Google Cloud Targets 2029 for Post-Quantum Cryptography Readiness
Summary
Google Cloud’s roadmap targets full post-quantum readiness by 2029, with milestones for mitigating store-now-decrypt-later risk, protecting signatures and identity, and preparing customers to adopt quantum-safe settings.
Key points
- Google Cloud targets 2029 for full readiness, with work expected to continue into the 2030s as standards evolve.
- Its API endpoints, including google[.]com and googleapis[.]com, now use NIST-standardized ML-KEM in hybrid mode.
- Application and proxy load balancers support opt-in quantum-safe hybrid key exchange for TLS 1.3; Cloud KMS has general availability for NIST-standardized post-quantum algorithms.
- Google targets the end of 2027 to mitigate store-now-decrypt-later risk across customer-facing workloads, tools and data-transfer services.
- Signature and identity protections, including quantum-safe certificates and software supply-chain attestations, are targeted for completion by the end of 2028.
- Google recommends customers inventory cryptographic assets, update development and operations tooling for PQC-capable libraries, and test applications with available quantum-safe APIs and load balancers.
Article Details
- Event Type
- Google Cloud published an updated roadmap for migrating its infrastructure to post-quantum cryptography, targeting full readiness by 2029.
- Impact
- The roadmap prioritizes reducing Store Now Decrypt Later risk, protecting digital signatures from forgery, and enabling cryptographic agility. Google says its API endpoints already use hybrid ML-KEM key exchange, and load balancers support opt-in quantum-safe hybrid key exchange for TLS 1.3. Customer-facing workloads and related services are targeted for SNDL risk mitigation by the end of 2027; signature, identity, and foundational key-management protections are targeted primarily for the end of 2028, with some efforts continuing into the 2030s. Customers remain responsible for updating client-side software, managing encryption-key lifecycles, and enabling quantum-safe settings when available.
Vendors
Products
BigQuery CLIand developer tooling such as Cloud VPN and Interconnect, and data transfer services including the BigQuery CLI and Storage Transfer Service.Cloud HSMkey import as early as 2026, while hardware-backed protections such as confidential computing and Cloud HSM, along with external key management and partner-enabled key sovereignty options, are slated for 2028.Cloud IAMThis covers quantum-resistant software supply chain attestations, the rollout of quantum-safe certificates across Google’s infrastructure, and hardening of identity mechanisms such as Cloud IAM.Cloud KMSIn addition, cloud KMS has also reached general availability for NIST-standardized PQC algorithms covering both key exchange and digital signatures.Cloud VPNfor mitigating SNDL risk across customer-facing workloads, administrative and developer tooling such as Cloud VPN and Interconnect, and data transfer services including the BigQuery CLI and Storage Transfer Service.Google CloudGoogle Cloud has published an updated roadmap for migrating its infrastructure to post-quantum cryptography (PQC), targeting full readiness by 2029, with some work expected to continue into the next decade.InterconnectSNDL risk across customer-facing workloads, administrative and developer tooling such as Cloud VPN and Interconnect, and data transfer services including the BigQuery CLI and Storage Transfer Service.Storage Transfer Servicesuch as Cloud VPN and Interconnect, and data transfer services including the BigQuery CLI and Storage Transfer Service.