Cloudflare's Post-Quantum GeoKey Manager Enters Closed Beta Without Attribute-Based Encryption
InfoQ, Monday, November 2nd, 2026
Cloudflare put a post-quantum GeoKey Manager into closed beta, replacing attribute-based encryption with hybrid ML-KEM-768 and X25519.
Cloudflare moved a post-quantum rebuild of GeoKey Manager into closed beta, protecting geo-fenced decryption keys with a hybrid of ML-KEM-768 and X25519 instead of the attribute-based encryption used since 2022.
The beta opened October 23 to existing Data Localization Suite customers, with general availability planned for the first quarter of 2027.
The redesign targets both data sovereignty rules and harvest-now, decrypt-later attacks, and Cloudflare dropped ABE because no production-ready post-quantum variant exists and customers do not need its many regions.
Key protection now uses HPKE per RFC 9180 with regional root keys and per-application, per-epoch key pairs, with wrapped keys distributed via Quicksilver and root keys stored in Vault.