The Signal
Cloudflare Puts Post-Quantum GeoKey Manager Into Closed Beta
Cloudflare has launched a closed beta of a post-quantum GeoKey Manager that restricts where customer decryption keys can be used. The system combines ML-KEM-768 and X25519, with general availability planned for the first quarter of 2027.
Quantum.world Team · Written with AI · fact-checked ·
Cloudflare launched a closed beta on October 23 for a post-quantum version of GeoKey Manager, its system for restricting where customer private keys can be decrypted. The company says the service is intended to keep those keys inside a customer-selected geography while adding protection against attacks that collect encrypted data now and seek to decrypt it later with quantum computers.
General availability is planned for the first quarter of 2027. Cloudflare says the beta supports its Data Localization Suite, while separate work remains to bring the new cryptography to the company’s existing geographic controls for CDN certificate keys.
Regional key access, not regional data routing
GeoKey Manager governs where Cloudflare servers may unwrap and use protected private keys. It does not determine where traffic is routed, where tunnels terminate or where inspection takes place; Cloudflare describes those functions as separate parts of its Regional Services offering.
The distinction matters for a global network that replicates customer data across servers for availability. Cloudflare distributes wrapped private keys and their metadata through Quicksilver, its global configuration system, but keeps the regional root keys on a separate provisioning path. A server can unwrap a customer key only if it has the root key authorized for that region and service.
Cloudflare’s authors describe the aim this way: GeoKey Manager implements this by wrapping each decryption key such that it can only be decrypted by Cloudflare servers that are located in the allowed geography. The system also associates wrapped keys with a service context, a regional boundary and a key-generation epoch, so a key for Tunnel in Germany, for example, is distinct from one for Gateway in the same region.
ML-KEM-768 shares the job with X25519
Cloudflare says the Cloudflare One path uses Hybrid Public Key Encryption, combining the post-quantum ML-KEM-768 mechanism with the classical X25519 key exchange. HKDF-SHA-256 derives keys, while AES-256-GCM provides authenticated encryption. The company’s stated design goal is to retain confidentiality if at least one of the classical or post-quantum components remains secure.
Each regional root key is a 256-bit symmetric secret. Cloudflare derives application-specific asymmetric key pairs from it; the public component wraps customer private-key material, while the private component is needed to unwrap it. The wrapped material can travel across the network, but the regional root key required to open it does not.
Chetan Agrawal, Arka Nayan and Erik Engstrom, Cloudflare write: “Combining post-quantum and classical components preserves confidentiality as long as at least one component remains secure.”
Missing regional keys stop service
The system ties server authorization to hardware identity and location. Cloudflare says its provisioning service checks a server’s registered Trusted Platform Module identity against Zinc, the company’s server inventory, before issuing a token that permits access only to regional root keys approved for that location.
Authorized servers load the roots into the Linux kernel keyring rather than saving them to disk. The edge key service uses in-memory copies, and a restart removes the keys until the server authenticates and provisions them again. If a required root key is missing or malformed at startup, the service does not initialize; if a request calls for a key unavailable in that region, Cloudflare says the request is rejected rather than decrypted elsewhere.
Regional membership changes as Cloudflare adds or retires servers and data centers. Its provisioning layer refreshes those permissions several times a day and synchronizes the authorized keys when membership changes, without requiring customer action.
CDN integration is still separate work
Cloudflare says the new GeoKey Manager will underpin improved Regional Services capabilities for Cloudflare One, which it plans to announce in the coming months. Bringing the post-quantum system to existing geographic controls for CDN certificate keys is a separate integration still in development; the company says it will share testing and transition details later.
For now, the announcement is a closed-beta launch, not a general release across Cloudflare’s CDN. The company places general availability in Q1 2027 and says current Data Localization Suite customers regionalizing CDN traffic can register interest in testing ahead of that service’s broader availability.