Cloudflare launches post-quantum GeoKey Manager beta

The new GeoKey Manager combines post-quantum and classical cryptography to address future quantum threats without compromising regional restrictions on encryption key access.

Cloudflare has launched a post-quantum GeoKey Manager in closed beta, adding geographically restricted key management to its Data Localization Suite (DLS). The service is designed to ensure that customer decryption keys can only be accessed by authorised Cloudflare servers within designated geographical regions, supporting organisations with data sovereignty and data localisation requirements. General availability is planned for the first quarter of 2027.

The system addresses both data residency requirements and emerging threats from quantum computing. Under a ‘harvest now, decrypt later’ attack, adversaries collect encrypted data and retain it until sufficiently powerful quantum computers can break the cryptography protecting it. For its Cloudflare One implementation, the new architecture combines the post-quantum ML-KEM-768 algorithm with the classical X25519 algorithm in a hybrid key-encapsulation mechanism, strengthening protection against future quantum threats while maintaining regional restrictions on decryption.