--- title: Bringing post-quantum cryptography to geographically... description: Cloudflare has launched a post-quantum geographically restricted key manager in closed beta, part of its Data Localization Suite, with general availability... canonical: https://daily.dev/posts/bringing-post-quantum-cryptography-to-geographically-fenced-key-management-3ib2zzvtg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Bringing post-quantum cryptography to geographically fenced key management | daily.dev og:description: Cloudflare has launched a post-quantum geographically restricted key manager in closed beta, part of its Data Localization Suite, with general availability... og:url: https://daily.dev/posts/bringing-post-quantum-cryptography-to-geographically-fenced-key-management-3ib2zzvtg og:image: https://api.daily.dev/og/posts/3iB2zzVTg.png og:image:alt: Bringing post-quantum cryptography to geographically fenced key management og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Bringing post-quantum cryptography to geographically fenced key management **[Cloudflare](https://daily.dev/sources/cloudflare)** · 13 min read · 1 upvotes · 0 comments ## Summary Cloudflare has launched a post-quantum geographically restricted key manager in closed beta, part of its Data Localization Suite, with general availability planned for Q1 2027. The new GeoKey Manager wraps each customer decryption key so it can only be unwrapped by Cloudflare servers located in an approved geography. It uses a hybrid key-encapsulation scheme combining ML-KEM-768 with X25519, protecting against harvest now, decrypt later attacks. Regional root keys are 256-bit symmetric secrets stored in a server's kernel keyring rather than on disk, and edge servers fail closed if a required regional root key is missing. The system supports soft and hard key rotation for transitioning between key epochs. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What key encapsulation mechanism does Cloudflare use for post-quantum geo-restricted key management? Cloudflare's GeoKey Manager uses a hybrid HPKE scheme combining ML-KEM-768, a post-quantum key encapsulation mechanism, with X25519 for classical elliptic-curve protection, following RFC 9180. HKDF-SHA-256 handles key derivation and AES-256-GCM provides authenticated encryption. Combining post-quantum and classical components keeps data confidential as long as at least one component remains secure. _Developers tracking post-quantum migration strategies can follow real-world hybrid KEM deployments like this on daily.dev._ ### How does Cloudflare prevent decryption keys from being used outside an approved geographic region? Cloudflare's GeoKey Manager wraps each customer's private key with a region-specific application key derived from a 256-bit symmetric regional root key, so only servers holding that root key can unwrap it. Regional root keys are loaded into a server's Linux kernel keyring rather than stored on disk, and a request fails closed if the required regional root key isn't locally available, so a request intended for Germany cannot be decrypted in Spain or France. _Teams designing data sovereignty controls can compare approaches like this one on daily.dev._ ### What is the difference between soft rotation and hard rotation for cryptographic keys in Cloudflare's GeoKey Manager? Soft rotation creates a new epoch for a regional root key while still allowing a limited number of previous epochs to remain usable, similar to how a credit card company lets a prior card keep working for recurring payments during a transition. Hard rotation instead rewraps all affected private keys under a new epoch and removes access to the old epoch entirely, blocking any further use of the previous keys. _Engineers planning key rotation strategies can dig into patterns like this on daily.dev._ ## Similar posts on daily.dev - [Cloudflare’s Post-Quantum GeoKey Manager Enters Closed Beta Without Attribute-Based Encryption](https://daily.dev/posts/cloudflare-s-post-quantum-geokey-manager-enters-closed-beta-without-attribute-based-encryption-3myhrvtji) · InfoQ · 1 upvotes · 0 comments - [Post-quantum encryption for Cloudflare IPsec is generally available](https://daily.dev/posts/post-quantum-encryption-for-cloudflare-ipsec-is-generally-available-bafxrwzks) · Cloudflare · 0 upvotes · 0 comments - [Announcing quantum-safe key import in Cloud KMS](https://daily.dev/posts/announcing-quantum-safe-key-import-in-cloud-kms-jrusae7fr) · Google Cloud · 0 upvotes · 0 comments - [Standardizing Post-Quantum IPsec: Cloudflare Adopts Hybrid ML-KEM to Replace Ciphersuite Bloat](https://daily.dev/posts/standardizing-post-quantum-ipsec-cloudflare-adopts-hybrid-ml-kem-to-replace-ciphersuite-bloat-72husfcdu) · InfoQ · 0 upvotes · 0 comments --- Tags: [#quantum-computing](https://daily.dev/tags/quantum-computing), [#cloudflare](https://daily.dev/tags/cloudflare) [View this post on daily.dev](https://daily.dev/posts/bringing-post-quantum-cryptography-to-geographically-fenced-key-management-3ib2zzvtg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Bringing post-quantum cryptography to geographically fenced key management","url":"https://daily.dev/posts/bringing-post-quantum-cryptography-to-geographically-fenced-key-management-3ib2zzvtg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/bringing-post-quantum-cryptography-to-geographically-fenced-key-management-3ib2zzvtg"},"datePublished":"2026-10-23T18:10:26.385Z","dateModified":"2026-10-23T18:11:08.441Z","description":"Cloudflare has launched a post-quantum geographically restricted key manager in closed beta, part of its Data Localization Suite, with general availability...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/022753a0fb4726f269b49aa2f6ef0837?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/022753a0fb4726f269b49aa2f6ef0837?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Cloudflare","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Cloudflare","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/38522e1d11354cd6b7af66f9d4316735","url":"https://daily.dev/sources/cloudflare"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/bringing-post-quantum-cryptography-to-geographically-fenced-key-management-3ib2zzvtg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"quantum-computing,cloudflare","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Cloudflare","item":"https://daily.dev/sources/cloudflare"},{"@type":"ListItem","position":3,"name":"Bringing post-quantum cryptography to geographically fenced key management"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/bringing-post-quantum-cryptography-to-geographically-fenced-key-management-3ib2zzvtg#faq","mainEntity":[{"@type":"Question","name":"What key encapsulation mechanism does Cloudflare use for post-quantum geo-restricted key management?","acceptedAnswer":{"@type":"Answer","text":"Cloudflare's GeoKey Manager uses a hybrid HPKE scheme combining ML-KEM-768, a post-quantum key encapsulation mechanism, with X25519 for classical elliptic-curve protection, following RFC 9180. HKDF-SHA-256 handles key derivation and AES-256-GCM provides authenticated encryption. Combining post-quantum and classical components keeps data confidential as long as at least one component remains secure. Developers tracking post-quantum migration strategies can follow real-world hybrid KEM deployments like this on daily.dev."}},{"@type":"Question","name":"How does Cloudflare prevent decryption keys from being used outside an approved geographic region?","acceptedAnswer":{"@type":"Answer","text":"Cloudflare's GeoKey Manager wraps each customer's private key with a region-specific application key derived from a 256-bit symmetric regional root key, so only servers holding that root key can unwrap it. Regional root keys are loaded into a server's Linux kernel keyring rather than stored on disk, and a request fails closed if the required regional root key isn't locally available, so a request intended for Germany cannot be decrypted in Spain or France. Teams designing data sovereignty controls can compare approaches like this one on daily.dev."}},{"@type":"Question","name":"What is the difference between soft rotation and hard rotation for cryptographic keys in Cloudflare's GeoKey Manager?","acceptedAnswer":{"@type":"Answer","text":"Soft rotation creates a new epoch for a regional root key while still allowing a limited number of previous epochs to remain usable, similar to how a credit card company lets a prior card keep working for recurring payments during a transition. Hard rotation instead rewraps all affected private keys under a new epoch and removes access to the old epoch entirely, blocking any further use of the previous keys. Engineers planning key rotation strategies can dig into patterns like this on daily.dev."}}]} ```