Cloudflare brings post-quantum encryption to its regional key manager

[GoldDriver]

Cloudflare has added post-quantum protection to a product that keeps encryption keys inside chosen regions. The Cloudflare blog, written by Chetan Agrawal, Arka Nayan and Erik Engstrom, announces a post-quantum Geo Key Manager in closed beta, with general availability planned for the first quarter of 2027

Geo Key Manager lets customers say that their TLS and service keys can only be used by Cloudflare servers in a specific region. The goal here is to protect that system against harvest now, decrypt later attacks, where traffic is stored today and broken by a future quantum computer

The original 2022 design used attribute based encryption, and there is no production ready post-quantum version of that. Instead, Cloudflare uses hybrid ML-KEM-768 with X25519 through HPKE, along with HKDF-SHA-256 and AES-256-GCM. Each region has a 256 bit root key from which application keys are derived

Root keys only go to authorised edge servers, which are checked using TPM identity and the server inventory. They are held in the kernel keyring rather than written to disk, and the system fails closed if anything looks wrong. A Regional Services offering for Cloudflare One is due in a few months

Cloudflare has been one of the most practical voices on post-quantum migration, and this is another sensible step. Choosing a hybrid scheme hedges against any surprise weakness in the newer algorithms. It is also refreshing that the blog admits the original design could not simply be upgraded

Is hybrid encryption the right approach during the transition? And how worried should companies be about harvest now, decrypt later?

Bringing post-quantum cryptography to geographically fenced key managementblog.cloudflare.com