Bringing post-quantum cryptography to geographically fenced key management

Introduction to Post-Quantum GeoKey Manager

Cloudflare is launching a post-quantum geographically restricted key manager in closed beta to support its Data Localization Suite (DLS). This new PQ GeoKey Manager acts as a cornerstone for Cloudflare's data sovereignty solutions, ensuring that a customer's decryption keys remain accessible only within their chosen geography. By wrapping each decryption key, GeoKey Manager restricts decryption solely to Cloudflare servers located in the permitted region. While general availability (GA) is planned for Q1 2027, today's launch marks an important milestone in migrating all Cloudflare products to post-quantum (PQ) cryptography while addressing data sovereignty goals.

Threat Model and Data Sovereignty Challenges

Governments, financial institutions, healthcare providers, and defense organizations handle highly sensitive data that retains its sensitivity for years or decades. Encryption protects this information, but when classical public-key encryption is used, adversaries can store encrypted data today and wait for quantum computers to break it later—a strategy known as harvest now, decrypt later. Simultaneously, organizations face strict data sovereignty regulations requiring certain data to be processed only within designated geographic regions. To maintain high availability across a global network while meeting these regulations, Cloudflare must ensure data is end-to-end encrypted so that only servers within the specified region can access the plaintext.

Cryptographic Design and Key Hierarchy

Cloudflare utilizes a hybrid ML-KEM-768 and X25519 protection scheme with regional root keys and application-specific key pairs. ML-KEM-768 is a NIST standard that protects private keys against harvest-now-decrypt-later attacks while preserving regional boundaries. A regional root key is a 256-bit symmetric secret tied to a specific region, while an application-specific key pair is derived for a single service like Gateway or Tunnel. Every wrapped private key carries metadata identifying its service context, regional boundary, and epoch. Quicksilver, Cloudflare's global configuration distribution system, distributes wrapped private keys and metadata globally, while regional root keys are delivered via a separate provisioning service only to authorized edge servers.

Server Authorization and Fail-Closed Security

Before receiving a regional root key, an edge server must verify its hardware identity using a Trusted Platform Module (TPM). Cloudflare's server inventory system, Zinc, maps this identity to a physical location, supporting FIPS 140-3 compliance and determining which regional root keys the server may access. Authorized servers load these root keys into the Linux kernel keyring rather than storing them on disk, utilizing volatile memory that clears upon a restart. GeoKey Manager operates on a strict fail-closed design: if any check fails—such as a missing or malformed root key, or a request originating outside the permitted region—the request is rejected rather than risking out-of-region unwrapping.

Future Integration and Availability

General availability for the PQ GeoKey Manager is targeted for Q1 2027. The current architecture serves as the foundation for an improved Regional Services offering for Cloudflare One, with new capabilities scheduled for announcement in a few months. Furthermore, Cloudflare is developing a separate integration to bring this post-quantum GeoKey Manager to its existing CDN capability that provides geographic controls for private keys associated with CDN certificates.