Cloudflare Launches Post-Quantum GeoKey Manager with Hybrid ML-KEM-768 Encryption for Regional Data Sovereignty
Article excerpt
Highlighted: the sentence this signal was extracted from
Global cloud and edge network provider Cloudflare (NYSE: NET) has launched its Post-Quantum (PQ) GeoKey Manager in closed beta as part of its Data Localization Suite (DLS) , integrating NIST-standardized post-quantum cryptography to enforce strict geographical boundaries on customer private key access. General availability across Cloudflare's network is scheduled for the first quarter of 2027. The upgraded infrastructure allows enterprises to control exactly where their private TLS and transport decryption keys can be unwrapped across Cloudflare's global anycast network. By transitioning to a quantum-safe key encapsulation model, the system protects long-term sensitive enterprise data against "Harvest Now, Decrypt Later" (HNDL) attacks while satisfying regional data sovereignty mandates such as GDPR and financial locality regulations. Cloudflare first introduced geographic key isolation in 2017, later updating the platform in 2022 to utilize Ciphertext-Policy Attribute-Based Encryption (CP-ABE) to support dynamic multi-region access policies. However, because production-ready, standardized post-quantum ABE schemes do not currently exist, Cloudflare redesigned the cryptographic architecture to adopt Hybrid Public Key Encryption (HPKE, RFC 9180). The revised implementation pairs lattice-based ML-KEM-768 with classical elliptic-curve Diffie-Hellman (X25519). Under this...
Keep reading with a free account
The rest of this article, and every signal for Cloudflare, is in your free account.
