EN PT-BR
← Voltar ao feed
low

Cloudflare launches post-quantum GeoKey Manager in closed beta for geographically fenced key management

1 fonte(s) · 1 atualização(ões) · publicado 23/10/2026 15:06 · coletado há 1 semana

Cloudflare has launched a post-quantum GeoKey Manager in closed beta as part of its Data Localization Suite (DLS). General availability is planned for Q1 2027. The service wraps customer private keys so they can only be unwrapped by Cloudflare servers in the customer's chosen geography. This supports data sovereignty requirements and mitigates "harvest now, decrypt later" risk. The announcement is a product and architecture description, not a threat or incident report.

Detalhes técnicos

  • The design uses hybrid ML-KEM-768 + X25519 protection. Cloudflare replaced the 2022 ciphertext-policy attribute-based encryption (ABE) design because no production-ready post-quantum ABE scheme exists.
  • A 256-bit symmetric regional root key is tied to one region. Application-specific HPKE key pairs (RFC 9180, with HKDF-SHA-256 and AES-256-GCM) are derived from it per service context, such as Gateway or Tunnel.
  • Each wrapped key carries metadata for service context, regional boundary and epoch. Quicksilver distributes wrapped keys globally but never distributes regional root keys.
  • A separate provisioning service, backed by on-premises Vault, delivers regional root keys only to authorized edge servers. It checks TPM-backed hardware identity and Zinc inventory location data, then issues a token.
  • Edge servers hold root keys in the Linux kernel keyring, not on disk, so a restart removes them. Regional membership is refreshed several times a day.
  • The system fails closed. If the service context, region or epoch check fails, or a root key is missing or malformed, the request is rejected or the service does not start.
  • Soft rotation keeps a limited number of previous epochs usable. Hard rotation rewraps keys under a new epoch so the old one can be removed.
  • The trust boundary covers the key-management service, the provisioning service and the authorized edge key services. Compromising a regional root key would affect all application-specific keys derived from it for that epoch.

Remediação

No remediation is required. Current DLS customers who regionalize CDN traffic can register intent to test the feature before it is generally available for CDN. Cloudflare says a separate CDN integration is in development, and new Regional Services capabilities for Cloudflare One will be announced in a few months.

Linha do tempo

  1. blog.cloudflare.com ↗ · pub. 23/10/2026 15:06 · coletado 23/10 16:00 primeiro registro

    Cloudflare launches post-quantum GeoKey Manager in closed beta for geographically fenced key management

    ler a análise desta fonte

    Cloudflare has launched a post-quantum GeoKey Manager in closed beta as part of its Data Localization Suite (DLS). General availability is planned for Q1 2027. The service wraps customer private keys so they can only be unwrapped by Cloudflare servers in the customer's chosen geography. This supports data sovereignty requirements and mitigates "harvest now, decrypt later" risk. The announcement is a product and architecture description, not a threat or incident report.

    Technical Details

    • The design uses hybrid ML-KEM-768 + X25519 protection. Cloudflare replaced the 2022 ciphertext-policy attribute-based encryption (ABE) design because no production-ready post-quantum ABE scheme exists.
    • A 256-bit symmetric regional root key is tied to one region. Application-specific HPKE key pairs (RFC 9180, with HKDF-SHA-256 and AES-256-GCM) are derived from it per service context, such as Gateway or Tunnel.
    • Each wrapped key carries metadata for service context, regional boundary and epoch. Quicksilver distributes wrapped keys globally but never distributes regional root keys.
    • A separate provisioning service, backed by on-premises Vault, delivers regional root keys only to authorized edge servers. It checks TPM-backed hardware identity and Zinc inventory location data, then issues a token.
    • Edge servers hold root keys in the Linux kernel keyring, not on disk, so a restart removes them. Regional membership is refreshed several times a day.
    • The system fails closed. If the service context, region or epoch check fails, or a root key is missing or malformed, the request is rejected or the service does not start.
    • Soft rotation keeps a limited number of previous epochs usable. Hard rotation rewraps keys under a new epoch so the old one can be removed.
    • The trust boundary covers the key-management service, the provisioning service and the authorized edge key services. Compromising a regional root key would affect all application-specific keys derived from it for that epoch.

    Remediation

    No remediation is required. Current DLS customers who regionalize CDN traffic can register intent to test the feature before it is generally available for CDN. Cloudflare says a separate CDN integration is in development, and new Regional Services capabilities for Cloudflare One will be announced in a few months.