Cloudflare's Post-Quantum GeoKey Manager Enters Closed Beta

Cloudflare has retired attribute-based encryption from a core data sovereignty product and replaced it with a quantum-resistant hybrid key scheme, signaling how seriously the harvest-now-decrypt-later threat is being taken even before any quantum computer exists capable of acting on stolen ciphertext. According to InfoQ, the rebuilt GeoKey Manager entered closed beta on October 23 for existing Data Localization Suite customers, with general availability targeted for the first quarter of 2027.

What Happened

GeoKey Manager first shipped in 2017 to manage TLS keys and moved to ciphertext-policy attribute-based encryption in 2022 to enforce geographic confinement of plaintext processing. According to InfoQ, Cloudflare engineers Chetan Agrawal, Arka Nayan and Erik Engstrom describe the new design as solving two problems simultaneously: data sovereignty rules that confine plaintext processing to a region, and the risk that traffic captured today could be decrypted later once a cryptographically relevant quantum computer exists. Cloudflare gave two reasons for dropping attribute-based encryption outright: no production-ready post-quantum variant of the scheme exists, and customers did not need the large number of regions it was originally built to express.

In its place, key protection now runs through HPKE, the hybrid public-key encryption construction defined in RFC 9180, combining a key encapsulation mechanism that pairs ML-KEM-768 with X25519, alongside HKDF-SHA-256 and AES-256-GCM. Two key types replace the old policy expressions: 256-bit symmetric regional root keys held one per region, and application-specific key pairs derived from a root for a single service and a single rotation generation Cloudflare calls an epoch. The key-management service derives the application key pair and wraps customer private keys under its public component. Regional root keys travel a separate path through a provisioning service and are stored in Vault, while wrapped keys and metadata move everywhere through Quicksilver, Cloudflare's globally replicated key-value store.

Before an edge server can receive a root key, it must clear three checks described in the InfoQ report: TPM hardware identity verification, a lookup in Cloudflare's server inventory system called Zinc that maps identity to location and data center, and a provisioning service decision on which roots that server may hold. Authorized servers load regional root keys into the kernel keyring rather than onto disk. Because kernel keyring memory is volatile, a machine restart removes the keys and forces re-authentication. Regional membership refreshes several times a day independent of key rotation, without requiring customer action.

Rotation itself follows an epoch model that answered a question posed under Cloudflare's announcement by Dabeer Shaikh, a senior solutions engineer at HashiCorp: a soft rotation creates a new epoch while a limited number of previous epochs stay usable, preserving uptime, while a hard rotation rewraps keys and removes access to the prior epoch entirely. Mark Tehrani, founder of CyberSeQ and a cybersecurity professor, posted five follow-up questions on the same thread probing the blast radius of a compromised regional root key, whether a compromised Zinc inventory or provisioning service could hand regional keys to an out-of-region server, what protects keys exposed before rotation, whether a compromised control plane could alter regional membership, and whether the design's fail-closed behavior could trigger a region-wide outage. Cloudflare's post calls failing closed a very intentional design choice. Any failed check on service context, region, or epoch causes the service not to start at the edge. The rebuild extends a pattern already visible elsewhere in the company's work: InfoQ notes Cloudflare adopted hybrid ML-KEM for its IPsec service in March, by which point more than 60% of human-generated TLS traffic on its network already used it, alongside stated plans for a quantum-safe certificate authority.

Why It Matters

Cloudflare's willingness to retire a four-year-old encryption scheme before a replacement standard was mature enough to directly substitute for it says something about how the industry is sequencing post-quantum migration. Rather than waiting for a post-quantum attribute-based encryption scheme to become production-ready, Cloudflare simplified the problem down to what its customers actually use and solved that narrower case with hybrid ML-KEM-768. MachineHours analysis: this mirrors the broader caution evident in enterprise PQC rollouts, where companies hedge against harvest-now-decrypt-later risk years ahead of any quantum computer capable of acting on stolen ciphertext, precisely because that timeline depends on fault-tolerant, error-corrected hardware that remains unproven at scale. The unresolved questions raised publicly by Shaikh and Tehrani, particularly around fail-closed outages and control-plane compromise, are a reminder that migrating cryptography introduces new operational risk even as it closes a cryptographic one. The design's trust boundary covers the key-management, provisioning, and authorized edge key services; Quicksilver sits outside it because it only ever holds wrapped keys and metadata. Readers tracking post-quantum computing advances should note that PQC adoption cycles like this one are driven more by compliance and risk management than by any near-term quantum advance.

Background

Post-quantum cryptography exists because a sufficiently large, fault-tolerant quantum computer could eventually break RSA and elliptic curve systems that protect most internet traffic today, as detailed in MachineHours' post-quantum cryptography explainer. The practical urgency comes from harvest-now-decrypt-later attacks, where encrypted data captured today is stored and decrypted once such a machine exists. Whether that machine arrives in five years or twenty depends heavily on progress in error correction, the subject covered in MachineHours' quantum hardware field comparison of superconducting, trapped ion, photonic and topological approaches, each of which faces its own fault-tolerance hurdles before reaching the scale needed to threaten current encryption.

What to Watch

The stated general availability window of the first quarter of 2027 gives a concrete checkpoint for whether Cloudflare's fail-closed design holds up at production scale without triggering the region-wide outages Tehrani raised. Cloudflare has not disclosed how it will answer the specific blast-radius and control-plane compromise questions posed on the announcement thread before GA. Watching whether Cloudflare extends the same hybrid ML-KEM approach to other sovereignty-sensitive products beyond Tunnel and Gateway will indicate how standardized this pattern becomes across its post-quantum roadmap, alongside the previously announced quantum-safe certificate authority.

Further reading and context

• MachineHours Encyclopedia: Post-Quantum Cryptography
• MachineHours Encyclopedia: Quantum Hardware — Superconducting, Trapped Ion, Photonic and Topological Approaches Compared