Cloudflare has launched a closed beta of a post-quantum rebuild of GeoKey Manager, a service that protects geographically restricted decryption keys using a hybrid encryption approach combining ML-KEM-768 and X25519, according to a company announcement published October 23. The beta is available to current Data Localization Suite customers, with general availability planned for the first quarter of 2027. The redesign replaces the attribute-based encryption the service has used since 2022.
The new architecture relies on two types of keys instead of policy expressions. Regional root keys are 256-bit symmetric secrets, with one held per region. Application-specific key pairs are generated from a root for a single service—such as Tunnel or Gateway—and a single epoch, Cloudflare's term for a key generation that advances through rotation. The key-management service generates the application key pair and wraps customer private keys under its public component. These two key types travel separate routes: Quicksilver, Cloudflare's globally replicated key-value store, distributes wrapped keys and metadata everywhere, while regional root keys move through the provisioning service, which stores them in Vault. Edge servers must pass three checks before receiving a root key: TPM hardware identity verification, a lookup in Zinc—Cloudflare's server inventory—that maps the identity to a data center and location, and a decision by the provisioning service about which roots that server may hold. Authorized servers load regional root keys into the kernel keyring rather than disk storage. Regional membership updates several times daily as the network evolves, independent of key rotation and without customer intervention.
Chetan Agrawal, Arka Nayan and Erik Engstrom describe the redesign as tackling two challenges simultaneously: data sovereignty regulations that limit plaintext processing to a specific region, and harvest-now, decrypt-later attacks where traffic captured today gets decrypted once a quantum computer becomes available. Cloudflare cites two reasons for abandoning the previous attribute-based encryption scheme: no production-ready post-quantum variant exists, and customers don't require the large number of regions it was designed to handle. The authors call failing closed "a very intentional design choice," meaning any failed check on service context, region, or epoch rejects the request, and at the edge a missing or malformed key prevents the service from starting.
The rebuild follows Cloudflare's broader post-quantum trajectory. The company adopted hybrid ML-KEM for its IPsec service in March, when over 60% of human-generated TLS traffic on its network already used it, and has since outlined plans for a quantum-safe certificate authority. Key protection now uses HPKE, the hybrid public-key encryption construction defined in RFC 9180, with a key encapsulation mechanism that combines ML-KEM-768 and X25519, HKDF-SHA-256 and AES-256-GCM. GeoKey Manager first shipped in 2017 for TLS keys before shifting to ciphertext-policy attribute-based encryption in 2022. Mark Tehrani, founder of CyberSeQ and a professor of cybersecurity, raised questions about the blast radius of a compromised regional root key and whether failed regional key provisioning, synchronization, or rotation could trigger a region-wide service outage under the fail-closed design.
Most regions will be covered at launch, with product-specific caveats. The trust boundary encompasses the key-management, provisioning, and authorized edge key services, while Quicksilver sits outside it because it only ever holds wrapped keys and metadata. Because the kernel keyring memory is volatile, a machine restart removes the keys and the server must authenticate again. A soft rotation creates a new epoch while a limited number of previous epochs remain usable, allowing customers to maintain uptime during the transition; a hard rotation rewraps affected keys under a replacement epoch and removes access to the previous one. What the beta will reveal is whether the design's response to a failed check—refusing to serve—is one customers accept at regional scale. Organizations that demand both geographic compliance and quantum resistance will need to weigh the architecture's security guarantees against the operational risk of a fail-closed posture that could halt service if provisioning stumbles.