old generation can be cut off entirely.

The limits are stated too. GeoKey Manager decides only where keys can be unwrapped. Where traffic is routed, where tunnels end and where it is inspected are handled by Cloudflare’s separate Regional Services. The new version serves the Cloudflare One security products first; an improved Regional Services offering built on it is due to be announced “in a few months”, and a separate integration for Cloudflare’s CDN is still being developed. Cloudflare says most of its regions will be available, with possible product-specific caveats.

Encrypting the fence matters more than the beta label

The interesting decision here is less the algorithm than the order of work. Cloudflare could have waited for a post-quantum version of its more flexible attribute-based scheme. Instead it dropped that flexibility to get quantum-resistant protection in place first, betting that customers care more about long-lived secrecy than about fine-grained region labels. For organisations whose data must stay confidential for decades, that is the right priority: keys wrapped classically today are exactly what a “harvest now” attacker would store.

The hybrid design is also a hedge worth noting. ML-KEM is a young standard, and pairing it with X25519 means a flaw found in either one does not, on Cloudflare’s account, expose the keys.

Two caveats temper the announcement. First, every security property described comes from Cloudflare’s own write-up of a closed beta; customers will want independent assurance before relying on it for regulated data. Second, sovereignty involves more than keys. A regulator asking where data is processed will also ask about routing and inspection, which this product does not cover. The test in early 2027 is whether general availability arrives on time, and whether the CDN integration and the promised Regional Services update close those gaps.