Cloudflare's PQ GeoKey Manager locks key unwrapping to chosen regions in closed beta

Cloudflare opens closed beta of PQ GeoKey Manager

Cloudflare has launched a post-quantum geographically restricted key manager in closed beta, according to the company's blog. The product, PQ GeoKey Manager, supports Cloudflare's Data Localization Suite by wrapping each customer decryption key so that only servers inside the customer's chosen geography can unwrap it. General availability is planned for Q1 2027.

Two problems at once

The launch addresses two separate pressures. The first is the "harvest now, decrypt later" threat: adversaries can record encrypted traffic today and hold on to it until quantum computers are able to break the classical public-key cryptography protecting it. Cloudflare notes that data handled by governments, financial institutions, healthcare providers and defense organizations can stay sensitive for decades, so ciphertext captured now remains a long-term liability.

The second is data sovereignty. Regulations in many jurisdictions require certain data to be processed only within a given region, while Cloudflare's high-availability model relies on replicating data across a global network. Meeting both requirements means encrypting the data end to end so that only in-region servers can ever see plaintext, which in turn means the private keys used to decrypt TLS traffic must never leave the region.

Why the design changed

Cloudflare introduced geo-restricted TLS keys in 2017 and moved to ciphertext-policy attribute-based encryption (ABE) in 2022, expressing restrictions as attributes such as "region = European Union" and letting newly authorized servers pick up decryption capabilities without rewrapping every customer key.

According to the blog, no production-ready post-quantum ABE scheme exists today, and customers generally do not need a large number of regions. Cloudflare therefore simplified the design: the new GeoKey Manager uses hybrid protection combining ML-KEM-768, a NIST post-quantum standard, with the classical X25519 curve. Two key types carry the design. A regional root key is a symmetric secret tied to a single region, and application-specific key pairs are derived from it for individual services such as Gateway or Tunnel.

How regional enforcement works

Distribution is deliberately split. Quicksilver, Cloudflare's global configuration distribution system, spreads wrapped private keys and their metadata across the network, but it never carries regional root keys. Those travel through a separate provisioning service that delivers them only to edge servers authorized for each region.

Every wrapped key carries metadata identifying its service context, its regional boundary and its epoch, meaning the generation of the regional root key it belongs to, with each rotation creating a new epoch.

Enforcement fails closed. During initialization, the edge key service on each server checks that every regional root key required by its configuration is loaded; if one is missing or malformed, the service does not start. At request time, if a request's metadata names a regional root key that is not locally available, Cloudflare rejects the request rather than risk unwrapping a key out of region. A request intended for Germany that somehow reached servers in Spain or France would fail, since neither holds Germany's regional root key.

The key hierarchy also bounds the blast radius of a compromise. Keys sharing the same service context, region and epoch share an application-specific key pair, so compromising the Tunnel-in-Germany key could expose multiple customers' Tunnel keys but not their Gateway keys. Compromising the Germany regional root key would affect every application-specific key derived from it in that epoch.

Scope and rollout

GeoKey Manager controls only where protected keys can be unwrapped and used on the data plane. Request routing, tunnel termination and traffic inspection are handled separately by Cloudflare's Regional Services. The company says most of its regions will be available for customers to regionalize their workflows, though product-specific caveats may apply.

Why it matters

Post-quantum migration and data localization are usually treated as separate compliance tracks; this product joins them. Organizations that must keep decryption inside a jurisdiction no longer have to accept classical key-wrapping that quantum attackers could eventually break. Cloudflare's decision to drop attribute-based encryption in favor of a simpler hybrid design is also a pragmatic signal to other operators facing the same constraint: waiting for a post-quantum variant of an elegant primitive may not be worth it when a less flexible design meets the actual requirement. Finally, the fail-closed behaviour illustrates the trade-off inherent in regional fencing on a single global anycast network — availability is deliberately sacrificed before a key is ever allowed to cross a border.