Cloudflare tests post-quantum keys fenced to one region
A closed beta wraps customer decryption keys so only servers in a chosen region can ever unwrap them, aimed at data sovereignty rules and harvest-now-decrypt-later attacks.
Cloudflare opened a closed beta on 23 October for PQ GeoKey Manager, a key-management system built into its Data Localization Suite. Each customer’s decryption key is wrapped with a region-specific key, so a key provisioned for, say, Germany can only be unwrapped by Cloudflare servers physically in that region, never in Spain or France.
The wrapping itself uses a hybrid scheme: ML-KEM-768 alongside X25519, following the HPKE standard in RFC 9180, with HKDF-SHA-256 for derivation and AES-256-GCM for the actual encryption. Pairing a post-quantum algorithm with a classical one means the data stays confidential even if only one of the two holds up. Regional root keys sit in a server’s Linux kernel keyring rather than on disk. General availability is planned for Q1 2027.
Why it matters: this targets “harvest now, decrypt later”, where encrypted traffic captured today is stored for decryption once quantum computers can break current key exchange. For teams under GDPR or similar data-residency rules, it is also a concrete answer to “can you prove this key never leaves the region”, which matters more as that becomes a contractual requirement rather than a nice-to-have.
The caveat: this is closed beta, and only existing Data Localization Suite customers can register interest, through a form linked from the post. Nobody else can try it yet.