cloud
Cloudflare Launches Post-Quantum Geo Key Manager and Remediates KV Cache Exposure
Cloudflare introduces post-quantum geographically restricted key manager and fixes KV cache exposure issue in GLM-5.3 Workers AI model
What changed and what the sources confirm
The recent launch of Cloudflare's post-quantum geographically restricted key manager, known as PQ GeoKey Manager, marks a significant development in the company's Data Localization Suite (DLS). According to the source Bringing post-quantum cryptography to geographically fenced key management, this new feature ensures that a customer's decryption keys are only accessible in their chosen geography. This is achieved by wrapping each decryption key such that it can only be decrypted by Cloudflare servers located in the allowed geography.
In addition to the launch of PQ GeoKey Manager, Cloudflare has also remediated a KV cache exposure issue in the GLM-5.3 Workers AI model. As reported in Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang, the issue allowed a small number of customers to receive responses that contained data from other customers' requests made to the same model shortly before theirs. The remediation involved adjusting the GLM 5.3 configuration to match the GLM 5.2 configuration, freeing enough GPU memory to hold the full context, and patching the engine to make the rejection path safe.
The launch of PQ GeoKey Manager and the remediation of the KV cache exposure issue demonstrate Cloudflare's commitment to security and data sovereignty. As stated in Bringing post-quantum cryptography to geographically fenced key management, the new GeoKey Manager provides customers with greater control over their decryption keys, while the remediation of the KV cache exposure issue ensures the integrity of customer data.
Furthermore, the sources confirm that Cloudflare's Data Localization Suite (DLS) is designed to support customers' data sovereignty goals while migrating all Cloudflare products to post-quantum (PQ) cryptography. As mentioned in Bringing post-quantum cryptography to geographically fenced key management, the suite includes the PQ GeoKey Manager, which controls where wrapped private keys can be unwrapped and used on the data plane.
In conclusion, the launch of PQ GeoKey Manager and the remediation of the KV cache exposure issue are significant developments in Cloudflare's efforts to enhance security and data sovereignty. The sources confirm that these developments demonstrate Cloudflare's commitment to protecting customer data and providing customers with greater control over their decryption keys.
How the technology works and who it affects
The launch of the post-quantum Geo Key Manager and the remediation of the KV cache exposure issue demonstrate Cloudflare's commitment to security and data sovereignty. The new Geo Key Manager provides customers with greater control over their decryption keys, while the remediation of the KV cache exposure issue ensures the integrity of customer data. According to Cloudflare's blog post on post-quantum Geo Key Manager, this new feature ensures that a customer's decryption keys are only accessible in their chosen geography. Additionally, as stated in Cloudflare's blog post on KV cache exposure remediation, the company has remediated a KV cache exposure issue in the GLM-5.3 Workers AI model, which affected a small number of customers.
The post-quantum Geo Key Manager implements post-quantum cryptography to restrict where customers' private keys are unwrapped. This is achieved by separating globally distributed wrapped private keys from the regional root key required to unwrap them. As explained in Cloudflare's blog post on post-quantum Geo Key Manager, Quicksilver, Cloudflare's global configuration distribution system, distributes wrapped private keys and their metadata across the network, while regional root keys follow a separate, controlled path and are only delivered to edge servers authorized for each region.
The KV cache exposure issue, on the other hand, was caused by a misconfiguration of the open-source inference engine, SGLang, used by Cloudflare. As described in Cloudflare's blog post on KV cache exposure remediation, the issue allowed a small number of customers to receive responses that contained data from other customers' requests made to the same model shortly before theirs. Cloudflare took immediate action to correct the vulnerability by adjusting the GLM 5.3 configuration to match the GLM 5.2 configuration, freeing enough GPU memory to hold the full context, and patching the engine to make the rejection path safe.
The impact of these technologies is significant, as they affect not only Cloudflare's customers but also the broader security and data sovereignty landscape. As noted in Cloudflare's blog post on post-quantum Geo Key Manager, the new Geo Key Manager provides customers with greater control over their decryption keys, while the remediation of the KV cache exposure issue ensures the integrity of customer data. Furthermore, as stated in Cloudflare's blog post on KV cache exposure remediation, the company's efforts to address the KV cache exposure issue demonstrate its commitment to security and data sovereignty.
In terms of next steps, customers can enable the post-quantum Geo Key Manager through the Cloudflare dashboard. Additionally, Cloudflare recommends that customers review their security settings and ensure that they are using the latest version of the GLM-5.3 Workers AI model. For more information on Cloudflare's security features and services, visit Cloudflare Services.
Practical implications, tradeoffs and limitations
The launch of the post-quantum Geo Key Manager and the remediation of the KV cache exposure issue have significant practical implications for Cloudflare's customers. The new Geo Key Manager provides customers with greater control over their decryption keys, ensuring that they are only accessible in their chosen geography. This is particularly important for organizations with sensitive data that must be protected from unauthorized access. However, the implementation of post-quantum cryptography also introduces new tradeoffs and limitations. For example, the use of hybrid ML-KEM-768 and X25519 protection requires careful key management and may introduce additional complexity for customers. Additionally, the regional root key management system may require customers to carefully plan and manage their key hierarchies to ensure that their decryption keys are properly restricted.
The remediation of the KV cache exposure issue also has practical implications for customers. The bug bounty program that identified the issue demonstrates the importance of collaboration between Cloudflare and security researchers to identify and fix vulnerabilities. However, the issue also highlights the potential risks associated with the use of complex systems like the GLM-5.3 Workers AI model. Customers must carefully evaluate the potential risks and benefits of using such systems and ensure that they are properly configured and monitored to prevent similar issues from arising.
In terms of limitations, the post-quantum Geo Key Manager is currently only available in closed beta, and general availability is planned for Q1 2027. This may limit the availability of the feature for some customers. Additionally, the use of post-quantum cryptography may require significant changes to existing systems and processes, which can be time-consuming and costly to implement. Furthermore, the regional root key management system may require customers to have a deep understanding of their key hierarchies and how they are used, which can be a complex and challenging task.
Overall, the launch of the post-quantum Geo Key Manager and the remediation of the KV cache exposure issue demonstrate Cloudflare's commitment to security and data sovereignty. However, customers must carefully evaluate the practical implications, tradeoffs, and limitations of these features to ensure that they are properly implemented and managed. For more information on Cloudflare's security features and services, visit Cloudflare Services. The Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang and Bringing post-quantum cryptography to geographically fenced key management articles provide additional details on these topics.
What developers should do next and conclusion
The launch of the post-quantum Geo Key Manager and the remediation of the KV cache exposure issue demonstrate Cloudflare's commitment to security and data sovereignty. As stated in Bringing post-quantum cryptography to geographically fenced key management, the new Geo Key Manager provides customers with greater control over their decryption keys. The remediation of the KV cache exposure issue, as described in Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang, ensures the integrity of customer data.
Developers should take note of the post-quantum Geo Key Manager's ability to restrict where customers' private keys are unwrapped, as this feature can help protect against potential quantum computer attacks. As mentioned in Bringing post-quantum cryptography to geographically fenced key management, this is particularly important for organizations that process highly sensitive data.
In addition, developers should review their security settings and ensure that they are using the latest version of the GLM-5.3 Workers AI model. They should also be aware of the potential for KV cache exposure issues and take steps to prevent them, such as implementing proper cache management and monitoring.
Overall, the launch of the post-quantum Geo Key Manager and the remediation of the KV cache exposure issue are important steps towards improving the security and data sovereignty of Cloudflare's customers. As the security landscape continues to evolve, it is essential for developers to stay up-to-date with the latest security features and best practices, such as those described in How bug bounty sharpens one researcher’s security skills.
By following these best practices and utilizing Cloudflare's security features, developers can help protect their customers' data and ensure the integrity of their applications. For more information on Cloudflare's security features and services, visit Cloudflare Services.
In conclusion, the post-quantum Geo Key Manager and the remediation of the KV cache exposure issue are significant advancements in Cloudflare's security offerings. Developers should take advantage of these features and stay informed about the latest security developments to ensure the security and data sovereignty of their applications.
Explore Leyora’s software development services.