Bringing post-quantum cryptography to geographically fenced key management

What it is

Cloudflare's post-quantum GeoKey Manager (closed beta, Data Localization Suite) wraps customer private keys so that only edge servers in a chosen region can unwrap them. It currently covers the Cloudflare One path (Access, Gateway, Tunnel, Cloudflare One client). The older GeoKey Manager for CDN certificates stays in place, and a separate integration to bring the post-quantum version to CDN is still in development.

How it works

Wrapped keys and regional root keys travel on separate paths. Quicksilver distributes wrapped keys and metadata (service context, regional boundary, epoch) globally. A separate provisioning service, backed by on-premises Vault, delivers 256-bit regional root keys only to authorized servers. Authorization combines a TPM-proven hardware identity, Zinc's mapping of that identity to a data center and location, and the provisioning service's per-server key policy. The server receives a token and fetches only its region's root keys.

Wrapping uses an application-specific HPKE key pair (RFC 9180) derived from the root. The KEM is ML-KEM-768 plus X25519, with HKDF-SHA-256 and AES-256-GCM. The page says hybrid construction keeps confidentiality as long as one component holds. It cites no post-quantum ABE scheme being production-ready as the reason for dropping the 2022 ABE design.

Blast radius

Keys sharing a service context, region and epoch share one key pair. Compromise of the Tunnel-Germany application key exposes every Tunnel-Germany wrapped key for that epoch, but not Gateway keys. Compromise of the Germany root exposes every application key derived from it for that epoch. The trust boundary is the key-management service, the provisioning service and the edge key services. Quicksilver is outside it.

Operational behavior

• Edge key services refuse to start if any configured root key is missing or malformed. At request time, a key whose root is not local is rejected.
• Root keys live in the Linux kernel keyring, not on disk. A reboot wipes them and the server must re-authenticate and re-provision.
• Regional membership is refreshed several times a day, with no customer action. On change, the provisioning service syncs the keyring immediately. The edge service caches keys in process memory until restart or cache expiry.
• Soft rotation adds a new epoch while keeping a limited number of earlier epochs usable (the page's example is one). Hard rotation rewraps affected keys under a replacement epoch and removes access to the old one.

What to do

Current DLS customers regionalizing CDN traffic can register intent to test through the form linked in the post. Cloudflare One regional capabilities built on this are to be announced "in a few months". General availability is planned for Q1 2027.

Caveats

GeoKey Manager governs only where wrapped private keys can be unwrapped. Request routing, tunnel termination and traffic inspection fall under Regional Services. Most regions will be available, with possible product-specific caveats. The page gives no performance figures, no list of regions and no CDN test timeline.