Cloudflare ties post-quantum keys to a region with hybrid ML-KEM-768 wrapping
Victoria Shinder1 min readCloudflare opened a closed beta on 23 October of a post-quantum version of its GeoKey Manager, part of the Data Localization Suite, with general availability planned for the first quarter of 2027. The system wraps each customer decryption key so that only Cloudflare servers physically located in the customer's chosen geography can unwrap it. The threat it targets is "harvest now, decrypt later": an adversary who records encrypted traffic today and waits for a quantum computer to break the classical public key later.
Rather than reuse the attribute-based encryption that GeoKey Manager adopted in 2022, the team chose a simpler design, because no production-ready post-quantum attribute-based scheme exists and customers do not need many regions. Protection is hybrid ML-KEM-768 plus X25519. A symmetric regional root key is tied to one region, and a per-service key pair — for Gateway or Tunnel, say — is derived from it.
What it means
The honest move here is dropping the clever cryptography. Attribute-based encryption let Cloudflare grant a new data centre a decryption capability without rewrapping every key, which is elegant and, for a post-quantum transition today, unavailable in any vetted form. Choosing a symmetric regional root with derived per-service keys trades that flexibility for something you can actually standardise on — ML-KEM-768 is a NIST scheme — and operate without surprises. Data sovereignty and quantum resistance are usually sold as separate features; welding them into one key-wrapping step is the part worth copying.