Cloudflare Launches Post-Quantum GeoKey Manager with Hybrid ML-KEM-768 Encryption for Regional Data Sovereignty

Global cloud and edge network provider Cloudflare (NYSE: NET) has launched its Post-Quantum (PQ) GeoKey Manager in closed beta as part of its Data Localization Suite (DLS), integrating NIST-standardized post-quantum cryptography to enforce strict geographical boundaries on customer private key access. General availability across Cloudflare's network is scheduled for the first quarter of 2027.

The upgraded infrastructure allows enterprises to control exactly where their private TLS and transport decryption keys can be unwrapped across Cloudflare’s global anycast network. By transitioning to a quantum-safe key encapsulation model, the system protects long-term sensitive enterprise data against "Harvest Now, Decrypt Later" (HNDL) attacks while satisfying regional data sovereignty mandates such as GDPR and financial locality regulations.

Transitioning from Classical ABE to Hybrid Post-Quantum HPKE

Cloudflare first introduced geographic key isolation in 2017, later updating the platform in 2022 to utilize Ciphertext-Policy Attribute-Based Encryption (CP-ABE) to support dynamic multi-region access policies. However, because production-ready, standardized post-quantum ABE schemes do not currently exist, Cloudflare redesigned the cryptographic architecture to adopt Hybrid Public Key Encryption (HPKE, RFC 9180).

The revised implementation pairs lattice-based ML-KEM-768 with classical elliptic-curve Diffie-Hellman (X25519). Under this dual-layer construction, session confidentiality remains preserved even if either the classical or the post-quantum primitive is compromised in the future.

Separation of Concerns and Hardware-Enforced Fail-Closed Boundaries

The platform separates globally distributed ciphertext from regional private decryption keys:

• Independent Distribution Paths: Customer private keys are wrapped using public application-specific keys and distributed globally across Cloudflare’s edge via its Quicksilver distributed key-value store. In contrast, the symmetric regional root keys required to derive private unwrapping keys are never sent through Quicksilver. Instead, they are provisioned exclusively through a secured control-plane service backed by on-premises HashiCorp Vault clusters.

• Cryptographic Hardware Attestation: Prior to receiving a regional root key, an edge server must authenticate using its hardware Trusted Platform Module (TPM). Cloudflare’s server inventory platform (Zinc) validates the hardware identity against verified physical data center coordinates before issuing authorization tokens.

• Volatile Memory Caching: Authorized edge nodes load root keys strictly into volatile Linux kernel keyrings. Because keys are never written to disk, any physical power cycle or reboot automatically purges the key material from the system.

• Fail-Closed Policy: If an edge server in an unauthorized geography receives a request requiring a regional root key it does not possess, the edge key service drops the request rather than attempting cross-border decryption.

The closed beta is initially available for enterprise customers utilizing Cloudflare One Zero Trust services (including Magic WAN, Tunnel, and Gateway), with full integration planned for Cloudflare's global Content Delivery Network (CDN) ahead of general availability in Q1 2027.

Review the full technical architecture on the Cloudflare Blog here and examine enterprise data localization tools via the Cloudflare Data Localization Suite Portal here.

October 23, 2026