ApplyDjinn digest · AI assisted
Bringing post-quantum cryptography to geographically fenced key management
Overview
Cloudflare launched a post-quantum geographically restricted key manager in closed beta for its Data Localization Suite. The PQ GeoKey Manager wraps customer decryption keys so only servers in a chosen geography can unwrap them, pairing regional boundaries with hybrid post-quantum protection. General availability is planned for Q1 2027.
Key facts
- Hybrid protection uses ML-KEM-768 with X25519, HKDF-SHA-256, and AES-256-GCM under HPKE from RFC 9180.
- A regional root key is a 256-bit symmetric secret, and application-specific keys are derived per service and epoch.
- Compromising one application-specific private key can expose keys that share that service, region, and epoch.
Key figures
- Q1 2027 — Planned general availability of the post-quantum GeoKey Manager.
- 2017 — Year Cloudflare pioneered geo-restricted TLS keys on its network.
- 2022 — Year attribute-based encryption replaced fixed data-center key binding.
- 256-bit — Size of each symmetric regional root key secret.
- ML-KEM-768 — NIST standard paired with X25519 in hybrid encapsulation.
- FIPS 140-3 — Compliance target tied to registered server hardware identity.
Context
Keys are stored and distributed through an on-premises Vault after regional provisioning.
What remains uncertain
No production-ready post-quantum ABE scheme exists today, so Cloudflare adopted a simpler hybrid design.
A concise AI-assisted digest of selected facts. The original publication may contain additional detail and later updates. Company data below is a separate ApplyDjinn observation.
Request a correction or removalApplyDjinn context
What else is visible for Cloudflare?
These are observations in our catalog around the company, not claims made by the article. A publication does not establish why hiring, search interest, or share prices moved.
Current roles
115
30-day current-market scope
Company stories · 30d
46
45 official · 1 independent
Attention records · 7d
10
0 Google · 10 Polymarket
Coverage mix
Attention sources
Open roles
115
NET share
$280.70
30-day share move
-19.2%
Hiring and market history
Daily vacancy snapshots and closing share prices are independent signals.
Vacancy history
NET closing price
Share price is shown for context, not as company-size or investment advice.
Vacancy history uses saved daily snapshots through 2026-11-01. News counts are dated publications; attention counts are matched records, not search volume or prediction probabilities.