PQC in Plaintext: Google Cloud’s post-quantum cryptography roadmap

Securing infrastructure and services against a future cryptographically-relevant quantum computer has been a goal for Google for a decade, and we’ve dedicated ourselves to help developers by advancing open standards that can benefit everyone. As post-quantum cryptography (PQC) has matured, we’ve been rolling it out in our infrastructure for internal and customer-facing services. 

Today, we’re sharing our updated Google Cloud roadmap to migrate to PQC by 2029.

Our strategy: Secure by design

We’ve based our PQC migration strategy on the Google Quantum Threat Model, prioritizing protection across three key domains:

• Mitigating Store Now, Decrypt Later (SNDL) risks: Protecting today’s encrypted data from being harvested and decrypted by a future quantum computer.

• Ensuring integrity against forgery: Strengthening digital signatures to prevent attackers from falsifying data and identity.

• Enhancing foundational capabilities for cryptographic agility: Building flexible systems that can easily adopt new cryptographic standards with minimal engineering effort as cryptographic standards evolve.

We’re actively transitioning internal infrastructure and customer-facing services to PQC algorithms far ahead of regulatory deadlines.

We are also deploying PQC solutions across our Sovereign Cloud initiatives, such as Google Cloud Dedicated (GCD) and Google Distributed Cloud (GDC), in collaboration with our partners. Similarly, our strategy allows us to progress on integrating post-quantum protections across our AI services to secure the next generation of cloud workloads. 

These efforts are fundamental pillars of our overarching strategy to achieve full post-quantum readiness across Google Cloud. As this landscape evolves, we will continue to refine and update our deployment schedules.

We plan to achieve full PQC readiness by 2029, when our efforts converge. We anticipate continuing those efforts into the 2030s to support broader industry guidance and evolving global standards. These standards include CNSA 2.0 and the transition paths defined in NIST IR 8547, which anticipate the final deprecation of legacy, quantum-vulnerable algorithms between 2030 and 2035.

Immediate progress: 2026 milestones

Leadership in the quantum era requires deployment at global scale. We have achieved foundational milestones that provide immediate protection for our customers:

• API endpoint readiness: Google Cloud API endpoints now offer quantum-safe key exchange, protecting incoming traffic from future decryption. These endpoints include google.com and *.googleapis.com, and both have implemented NIST-standardized ML-KEM (FIPS 203) in hybrid mode.

• Load balancers PQC support: Application and proxy load balancers now support quantum-safe hybrid key exchange (X25519MLKEM768) for TLS 1.3. Initially available on an opt-in basis, this allows our customers to perform validation, while minimizing impacts to their existing applications.  

• Quantum-safe certificate experimentation at scale: We’re collaborating with the IETF PLANTS Working Group to produce a public key infrastructure (PKI) standard that minimizes impact to your operations teams. Chrome and Cloudflare have started experimenting with Merkle Tree Certificates to address challenges using PQC signatures for WebPKI, and we have been sharing insights with the standards working group.

• Cloud KMS PQC algorithms: NIST standardized PQC algorithms (ML-KEM, ML-DSA, SLH-DSA) for your encryption and signing keys are now generally available. 

The roadmap to 2029

We’ve established specific customer-centered journeys for Google Cloud to achieve quantum readiness that allow us to prioritize our quantum-safety initiatives. By adopting this risk-based approach, we focus on the core journeys our security experts have identified as most vulnerable to the potential impacts of quantum computing.

These scenarios offer diverse platform perspectives to ensure global enablement across our services to meet you where you are.

For each risk domain, we provide a roadmap for key products and services organized by domain, although the services highlighted are not exhaustive lists. We project most services will meet their respective domain’s target completion date, though specific product timelines may be adjusted if necessary to account for evolving engineering requirements and any third-party dependencies.

Domain 1: Store Now Decrypt Later (SNDL) mitigation

This domain focuses on addressing vulnerabilities in asymmetric encryption where a future cryptographically-relevant quantum computer (CRQC) could decrypt data captured today.

We’re enabling incremental progress for our customers based on their typical journeys.

• Securing your customer workloads: Offer quantum-confidential TLS 1.3 handshakes for your Google Cloud services and configured load balancers to protect user sessions.

• Securing administrator and developer flows: Protect the admin pathways used to manage your cloud environment against SNDL. This includes services such as Cloud VPN and Interconnect. For developers, these include client libraries, SDKs, and Tink, our open-source cryptographic library.

• Securing data pipelines: Safeguard the confidentiality of data transfers for our analytics and storage platforms. PQC is essential to ensure that sensitive intellectual property and customer data flowing through these systems cannot be captured today and decrypted by a future quantum-capable adversary.

Roadmap
We are targeting these changes for 2027. 

Domain 2: Integrity and non-repudiation

This domain addresses quantum-proofing of digital signatures and attestations to safeguard against forgery that could compromise data integrity and authenticity.

• Securing the software supply chain: Ensure that only trusted, untampered images with quantum-resistant attestations run in production to help prevent a quantum attacker from altering builds. This includes services like Binary Authorization, Cloud Build, and Assured Open Source Software.

• Issuing quantum-safe certificates: Transition the public key infrastructure (PKI) including our internal and external certificate authorities (CAs) to support ML-DSA certificates and where meaningful, SLH-DSA certificates. This transition will follow Internet Engineering Task Force (IETF) standardization efforts that are currently in development. We’re actively contributing to these efforts, and we’re also conducting several large-scale experiments:

• Address large PQC signature sizes that can impact the performance of certificate chain validations through novel approaches like Merkle Tree Certificates for Web PKI. 

• Support ML-DSA/SLH-DSA (pure PQC)-based certificates in private CA solutions such as Certificate Authority Service (CAS). 

• Add quantum-authentication in addition to our internal traffic protocol ALTS that already supports PQC for confidentiality. You can learn more technical details on our approach to digital signatures and Public Key Infrastructure here.

• Protecting identity and access: Ensure authentication mechanisms like service account keys and tokens (JWT/OAuth) are resistant to quantum forgery.

Roadmap
We are targeting completion of these milestones by 2028. We also are mindful of ongoing standardization efforts particularly in the field of certificates. Google is actively contributing to quantum-safe certificate standards, and we are committed to help the industry overall meet those deadlines.

Domain 3: Foundations and key management

Cryptographic agility is the foundation of our PQC migration. Our ongoing investment in this area drives our end-to-end strategy for key management, libraries, and infrastructure changes.

• Foundational key management and libraries: Enable NIST-approved algorithms through Cloud KMS and libraries like BoringSSL and Tink. 

• Note that Cloud KMS achieved general availability for the NIST standardized PQC algorithms (ML-KEM, ML-DSA, SLH-DSA), and is in the process of enabling quantum-safe key import.

• Hardware-backed cryptographic services: Secure physical foundations using quantum-resistant roots of trust. This includes PQC as part of our Confidential Computing offerings and Cloud Hardware Security Module (HSM).

• Key sovereignty and partner solutions: Enable PQC orchestration for Google Workspace Client-side Encryption (CSE) and External Key Managers (EKM). Collaborate with partners to support PQC on-premises key providers.

Roadmap
We are targeting completion of these milestones by 2028. 

A shared responsibility for quantum safety

Security has long been a collaborative partnership with our customers. 

Google’s responsibility — Security of the cloud: We manage the transition to a quantum-safe infrastructure, including our network and encryption in-transit, global front-ends, and the ALTS protocol. 

This responsibility encompasses the end-to-end PQC transition of our servers, ensuring that the underlying hardware and operating systems are secured against quantum threats. We maintain hardware integrity through quantum-safe, open-source silicon foundations such as Caliptra v2.1, TPM 2.0 v185, and OpenTitan. The latter is the first open-source silicon root of trust and already supports quantum-secure boot. 

While we are working toward our 2029 target, hardware transition to PQC involves both active replacement, where feasible, and natural equipment replacement cycles. Our phased approach ensures stability, though the timeline for some physical components may extend beyond 2029.

Customer’s responsibility — Security in the cloud: Organizations must manage their own applications, including updating client-side software to negotiate PQC handshakes and managing the lifecycle of your asymmetric keys.  

In addition, you should update your Google Cloud service configurations with quantum-safe settings and policies.

Our path forward, together

Building momentum toward quantum readiness requires immediate, practical action. We recommend starting with these three steps:

1. Inventory: Identify your cryptographic resources (such as keys and certificates) using Cloud Asset Inventory and solutions such as Wiz’s cryptography and PQC readiness. When you map cryptographic resource usage across your organization, you can more accurately define and prioritize your migration backlog.

2. Update: Ensure your development and Site Reliability Engineering teams are using software that supports PQC algorithms such as BoringSSL, Chrome, and SDKs. This update ensures your internal workflows are prepared to negotiate quantum-safe connections by default as we enable them at the edge.

3. Validate: Test the behaviors of your existing application using our quantum-safe APIs and load balancers. Validating your workflows today will identify architectural bottlenecks before they impact your primary production environments.

Google Cloud is committed to managing the complexity of this transition so you can achieve your regulatory and compliance commitments, while focusing on innovation. We are just beginning to share our progress as we work to empower our customers to lead in the post-quantum landscape.

To learn more about our PQC approach, please visit our post-quantum cryptography (PQC) hub.