Cloudflare Swaps Attribute-Based Encryption for Post-Quantum Scheme in GeoKey Manager
- Reading
- 5 min
- Tables
- 1
Cloudflare's geographically restricted key manager entered closed beta with a hybrid post-quantum scheme, replacing the attribute-based encryption used since 2022. The decision to fail closed on verification errors is dividing the technical community.
On October 23, 2026, Cloudflare put into closed beta a complete rebuild of GeoKey Manager, the service that geographically restricts where decryption keys can be used. The change replaces the attribute-based encryption the service had used since 2022 with a hybrid post-quantum scheme combining ML-KEM-768 and X25519. Access is currently restricted to customers already using the Data Localization Suite, and general availability is expected in the first quarter of 2027, according to InfoQ.
GeoKey Manager isn't new: it debuted in 2017 handling TLS keys and migrated, in 2022, to ciphertext-policy attribute-based encryption (CP-ABE). According to engineers Chetan Agrawal, Arka Nayan, and Erik Engstrom, authors of the technical post cited by InfoQ, the redesign tackles two problems at once: data sovereignty rules that require processing plaintext only within a region, and harvest-now-decrypt-later attacks, in which traffic captured today is stored to be decrypted once a quantum computer exists.
Why Attribute-Based Encryption Was Dropped
Cloudflare gives two reasons for abandoning CP-ABE, according to the report. There is currently no production-ready post-quantum variant of this scheme. And, in practice, customers never needed the huge number of regions that CP-ABE was built to express through attribute policies.
In place of attribute policies, the new design uses two types of keys. Regional root keys are 256-bit symmetric secrets, one per region. Application-specific key pairs are derived from a root key for a single service, such as Tunnel or Gateway, and a single epoch, a term Cloudflare uses for a key generation that advances with each rotation.
How the Hybrid Scheme Protects the Keys
Key protection uses HPKE, the hybrid public-key encryption construction defined in RFC 9180, with a key encapsulation mechanism that combines ML-KEM-768 and X25519, plus HKDF-SHA-256 and AES-256-GCM. The key management service derives the application key pair and wraps the customer's private keys under the public component of that pair.
| Aspect | Old scheme (since 2022) | Beta scheme (since Oct 2026) |
|---|---|---|
| Encryption | CP-ABE | HPKE with hybrid KEM (ML-KEM-768 + X25519) |
| Quantum-resistant | No | Yes |
| Granularity | Attribute policies for many regions | One symmetric root key per region |
| Where the key runs on the server | Not detailed by the source | Kernel keyring (volatile memory) |
The Key's Path to the Edge Server
The two types of keys follow different routes. Quicksilver, Cloudflare's globally replicated key-value store, carries already-wrapped keys and metadata to the entire network. Regional root keys, in turn, go through a separate path through the provisioning service, which stores them in Vault.
Before an edge server receives a root key, it must pass three checks:
- Hardware identity verification via TPM;
- A lookup in Zinc, Cloudflare's server inventory, which maps server identity to a data center and location;
- A decision by the provisioning service on which root keys that specific server may receive.
Authorized servers load regional root keys into the kernel keyring instead of writing them to disk. Since this memory is volatile, Cloudflare's own post describes the consequence:
A machine restart removes the keys.
Cloudflare, technical post about the GeoKey Manager redesign
After a restart, the server has to authenticate again. Each server's regional membership is updated several times a day as the network changes, separately from key rotation and without any action from the customer.
Rotation Without Taking Down the Service
Dabeer Shaikh, senior solutions engineer at HashiCorp, publicly asked under Cloudflare's announcement how a key tied to a region can be rotated without downtime. The answer lies in the epoch model: a soft rotation creates a new epoch while a limited number of previous epochs remain valid, letting the customer maintain availability during the transition. A forced rotation rewraps the affected keys under the replacement epoch and removes access to the previous epoch.
The Fail-Closed Design and the Open Questions
Mark Tehrani, founder of the consultancy CyberSeQ and a cybersecurity professor, posted five questions in the same thread. Four of them target the blast radius of a compromised regional root key: whether a compromised Zinc inventory or provisioning service could hand regional keys to a server outside the region, what protects keys exposed before a rotation, and whether a compromised control plane could alter a server's regional membership. The fifth question goes straight to the design's central trade-off:
If regional key provisioning, synchronization, or rotation fails, could the fail-closed design cause a region-wide service outage?
Mark Tehrani, founder of CyberSeQ and cybersecurity professor
Cloudflare's post is direct about this behavior. Any check that fails, whether of service context, region, or epoch, rejects the request; at the edge, a missing or malformed key means the service simply doesn't start. The authors call this choice:
a very intentional design choice.
The system's trust boundary covers the key management and provisioning services and the authorized edge keys. Quicksilver falls outside this boundary, since it only stores wrapped keys and metadata, never plaintext material.
What This Means for Data Localization Suite Users
The GeoKey Manager redesign extends a pattern Cloudflare has been following in post-quantum cryptography: the company adopted hybrid ML-KEM in its IPsec service in March 2026, when more than 60% of human-generated TLS traffic on the network already used hybrid schemes, and has since announced plans for a quantum-safe certificate authority. Most regions should be covered at launch, with product-specific caveats.
For Brazilian teams using the Data Localization Suite due to regulatory or sector requirements, or because of the LGPD (Brazil's data protection law), the practical point isn't the cryptography itself, it's the failure behavior. A scheme that refuses to serve instead of degrading gracefully trades leak risk for downtime risk, and that trade-off only becomes real experience once the beta runs at scale, something Cloudflare itself hadn't explicitly answered in response to Tehrani's questions as of the report's publication.
Anyone relying on the suite to operate sensitive data within a regional boundary should follow the rollout and test rotation-failure scenarios before migrating production workloads to the new scheme, since enrollment is still restricted to existing customers during the beta.
Translated from the Brazilian Portuguese original · Read the original
AWS Has Reserved Capacity Sold Out Through 2027, But Sets Aside a Share for On-Demand Use
Andy Jassy confirms that large blocks of AWS capacity are largely sold out through 2027, with part of 2028 already allocated. The company says it keeps room for on-demand EC2 and Bedrock, but developers are already reporting queues for common instances.
