Cloudflare opens closed beta of its geographically restricted key manager with post-quantum cryptography
Cloudflare launched PQ GeoKey Manager in closed beta, a key manager that combines post-quantum cryptography with the data localization rules of its Data Localization Suite. A customer's decryption keys can only be opened on servers within the chosen geography, because the regional root key travels through a separate channel and is not distributed globally. It uses HPKE (RFC 9180) with ML-KEM-768 and X25519. General availability is expected in the first quarter of 2027.
In 35 seconds
- PQ GeoKey Manager is in closed beta; general availability is expected in the first quarter of 2027.
- The regional root key, a 256-bit symmetric secret, is delivered only to authorized edge servers in that region.
- The design uses HPKE under RFC 9180, with ML-KEM-768 and X25519, HKDF-SHA-256 and AES-256-GCM.
IASummary generated by artificial intelligence from a story by El Ecosistema Startup. It may contain errors: the original source prevails.




Comments
Be respectful. Comments reported by several people are hidden until a moderator reviews them.
You do not need an account to read, only to comment. Sign in with a code sent to your email or with your Google account. We only show the name you choose, never your email.