--- title: Cloudflare’s Post-Quantum GeoKey Manager Enters Closed... description: Cloudflare has moved a post-quantum rebuild of its GeoKey Manager into closed beta, replacing the attribute-based encryption used since 2022. Keys are now... canonical: https://daily.dev/posts/cloudflare-s-post-quantum-geokey-manager-enters-closed-beta-without-attribute-based-encryption-3myhrvtji twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cloudflare’s Post-Quantum GeoKey Manager Enters Closed Beta Without Attribute-Based Encryption | daily.dev og:description: Cloudflare has moved a post-quantum rebuild of its GeoKey Manager into closed beta, replacing the attribute-based encryption used since 2022. Keys are now... og:url: https://daily.dev/posts/cloudflare-s-post-quantum-geokey-manager-enters-closed-beta-without-attribute-based-encryption-3myhrvtji og:image: https://api.daily.dev/og/posts/3myhrVTJI.png og:image:alt: Cloudflare’s Post-Quantum GeoKey Manager Enters Closed Beta Without Attribute-Based Encryption og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cloudflare’s Post-Quantum GeoKey Manager Enters Closed Beta Without Attribute-Based Encryption **[InfoQ](https://daily.dev/sources/infoq)** · 4 min read · 1 upvotes · 0 comments ## Summary Cloudflare has moved a post-quantum rebuild of its GeoKey Manager into closed beta, replacing the attribute-based encryption used since 2022. Keys are now protected with HPKE using a hybrid ML-KEM-768 and X25519 key encapsulation mechanism, HKDF-SHA-256 and AES-256-GCM. Regional root keys live only in volatile kernel memory on verified servers, so a restart wipes them and forces re-authentication. The beta opened October 23 for Data Localization Suite customers, with general availability planned for Q1 2027. Any failed region, epoch or service check causes the system to fail closed and reject the request, a choice someone questioned could trigger a regional outage. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What cryptographic algorithms does Cloudflare's post-quantum GeoKey Manager use? It uses HPKE as defined in RFC 9180, with a key encapsulation mechanism combining ML-KEM-768 and X25519, paired with HKDF-SHA-256 for key derivation and AES-256-GCM for encryption. This hybrid approach protects regional root keys and application-specific key pairs, replacing the ciphertext-policy attribute-based encryption scheme used since 2022. _Teams planning post-quantum migrations can track real KEM implementations like this on daily.dev._ ### How does Cloudflare rotate geo-fenced encryption keys without causing downtime? Cloudflare uses an epoch model where a soft rotation creates a new epoch while a limited number of previous epochs remain usable, letting customers keep uptime during the transition. A hard rotation rewraps affected keys under a replacement epoch and removes access to the previous one, fully retiring the old keys. _Engineers designing zero-downtime key rotation can compare approaches like this via daily.dev._ ### What happens if a regional key check fails in Cloudflare's GeoKey Manager? The system fails closed: any failed check on service context, region, or epoch rejects the request, and at the edge a missing or malformed key means the service simply does not start. Cloudflare calls this a deliberate design choice, though practitioners have questioned whether it could cause a region-wide outage if provisioning, synchronization, or rotation fails. _Architects weighing fail-closed versus fail-open tradeoffs can follow this debate on daily.dev._ ## Similar posts on daily.dev - [Bringing post-quantum cryptography to geographically fenced key management](https://daily.dev/posts/bringing-post-quantum-cryptography-to-geographically-fenced-key-management-3ib2zzvtg) · Cloudflare · 1 upvotes · 0 comments - [Standardizing Post-Quantum IPsec: Cloudflare Adopts Hybrid ML-KEM to Replace Ciphersuite Bloat](https://daily.dev/posts/standardizing-post-quantum-ipsec-cloudflare-adopts-hybrid-ml-kem-to-replace-ciphersuite-bloat-72husfcdu) · InfoQ · 0 upvotes · 0 comments - [Announcing quantum-safe key import in Cloud KMS](https://daily.dev/posts/announcing-quantum-safe-key-import-in-cloud-kms-jrusae7fr) · Google Cloud · 0 upvotes · 0 comments - [AWS Secrets Manager now supports hybrid post-quantum TLS to protect secrets from quantum threats](https://daily.dev/posts/aws-secrets-manager-now-supports-hybrid-post-quantum-tls-to-protect-secrets-from-quantum-threats-m1zexumou) · AWS · 0 upvotes · 0 comments --- Tags: [#quantum-computing](https://daily.dev/tags/quantum-computing), [#cloudflare](https://daily.dev/tags/cloudflare), [#encryption](https://daily.dev/tags/encryption) [View this post on daily.dev](https://daily.dev/posts/cloudflare-s-post-quantum-geokey-manager-enters-closed-beta-without-attribute-based-encryption-3myhrvtji) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cloudflare’s Post-Quantum GeoKey Manager Enters Closed Beta Without Attribute-Based Encryption","url":"https://daily.dev/posts/cloudflare-s-post-quantum-geokey-manager-enters-closed-beta-without-attribute-based-encryption-3myhrvtji","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cloudflare-s-post-quantum-geokey-manager-enters-closed-beta-without-attribute-based-encryption-3myhrvtji"},"datePublished":"2026-10-31T20:03:36.441Z","dateModified":"2026-10-31T20:04:02.628Z","description":"Cloudflare has moved a post-quantum rebuild of its GeoKey Manager into closed beta, replacing the attribute-based encryption used since 2022. Keys are now...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/51c9ddd8a28e31478e47c2b165ac2ef3?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/51c9ddd8a28e31478e47c2b165ac2ef3?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cloudflare-s-post-quantum-geokey-manager-enters-closed-beta-without-attribute-based-encryption-3myhrvtji","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"quantum-computing,cloudflare,encryption","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"Cloudflare’s Post-Quantum GeoKey Manager Enters Closed Beta Without Attribute-Based Encryption"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cloudflare-s-post-quantum-geokey-manager-enters-closed-beta-without-attribute-based-encryption-3myhrvtji#faq","mainEntity":[{"@type":"Question","name":"What cryptographic algorithms does Cloudflare's post-quantum GeoKey Manager use?","acceptedAnswer":{"@type":"Answer","text":"It uses HPKE as defined in RFC 9180, with a key encapsulation mechanism combining ML-KEM-768 and X25519, paired with HKDF-SHA-256 for key derivation and AES-256-GCM for encryption. This hybrid approach protects regional root keys and application-specific key pairs, replacing the ciphertext-policy attribute-based encryption scheme used since 2022. Teams planning post-quantum migrations can track real KEM implementations like this on daily.dev."}},{"@type":"Question","name":"How does Cloudflare rotate geo-fenced encryption keys without causing downtime?","acceptedAnswer":{"@type":"Answer","text":"Cloudflare uses an epoch model where a soft rotation creates a new epoch while a limited number of previous epochs remain usable, letting customers keep uptime during the transition. A hard rotation rewraps affected keys under a replacement epoch and removes access to the previous one, fully retiring the old keys. Engineers designing zero-downtime key rotation can compare approaches like this via daily.dev."}},{"@type":"Question","name":"What happens if a regional key check fails in Cloudflare's GeoKey Manager?","acceptedAnswer":{"@type":"Answer","text":"The system fails closed: any failed check on service context, region, or epoch rejects the request, and at the edge a missing or malformed key means the service simply does not start. Cloudflare calls this a deliberate design choice, though practitioners have questioned whether it could cause a region-wide outage if provisioning, synchronization, or rotation fails. Architects weighing fail-closed versus fail-open tradeoffs can follow this debate on daily.dev."}}]} ```