Cloudflare's new PQ GeoKey Manager: keys that can only unwrap inside a chosen region, wrapped with hybrid ML-KEM + X25519

Cloudflare's PQ GeoKey Manager is a geographically restricted key management system designed to enforce data sovereignty by allowing decryption keys to be unwrapped only within specified geographic regions. It uses hybrid post-quantum cryptography combining ML-KEM-768 (a NIST standard) and X25519 to secure wrapped keys. The system separates globally distributed wrapped private keys from regional root keys, which are provisioned only to authorized edge servers within the allowed region and stored in volatile kernel keyring memory. Requests attempting to decrypt keys outside their authorized region fail closed, ensuring strict geographic enforcement. The system supports multiple services and epochs, with application-specific keys derived from regional root keys. This approach mitigates 'harvest now, decrypt later' attacks by protecting keys against future quantum computer threats while maintaining high availability and compliance with data localization regulations.

The PQ GeoKey Manager enhances data sovereignty and security by ensuring that decryption keys cannot be unwrapped or used outside authorized geographic regions. This prevents unauthorized access to sensitive data in transit or at rest across Cloudflare's global network. The use of hybrid post-quantum cryptography protects against future quantum computing attacks that could compromise classical encryption. The system's fail-closed behavior on out-of-region decryption attempts reduces the risk of data leakage. However, it introduces operational complexity in managing regional root keys and ensuring correct regional configurations. There are no known exploits in the wild at this time.

Cloudflare manages the deployment and operation of the PQ GeoKey Manager as a cloud service. Customers selecting this service should follow Cloudflare's guidance for regional key configuration and provisioning. Since this is a new feature in closed beta with planned general availability, customers should monitor Cloudflare advisories for updates and apply recommended configurations to enforce geographic restrictions. No direct patching or remediation is required by customers beyond proper configuration and use of the service.