Security
Cloudflare Shifts GeoKey Manager to Post-Quantum Hybrid Cryptography, Scraps Attribute-Based Encryption
Cloudflare's redesigned GeoKey Manager enters closed beta with ML-KEM-768 hybrid encryption to defend against harvest-now attacks while respecting data sovereignty boundaries.
InfoQ
Cloudflare has entered closed beta with a post-quantum overhaul of its GeoKey Manager, retiring the attribute-based encryption scheme it deployed in 2022 in favor of a hybrid cryptographic approach combining ML-KEM-768 and X25519. The beta phase began on October 23 for existing Data Localization Suite customers, with general availability targeted for early 2027.
The redesign tackles two overlapping problems: enforcing data sovereignty rules that limit plaintext processing to specific regions, and defending against harvest-now, decrypt-later attacks where adversaries record encrypted traffic today to exploit future quantum computing capabilities.
From Policy Expressions to Regional Keys#
GeoKey Manager originally launched in 2017 for managing TLS encryption keys. The 2022 upgrade moved to ciphertext-policy attribute-based encryption to express complex access policies across many regions. Cloudflare has now abandoned that approach for two practical reasons: no production-ready post-quantum variant of attribute-based encryption yet exists, and the added complexity exceeds what most customers actually need.
The new architecture employs HPKE (Hybrid Public-Key Encryption), defined in RFC 9180, with a simpler key structure built around two components:
- Regional root keys: 256-bit symmetric secrets, one per geographic region
- Application-specific key pairs: Derived from a regional root, tied to a single service (such as Tunnel or Gateway) and a specific epoch—Cloudflare's term for a key generation cycle that advances during rotation
The key-management service generates application key pairs and wraps customer private keys using the public component, while the underlying cryptography combines ML-KEM-768 for post-quantum security with X25519 for classical strength, supported by HKDF-SHA-256 and AES-256-GCM.
How Keys Move Through the Network#
The system enforces strict separation: wrapped keys and metadata travel globally through Quicksilver, Cloudflare's key-value store, while regional root keys follow a separate path via the provisioning service, which holds them in Vault.
Before any edge server receives a regional root key, it must pass three verification stages:
- TPM hardware identity check
- Zinc lookup (Cloudflare's server inventory) to confirm data center location
- Provisioning service approval for which roots the server may hold
