Cloudflare’s Post-Quantum GeoKey Manager Enters Closed Beta Without Attribute-Based Encryption

Cloudflare's post-quantum GeoKey Manager has entered closed beta, protecting geographically restricted decryption keys using a hybrid of ML-KEM-768 and X25519. This system replaces the attribute-based encryption the service had used since 2022. The beta began on October 23 for existing Data Localization Suite customers, with general availability planned for Q1 2027.

The redesign addresses two key concerns: data sovereignty and harvesting-then-decrypting attacks that would occur if quantum computers become available. Cloudflare shed light on the reasons for dropping the previous attribute-based encryption scheme, noting the lack of a production-ready post-quantum variant and the unnecessary number of regions the system was built to support.

In its place, key protection utilizes HPKE, a hybrid public-key encryption construction outlined in RFC 9180, integrating KEMs of ML-KEM-768 and X25519, along with HKDF-SHA-256 and AES-256-GCM. Two distinct types of keys have now replaced the policy expressions. Regional root keys are 256-bit symmetric secrets, held individually per region, while application-specific key pairs are generated from a root for a single service and epoch.

These key-management services then secure customer private keys under their public components. The keys travel through different paths: wrapped keys and metadata traverse Quicksilver, Cloudflare's globally replicated key-value store, whereas regional root keys follow a separate route through the provisioning service and are stored in Vault.

Before an edge server acquires a root key, it undergoes three crucial checks: TPM hardware identity verification, a lookup in Zinc, Cloudflare's server inventory, that maps the identity to a data center and location, and a decision by the provisioning service about which roots the server may hold. Authorized servers subsequently load regional root keys into the kernel keyring rather than storing them on disk.

This approach ensures that if a machine restarts, the keys are removed, and the server must authenticate again. Regional membership refreshes occur multiple times daily as the network changes, independent of key rotation and without the need for customer intervention. Cloudflare highlighted a few concerns raised by Dabeer Shaikh, a senior solutions engineer at HashiCorp, regarding the blast radius of a compromised regional root key, potential out-of-region server access to regional keys via compromised Zinc inventory or provisioning services, protection for keys exposed before a rotation, and the possibility of a compromised control plane altering regional membership.

Tehrani, a professor of cybersecurity, also posed five questions concerning the blast radius, service-wide impact in case of failures, and the design's central tradeoff. Cloudflare clarified that any failed check on service context, region, or epoch would lead to request rejection, and at the edge, a missing or malformed key would prevent the service from starting.

The designers deemed this a deliberate "very intentional design choice." The trust boundary encompasses the key-management, provisioning, and authorized edge key services; Quicksilver remains outside this boundary as it only holds wrapped keys and metadata. This reconstruction builds upon Cloudflare's earlier post-quantum work, including its hybrid ML-KEM for IPsec service in March and its plans for a quantum-safe certificate authority. Cloudflare aims to cover most regions at launch, with product-specific exceptions.