Google Sets 2027 Goal for First Post-Quantum Security Milestone
▼ Summary
– Google Cloud’s post-quantum migration roadmap targets store-now-decrypt-later risk by end of 2027, with signature hardening and key management completed by end of 2028.
– Quantum-safe key exchange using ML-KEM is now available on API endpoints and load balancers, while Cloud KMS supports ML-KEM, ML-DSA, and SLH-DSA.
– Upcoming releases include Cloud VPN and Interconnect in 2026–2027, Private CA in 2027, and quantum-safe Cloud IAM and HSM in 2028.
– Google addresses large post-quantum certificate signatures with Merkle Tree Certificates, replacing multiple signatures with one compact proof and integrating transparency logging into issuance.
– Customers must update client software and manage key lifecycles, while some hardware transitions may extend past 2029 due to equipment replacement cycles.
Google Cloud has broken its post-quantum migration into a phased timeline, with the first major security milestone slated for completion by the close of 2027. The roadmap, unveiled on August 12, sorts the work into three distinct risk categories based on Google’s internal quantum threat model.
The most urgent priority is mitigating store-now-decrypt-later (SNDL) risk , where adversaries collect encrypted data today with the intention of decrypting it once a sufficiently powerful quantum computer exists. Google targets this domain for completion by the end of 2027. Meanwhile, efforts to harden digital signatures against forgery and rebuild key management for cryptographic agility extend through the end of 2028. That timeline sits ahead of the 2029 date Google previously set alongside Cloudflare and Microsoft.
What Has Already Shipped
Several quantum-resistant features are already live. Google Cloud API endpoints, including google.com and *.googleapis.com, now support quantum-safe key exchange using the NIST-standardized ML-KEM in hybrid mode. Application and proxy load balancers also offer hybrid key exchange for TLS 1.3, though it is initially opt-in so customers can test compatibility without disrupting existing workloads.
Cloud KMS has reached general availability for ML-KEM, ML-DSA, and SLH-DSA algorithms. Additionally, quantum-confidential ALTS, Google’s internal traffic protocol, was completed in 2025. Looking ahead, Cloud VPN and Interconnect arrive in 2026 and 2027, followed by Private CA in 2027, and quantum-safe Cloud IAM and Cloud HSM in 2028.
The Certificate Problem
Certificates introduce an extra layer of complexity. Post-quantum signatures are large enough to slow down certificate chain validation, a bottleneck Google plans to address with Merkle Tree Certificates. Jason Soroko, senior fellow at certificate lifecycle management provider Sectigo, explained that this method swaps multiple bulky signatures for a single compact inclusion proof, keeping performance overhead close to current levels. It also embeds transparency logging into the issuance process rather than layering it on afterward. As Soroko put it, “If a certificate is not in the tree, it simply does not exist.”
Google was direct about shared responsibility. Customers must update client-side software to negotiate post-quantum handshakes and take charge of their own asymmetric key lifecycles. On the hardware front, the company noted that some physical components may not be replaced until after 2029, since the transition depends partly on natural equipment refresh cycles.
The urgency is real. Google warned in March that a cryptographically relevant quantum computer could emerge as early as 2029, making the current migration window a narrow one.
(Source: Infosecurity Magazine)