Cloudflare announced a closed-beta post-quantum geographically restricted key manager that restricts decryption-key access to a chosen geography. General availability is planned for Q1 2027. The new PQ GeoKey Manager wraps each decryption key so that only Cloudflare servers located in the allowed geography can decrypt it, using hybrid ML-KEM-768 and X25519 key encapsulation to protect wrapped key material against harvest now, decrypt later attacks.
Post-quantum GeoKey Manager: closed beta and planned availability
The closed-beta launch supports Cloudflare's Data Localization Suite and is planned for general availability in Q1 2027. Most regions will be available for customers to regionalize their workflow, and there may be product-specific caveats. Customers select a region, and Cloudflare manages everything else needed to unwrap private keys within that region's boundary.
Where key use ends and regional processing begins
GeoKey Manager controls where wrapped private keys can be unwrapped and used on the data plane. It does not control where requests are forwarded or routed, where tunnels terminate, or where traffic inspection happens—Regional Services addresses those processing locations.
With Regional Services, TLS termination only occurs inside the configured region. If a hostname is configured to regionalize to the European Union, any HTTPS request from the United States will be forwarded in encrypted form to an EU data center before being decrypted. L3/L4 DDoS mitigations are applied at any Cloudflare data center worldwide without decrypting traffic content, while security, performance, and reliability functions that require access to decrypted traffic operate only at in-region locations.
What the documented post-quantum design protects
For the Cloudflare One path, the post-quantum design uses HPKE as defined in RFC 9180, with a key-encapsulation mechanism combining ML-KEM-768 and X25519, HKDF-SHA-256 for key derivation, and AES-256-GCM for authenticated encryption. Combining post-quantum and classical components preserves confidentiality as long as at least one component remains secure.
Regional root keys are 256-bit symmetric secrets tied to one region. GeoKey Manager derives application-specific key pairs from each regional root key for services such as Gateway or Tunnel. During wrapping, the key-management service uses the regional boundary to retrieve the regional root key and its latest configured epoch, derives the corresponding asymmetric application key pair, and uses its public component to wrap the private key. The wrapped private key and metadata are then distributed globally via Quicksilver.
Unwrapping a key requires the corresponding regional root key and service context. Edge servers load regional root keys into the kernel keyring rather than persisting them on disk, and process-level access controls limit which services can use them. If any required check fails—service context, region, epoch—the request is rejected. The system fails closed: it never unwraps a customer's private key outside its allowed region.
Every wrapped customer private key carries metadata identifying its service context, regional boundary, and epoch. Keys with the same service context, regional boundary, and epoch use the same application-specific key pair. Compromising one application-specific private key could expose keys for that service and region, but not keys for other services. Compromising a regional root key could affect every application-specific key derived from that root for the same epoch.
What existing deployments can conclude today
Older versions of GeoKey Manager already provide geographic controls for private keys associated with CDN certificates. Cloudflare is developing a separate integration that will bring this new post-quantum GeoKey Manager to that existing CDN capability, and will share testing and transition details when that work is ready. The new post-quantum design is not documented as already integrated with the existing CDN capability.
The sources do not provide configuration, enrollment, or migration steps, do not list every eligible region or product-specific caveat, and do not establish a need for existing customers to change deployments now.
Register interest if you're eligible
Current Data Localization Suite customers who are regionalizing CDN traffic can register intent to test the feature before general availability.
Verification status: Supported by official documentation only under the conditions below; not reproduced in a test environment by IGPROD. Checked 2026-10-23.
Conditions:
- The announced post-quantum GeoKey Manager is in closed beta; general availability is planned for Q1 2027.
- Region availability may have product-specific caveats.
- The described hybrid HPKE design applies to the Cloudflare One path.
- Integration of the new post-quantum design with the existing CDN capability is still in development.
Sources:
Leave a comment
Your email address will not be published. Required fields are marked *
