Cloudflare Launches Post-Quantum Geo Key Manager in Closed Beta
Cloudflare has introduced a closed beta for its post-quantum geographically restricted key manager, designed to protect decryption keys within targeted data sovereignty boundaries.
Before you start: versions, package names and storage identifiers change over time. Check the commands against the official documentation for your setup before running them, especially anything that creates, deletes or overwrites data.
Securing Data Localization with Post-Quantum Cryptography
Cloudflare has announced the closed beta launch of a post-quantum geographically restricted key manager, strengthening its Data Localization Suite by ensuring decryption keys remain accessible only within chosen regions. This implementation is designed to counter long-term threats where encrypted data is intercepted and stored by adversaries awaiting the advent of practical quantum computers—a strategy commonly referred to as harvest-now-decrypt-later.
While general availability is targeted for the first quarter of 2027, the current release forms an essential baseline for migrating Cloudflare services to post-quantum cryptographic standards without compromising strict regional compliance boundaries.
Hybrid Cryptographic Architecture and Regional Enforcement
The system utilizes a hybrid approach combining the NIST-standardized ML-KEM-768 with X25519 protection, alongside HKDF-SHA-256 for key derivation and AES-256-GCM for authenticated encryption. Regional root keys—256-bit symmetric secrets tied strictly to specific geographic borders—generate application-specific asymmetric key pairs for services such as Cloudflare Tunnel and Gateway.
To maintain high availability across a global footprint while fulfilling localization mandates, Cloudflare separates the distribution of globally cached wrapped private keys from the restricted path of regional root keys. Edge servers authenticate their physical location and hardware identity using a Trusted Platform Module (TPM) alongside internal inventory data. If a validation check fails or a required regional root key is missing from the local Linux kernel keyring, the node fails closed and rejects the request entirely, preventing out-of-region decryption.
Availability and Future Integration Roadmap
The post-quantum Geo Key Manager is currently live in closed beta for customers utilizing the Data Localization Suite and Cloudflare One components. Cloudflare has confirmed plans to extend this architecture to existing content delivery network (CDN) capabilities, with additional testing and transition details expected ahead of general availability.
Source
Official announcement or documentation
Some links on this page may be affiliate links. If you buy through them we may earn a commission at no extra cost to you. See our affiliate disclosure.
