CLOUDFLARE has introduced a post-quantum geographically restricted key manager (PQ GeoKey Manager) in closed beta as part of its Data Localization Suite. The system ensures that a customer’s decryption keys can only be accessed by Cloudflare edge servers located in the customer’s chosen geography. It achieves this by wrapping each decryption key so that it can only be unwrapped within the region specified by the customer, with GA envisaged for Q1 2027.
The design builds on Cloudflare’s evolution of geo-restricted key controls. It uses a hybrid post-quantum and classical approach: regional root keys are 256-bit symmetric secrets, from which application-specific key pairs are derived to wrap private key material (for example, for services like Gateway or Tunnel) using HPKE (RFC 9180) with ML-KEM-768 and X25519.
A two-tier key hierarchy separates globally distributed wrapped keys from regional root keys; regional keys are provisioned only to edge servers authorised for a region and loaded into the kernel keyring. The system supports soft and hard rotation of epochs, enforces fail-closed checks (rejecting requests if region, service context, or epoch do not align), and relies on TPM-backed identity and Zinc for regional mapping.
Cloudflare notes this is foundational for future Regional Services in Cloudflare One and for extending post-quantum protections to CDN-related keys, with early access available to existing Data Localization Suite customers.