Cloudflare launches post-quantum GeoKey Manager for geo-fenced key decryption
Cloudflare Blog · rss · 2026-10-24
Cloudflare launched the post-quantum PQ GeoKey Manager (closed beta, GA planned Q1 2027) as part of its Data Localization Suite, ensuring customer decryption keys can only be unwrapped on servers within a chosen geography.
Threat model
- Defends against 'harvest now, decrypt later' attacks where ciphertext is stored until quantum computers can break classical public-key crypto
- Meets data sovereignty rules requiring plaintext processing within a region
Evolution
- Pioneered geo-fenced TLS keys in 2017; moved to ciphertext-policy attribute-based encryption (ABE) in 2022
- No production-ready PQ ABE exists, so the new design uses hybrid ML-KEM-768 + X25519 with a simpler key hierarchy
- Regional root keys (symmetric, region-bound, never leave their region) derive application-specific key pairs scoped by service, region and epoch
Guarantees
- Edge key service fails to start if configured regional root keys are missing; requests fail closed rather than decrypt out of region
- Quicksilver distributes only wrapped keys; regional root keys travel a separate controlled provisioning path
More from Infra
- Miles v0.1.3 cuts first RL weight update from 99.5s to 3.9s, shares GPUs across train/rollout — hsu_byron · 2026-10-24
- 98%+ Tensor Core utilization shown in LLM training run, drawing admiration — gharik · 2026-10-24
- We spent millions on AI apps with zero revenue — but our old GPUs are now worth more than we paid — stephen280up · 2026-10-24
- Polymarket puts 24% odds on AI data centers launching to space by end of next year — Polymarket · 2026-10-24
- Polymarket jokes wolves are entering Finnish villages after Google cleared forest for AI data centers — Polymarket · 2026-10-24
- llama.cpp PR drops kq_mask for QSA selection, saving gigabytes of VRAM on Qwen Flash Next — jacek2023 · 2026-10-24