Cloudflare wants to stop a quantum computer from decrypting tomorrow the traffic stolen today

For some companies, it doesn't matter where their traffic travels. What matters is where the keys that decrypt it are used. Since 2017, Cloudflare has offered these customers a guarantee that their private keys are used only in a chosen region, such as France, Germany or the European Union. On October 23, the company announced a new version of this service, designed to withstand future quantum computers.

The service is called Geo Key Manager. It is part of the Data Localization Suite, Cloudflare's offering for customers subject to data localization requirements. The new version is in closed beta, and Cloudflare expects general availability in the first quarter of 2027.

Why the old version had to be rebuilt

In 2022, Cloudflare relied on an elegant technique: attribute-based encryption, which reserves a secret for servers that have certain characteristics, such as their country. The problem, according to Cloudflare, is that there is currently no production-ready post-quantum version of this encryption.

The stakes are concrete. An attacker who records encrypted traffic today could decrypt it the day a sufficiently powerful quantum computer exists. Specialists call this threat "store now, decrypt later." Cloudflare therefore chose a simpler design that is protected against this scenario.

How the new system works

Each region has a 256-bit symmetric root key. From this key, Cloudflare derives a separate key pair for each service (for example, its Gateway security gateway or its tunnels). The customer's decryption key is then "wrapped" so that only servers in the authorized region can unwrap it.

This wrapping relies on a hybrid key exchange that combines ML-KEM-768, the post-quantum algorithm standardized by NIST, and X25519, a proven classical algorithm. The whole follows the HPKE standard (RFC 9180) and encrypts with AES-256-GCM. Hybridization, which ANSSI (France's national cybersecurity agency) in particular recommends, preserves confidentiality as long as at least one of the two algorithms remains secure, according to Cloudflare.

Cloudflare chose a system that refuses rather than takes risks: if a region's root key is missing on a server, the service does not start, and requests that need it are rejected. Root keys live only in memory. A restarted server must therefore receive them again.

What to know before looking into it

• The scope is limited: the service controls only where private keys can be used. Request routing and traffic inspection fall under a separate product, Regional Services.
• Access is restricted: the beta is reserved for Data Localization Suite customers. Customers of this suite who regionalize their traffic on the content delivery network (CDN) can apply through a form.
• The timeline remains open: an improved Regional Services offering for Cloudflare One, built on this service, is to be announced "in a few months," and the CDN version is under development. Pricing has not been disclosed.

The day before, another player took a step toward post-quantum security: LibreSSL 4.4, OpenBSD's cryptography library, now prefers the hybrid X25519MLKEM768 exchange for TLS 1.3 connections established through its libtls library. Cloudflare, for its part, is multiplying its post-quantum projects, including its plan to become a certificate authority. The general availability of the new key manager, expected in early 2027, will show whether European customers follow.