Cloudflare has moved a post-quantum rebuild of its GeoKey Manager into closed beta, replacing the attribute-based encryption used since 2022 with HPKE, which uses a hybrid key encapsulation mechanism combining ML-KEM-768 and X25519. The beta opened on October 23 for existing Data Localization Suite customers, with general availability targeted for the first quarter of 2027.
Chetan Agrawal, Arka Nayan and Erik Engstrom describe the redesign as addressing two requirements at once: data sovereignty rules that confine plaintext processing to a region, and protection against harvest-now, decrypt-later attacks, where traffic captured today could be decrypted once a quantum computer exists. Cloudflare cited two reasons for dropping the attribute-based encryption scheme that GeoKey Manager relied on: there is no production-ready post-quantum variant, and customers do not need the large number of regions that scheme was designed to express.
Under the new system, key protection uses HPKE, the hybrid public-key encryption construction defined in RFC 9180, with a key encapsulation mechanism combining ML-KEM-768 and X25519, HKDF-SHA-256, and AES-256-GCM. Two new types of keys replace the earlier policy expressions: regional root keys, which are 256-bit symmetric secrets held one per region, and application-specific key pairs derived from a root for a single service and a single epoch. The key-management service derives the application key pair and wraps customer private keys under its public component.
Regional root keys travel a different path from wrapped keys and metadata. Quicksilver, Cloudflare's globally replicated key-value store, carries wrapped keys and metadata everywhere, while the provisioning service stores regional keys in Vault. Before an edge server receives a root key, it must pass three checks: TPM hardware identity verification, a lookup in Cloudflare's server inventory Zinc that maps the identity to a data center and location, and a decision by the provisioning service about which roots that server may hold. Authorised servers load regional root keys into the kernel keyring rather than writing them to disk. Because that memory is volatile, "a machine restart removes the keys," and the server must authenticate again.
Dabeer Shaikh, a senior solutions engineer at HashiCorp, asked how a geo-fenced key could be rotated without downtime. Cloudflare's post answers that through an epoch model: a soft rotation creates a new epoch while a limited number of previous epochs remain usable, maintaining uptime, whereas a hard rotation rewraps affected keys under a replacement epoch and removes access to the previous one.
Mark Tehrani, founder of CyberSeQ and a professor of cybersecurity, posted five questions on the same thread. Four concern the blast radius of a compromised regional root key, whether a compromised Zinc inventory or provisioning service could hand regional keys to an out-of-region server, what protects keys exposed before a rotation, and whether a compromised control plane could alter regional membership. The fifth goes to the design's central tradeoff: if regional key provisioning, synchronisation, or rotation fails, could the fail-closed design cause a region-wide service outage?
Cloudflare's post is explicit about that behaviour. Any failed check on service context, region, or epoch rejects the request, and at the edge a missing or malformed key means the service does not start. The authors call failing closed "a very intentional design choice." The trust boundary covers the key-management, provisioning, and authorised edge key services; Quicksilver sits outside it because it only ever holds wrapped keys and metadata.
The rebuild extends a pattern in Cloudflare's post-quantum work. The company adopted hybrid ML-KEM for its IPsec service in March, when over 60% of human-generated TLS traffic on its network already used it, and has since set out plans for a quantum-safe certificate authority.
Analysis
Why This Matters
- Post-quantum key management is becoming essential for long-term security; Cloudflare's approach may set a pattern for internet infrastructure.
- The change affects data sovereignty compliance, which matters for any organisation subject to regional data-processing rules.
- The fail-closed design introduces a trade-off between security and availability that could cause region-wide outages if provisioning or rotation fails.
Background
Cloudflare's GeoKey Manager first shipped in 2017 for TLS keys and moved to ciphertext-policy attribute-based encryption in 2022. This latest rebuild responds to the emerging threat of quantum computers being able to break current public-key cryptography, as well as evolving data-localisation regulations. Cloudflare is one of the largest content-delivery networks and its key-management choices influence industry practices.
Key Perspectives
Cloudflare: Describes the redesign as addressing both data sovereignty and harvest-now, decrypt-later threats. The company states that failing closed on any check is an intentional design choice to prevent key leakage, and that the trust boundary excludes Quicksilver because it only holds wrapped keys and metadata.
Mark Tehrani (CyberSeQ): Raise concerns about the blast radius if a regional root key is compromised, the risk of a compromised Zinc inventory or provisioning service granting keys out-of-region, the protection of keys exposed before a rotation, the possibility of a compromised control plane altering regional membership, and the potential for a fail-closed design to cause a region-wide outage if provisioning or rotation fails.
What to Watch
- How existing Data Localization Suite customers respond to the fail-closed behaviour in the beta.
- The general availability release planned for Q1 2027, and whether the design changes before then.
- Third-party security analyses or audits that may emerge as the system sees wider deployment.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedCloudflare moved a post-quantum rebuild of GeoKey Manager into closed beta.InfoQ: “Cloudflare has moved a post-quantum rebuild of GeoKey Manager into closed beta”
- SupportedThe rebuild replaces attribute-based encryption with a hybrid of ML-KEM-768 and X25519 for geographically fenced decryption keys.InfoQ: “protecting geographically fenced decryption keys with a hybrid of ML-KEM-768 and X25519 and replacing the attribute-based encryption the service has relied on since 2022.”
- SupportedThe beta opened on October 23 to existing Data Localization Suite customers, with general availability planned for the first quarter of 2027.InfoQ: “The beta opened on October 23 to existing Data Localization Suite customers, with general availability planned for the first quarter of 2027.”
- SupportedChetan Agrawal, Arka Nayan and Erik Engstrom describe the redesign as addressing data-sovereignty requirements and harvest-now, decrypt-later attacks.InfoQ: “Chetan Agrawal, Arka Nayan and Erik Engstrom describe the redesign as addressing two requirements at once: data sovereignty rules that confine plaintext processing to a region, and harvest-now, decrypt-later attacks”
- SupportedCloudflare gives two reasons for dropping attribute-based encryption: no production-ready post-quantum variant exists, and customers do not need the large number of regions it was designed to express.InfoQ: “Cloudflare gives two reasons for dropping that scheme: no production-ready post-quantum variant exists, and customers don't need the large number of regions it was built to express.”
- SupportedThe new key protection uses HPKE with ML-KEM-768 and X25519, HKDF-SHA-256 and AES-256-GCM.InfoQ: “In its place, key protection uses HPKE, the hybrid public-key encryption construction defined in RFC 9180 , with a key encapsulation mechanism (KEM) combining ML-KEM-768 and X25519, HKDF-SHA-256 and AES-256-GCM.”
- SupportedRegional root keys are 256-bit symmetric secrets held one per region.InfoQ: “Regional root keys are 256-bit symmetric secrets held one per region.”
- SupportedBefore an edge server receives a root key, it must pass TPM identity verification, a Zinc inventory lookup, and a provisioning-service decision about which roots it may hold.InfoQ: “Before an edge server receives a root key, it must clear three checks: TPM hardware identity verification, a lookup in Zinc, Cloudflare's server inventory, that maps the identity to a data center and location, and a decision by the provisioning service about which roots that server may hold.”
- SupportedThe source says, “a machine restart removes the keys,” and that the server has to authenticate again.InfoQ: “Because that memory is volatile, "a machine restart removes the keys," and the server has to authenticate again.”
- SupportedDabeer Shaikh asked how a geo-fenced key could be rotated without downtime; the post describes soft and hard rotation through epochs.InfoQ: “Dabeer Shaikh , a senior solutions engineer at HashiCorp, asked under Cloudflare's announcement how a geo-fenced key can be rotated without downtime, and the post answers that question through its epoch model.”
- SupportedA failed check on service context, region or epoch rejects a request, and a missing or malformed key at the edge means the service does not start; the authors call failing closed “a very intentional design choice.”InfoQ: “Any failed check on service context, region, or epoch rejects the request, and at the edge a missing or malformed key means the service does not start. The authors call failing closed "a very intentional design choice."”
- SupportedCloudflare adopted hybrid ML-KEM for its IPsec service in March, when over 60% of human-generated TLS traffic on its network already used it.InfoQ: “Cloudflare adopted hybrid ML-KEM for its IPsec service in March, when over 60% of human-generated TLS traffic on its network already used it”
