Google Cloud has outlined a phased roadmap for its transition to post-quantum cryptography, setting a target of late 2027 for the completion of its first major security milestone. This initial phase focuses on mitigating "store-now-decrypt-later" (SNDL) risks, where data collected today could be decrypted by a future quantum computer. The comprehensive plan, published on August 12, organizes the migration into three distinct risk domains, based on Google's internal quantum threat model.
The subsequent phases aim to harden digital signatures against forgery and rebuild key management systems to support cryptographic agility. These efforts are scheduled for completion by the end of 2028, aligning with a broader industry timeline that Google, Cloudflare, and Microsoft previously established for 2029.
Significant progress has already been made in implementing quantum-safe measures. Google Cloud API endpoints, including `google.com` and `*.googleapis.com`, now offer quantum-safe key exchange using the NIST-standardized ML-KEM algorithm in a hybrid mode. Similarly, application and proxy load balancers support hybrid key exchange for TLS 1.3, initially as an opt-in feature to allow customers to validate without disrupting existing applications.
Cloud Key Management Service (KMS) has reached general availability for ML-KEM, ML-DSA, and SLH-DSA. Additionally, quantum-confidential ALTS, Google's internal traffic protocol, completed its transition in 2025. Upcoming integrations include Cloud VPN and Interconnect in 2026 and 2027, Private CA in 2027, and Cloud IAM along with a quantum-safe Cloud HSM in 2028.
A particular challenge lies in the realm of digital certificates, as post-quantum signatures are considerably larger, potentially impacting certificate chain validation performance. Google is addressing this through the use of Merkle Tree Certificates. This approach replaces multiple large signatures with a single, compact inclusion proof, aiming to keep overhead near current levels. It also integrates transparency logging directly into the issuance process, ensuring that any certificate not present in the tree is effectively non-existent.
Google has emphasized that customers will share responsibility in this transition, needing to update their client-side software to negotiate post-quantum handshakes and manage their own asymmetric key lifecycles. The company also noted that the timeline for some physical hardware components might extend beyond 2029, as their transition is partly dependent on natural equipment replacement cycles. Google previously warned in March that a cryptographically relevant quantum computer could emerge as early as 2029.
