Google Cloud has updated its post-quantum cryptography roadmap, aiming for full PQC readiness by 2029 to protect against future quantum threats. The strategy focuses on three domains: mitigating Store Now Decrypt Later risks, ensuring integrity against forgery, and enhancing cryptographic agility. Immediate progress includes quantum-safe key exchange on API endpoints and load balancers, general availability of PQC algorithms in Cloud KMS, and experimentation with Merkle Tree Certificates.
Immediate Progress: 2026 Milestones
Google Cloud API endpoints now offer quantum-safe key exchange in hybrid mode using NIST-standardized ML-KEM (FIPS 203), protecting incoming traffic from future decryption attempts. This includes google.com and *.googleapis.com, securing customer and internal service communications at the edge. The hybrid approach combines classical and post-quantum algorithms to ensure backward compatibility while advancing quantum resistance.
Application and proxy load balancers support quantum-safe hybrid key exchange (X25519MLKEM768) for TLS 1.3 on an opt-in basis, allowing customers to validate PQC readiness while minimizing disruption to existing applications. This enables gradual adoption without requiring immediate changes to client configurations or breaking existing TLS 1.3 workflows.
Cloud KMS has made NIST-standardized PQC algorithms (ML-KEM, ML-DSA, SLH-DSA) generally available for encryption and signing keys, enabling customers to adopt quantum-safe cryptographic operations today. These algorithms are accessible through standard Cloud KMS interfaces, allowing seamless integration into existing key management workflows without requiring specialized hardware or software changes.
Domain 1: Store Now Decrypt Later Mitigation
Google Cloud is securing customer workloads by enabling quantum-confidential TLS 1.3 handshakes for services and configured load balancers to protect user sessions from future quantum decryption of today’s encrypted traffic. This ensures that data transmitted over Google Cloud networks remains confidential even if intercepted and stored for later decryption by a quantum-capable adversary.
Administrator and developer flows are being secured through quantum-safe protections in Cloud VPN, Interconnect, ALTS, client libraries, SDKs, and Tink, safeguarding management and deployment stacks against harvest-and-decrypt attacks. These measures protect sensitive operational workflows such as infrastructure provisioning, configuration updates, and secure access to development environments.
Data pipelines in Cloud Storage SDK, Storage Transfer Service, BigQuery CLI, and Data Transfer Service are being upgraded to ensure confidentiality of sensitive intellectual property and customer data against future quantum-capable adversaries. This includes encrypting data in transit between storage systems, analytics platforms, and transfer services using post-quantum resistant cryptographic protocols.
Domains 2 and 3: Integrity, Foundations, and Shared Responsibility
Work on integrity and non-repudiation includes issuing quantum-safe certificates via ML-DSA and SLH-DSA, securing the software supply chain with Binary Authorization and Assured OSS, and protecting identity and access in Cloud IAM, with most milestones targeting completion by 2028. These efforts ensure that software artifacts, digital signatures, and authentication mechanisms remain trustworthy in a post-quantum world.
Foundational capabilities are being strengthened through hardware-backed cryptographic services like Confidential Computing and Quantum-Safe Cloud HSM, alongside key sovereignty solutions such as External Key Management and partner enablement for on-premises key providers. This includes integrating post-quantum roots of trust into hardware security modules and enabling customers to manage their own keys in hybrid or multi-cloud environments.
Google manages the security of the cloud, including infrastructure and encryption-in-transit, while customers must update client-side software, configure quantum-safe settings, and manage asymmetric key lifecycles to share responsibility for quantum safety. This shared model ensures that both provider and user contribute to end-to-end protection against quantum threats.
What to do next
Organizations should begin by inventorying cryptographic assets using Cloud Asset Inventory or third-party tools, updating development workflows to use PQC-supporting software like BoringSSL and Chrome, and validating applications with quantum-safe APIs and load balancers. These steps help identify bottlenecks early and ensure a smoother transition to quantum readiness. Starting now allows teams to build familiarity with post-quantum algorithms before broader deployment becomes necessary.
Source: PQC in Plaintext: Google Cloud’s post-quantum cryptography roadmap (GCP).
