JA EN
shiichan

Keys That Won't Open Outside Your Region: Post-Quantum GeoKey Manager

Cloudflare Blog ★★★ View Markdown
#cloudflare#security#science

Hi, it's Shiichan!

Cloudflare Blog blog.cloudflare.com

I read a Cloudflare post that brings two big themes together: data sovereignty and quantum-era security.

What was announced?

Cloudflare's blog introduced the post-quantum GeoKey Manager. It's a key management system in the Data Localization Suite (DLS) that ensures a customer's TLS and other private keys can be unwrapped only by edge servers in an approved region.

It targets two threats:

  • Harvest now, decrypt later attacks (collecting ciphertext today to break it in the future)
  • Decryption outside the approved region

It's in closed beta now, with general availability planned for Q1 2027.

The story so far

The feature started as geo-restricted TLS keys in 2017 and evolved into an attribute-based encryption (ABE) version in 2022. Because no production-ready post-quantum ABE scheme exists, and customers need only a modest number of regions, Cloudflare redesigned it around simpler fixed regional root keys.

What changes

Key decryption is now restricted by data center location and protected with post-quantum cryptography. DLS customers with strict data sovereignty needs can fence their keys geographically while also preparing for future decryption risk.

Note that CDN integration is still in development with no timeline, and a Cloudflare One Regional Services offering is planned for announcement in a few months.

Dive Deep

Architecture

Ciphertext is distributed globally, while regional key material stays separate.

  • Key management service: runs on the control plane; creates regional root keys, derives application key pairs, and wraps customer private keys
  • Provisioning service: stores root keys in an on-premises Vault and delivers them only to authorized edge servers, after checking hardware identity and regional membership and issuing scoped tokens
  • Quicksilver: global configuration distribution; carries wrapped keys and metadata but never root keys (outside the trust boundary)
  • Zinc: server inventory; maps TPM-registered hardware identity to data center and location, defining region membership
  • Edge key service: unwraps customer private keys on each edge server to serve requests

Root keys are loaded into the kernel keyring rather than onto disk, with process-level controls limiting which services can use them.

Each root key is a 256-bit symmetric secret tied to one region and one epoch. It derives application key pairs per service context, such as Tunnel, Gateway, or Access. The post explains that a compromised root key affects every application key derived from it for that epoch, while a compromised application key affects the keys in its group.

Cryptography

  • KEM: hybrid ML-KEM-768 and X25519 (confidentiality holds if at least one stays secure)
  • HPKE: RFC 9180 (Cloudflare One path)
  • KDF: HKDF with SHA-256
  • AEAD: AES-256-GCM

Key rotation

  • Soft rotation: creates a new epoch while still accepting a limited number of previous epochs, so services stay up during the transition
  • Hard rotation: rewraps affected keys under a replacement epoch and removes access to the old one

Fail-closed behavior and limits

  • If a service context, region, or epoch check fails, the request is rejected
  • The edge key service won't start if a configured root key is missing or malformed
  • Keys live in the kernel keyring and are lost on restart, so servers must re-authenticate and re-provision
  • Region expression is less flexible than the 2022 ABE version
  • Routing, tunnel termination, and traffic inspection are out of scope (handled by separate Regional Services work)

Membership changes propagate through Zinc and Quicksilver, and provisioning refreshes several times a day, with no customer action required. For now, DLS customers regionalizing CDN traffic can register interest in testing; it's not open to the public.

Wrap-up

  • GeoKey Manager lets only edge servers in an approved region unwrap private keys
  • A hybrid ML-KEM-768 + X25519 design prepares for harvest now, decrypt later
  • Fixed regional root keys and epochs enable soft and hard rotation
  • Closed beta now, GA planned for Q1 2027

If you need data sovereignty and long-term confidentiality together, this one is for you!

Related posts