Google Cloud sets 2027 quantum-security milestone

Google Cloud has set the end of 2027 as its first major deadline for protecting customer workloads and sensitive data flows against attacks enabled by future quantum computers, marking a significant step in its wider plan to make its cloud infrastructure post-quantum ready by 2029.

The timetable places so-called “store now, decrypt later” attacks at the front of the company’s security migration. Under that threat model, attackers collect encrypted information today and retain it until sufficiently powerful quantum computers become available to break cryptographic systems that currently protect the data. Google Cloud is prioritising information whose confidentiality must survive for years, even if a capable quantum computer does not emerge for some time.

The company has divided its post-quantum cryptography programme into separate risk domains rather than attempting a single infrastructure-wide conversion. The first domain covers confidentiality and the store-now-decrypt-later threat, with key changes targeted for completion by the end of 2027. A second domain, addressing integrity, digital signatures and non-repudiation, carries a 2028 target. Foundations and key-management infrastructure are also scheduled to reach their main milestones by the end of 2028, before the broader programme converges towards full readiness in 2029.

The 2027 programme encompasses customer workloads, administrative and developer connections and data pipelines. Google Cloud plans quantum-resistant protection for services including Cloud VPN, Cloud Interconnect, GCE OS Login, the Cloud SDK, gCloud CLI, GKE service mesh and client libraries during 2026 and 2027. Storage and analytics-related transfers involving the Cloud Storage SDK, Storage Transfer Service, BigQuery CLI and Data Transfer Service are covered by the same period.

Several building blocks are already operating. Google Cloud API endpoints, including google. com and *. googleapis. com endpoints, use the NIST-standardised ML-KEM algorithm in a hybrid configuration for quantum-safe key exchange. Cloud KMS has also made ML-KEM, ML-DSA and SLH-DSA generally available, providing customers with standardised mechanisms for key establishment and digital signatures.

Application Load Balancers and external proxy Network Load Balancers began supporting the hybrid X25519MLKEM768 key exchange for TLS 1.3 connections in June. Customers can currently opt into the protection. Google plans to enable it by default from October 2026 while permitting customers to defer adoption until October 2027. After that point, the post-quantum exchange is intended to remain enabled by default without the deferral option.

The shift follows the standardisation of the first core post-quantum cryptographic algorithms by the US National Institute of Standards and Technology in 2024. FIPS 203 specifies ML-KEM for establishing shared secrets, while FIPS 204 defines ML-DSA digital signatures and FIPS 205 covers the hash-based SLH-DSA signature system. NIST has urged organisations to begin migration rather than wait for quantum machines capable of defeating current public-key cryptography.

Quantum computing poses a particular risk to widely deployed asymmetric cryptography because sufficiently capable machines running quantum algorithms could undermine mathematical problems on which conventional public-key encryption and digital signatures depend. The timing of such a machine remains uncertain, but the security problem begins before it exists because stolen encrypted material may retain value for many years.

Google Cloud’s second major phase therefore extends beyond confidentiality. By 2028, it plans broader protection for software supply chains, certificate authorities, identity systems and digital attestations. Assured Open Source Software is listed for 2027, Private Certificate Authority support for quantum-safe certificates is also planned for 2027, and Cloud IAM is targeted for 2028. An infrastructure-wide rollout of quantum-resistant authentication and access mechanisms spans 2027 and 2028.

Hardware presents another challenge because cryptographic transitions cannot always be delivered through software updates. Google is incorporating quantum-resistant roots of trust into its infrastructure and expects work involving Confidential Computing and Cloud HSM to advance through 2028. Some physical equipment may remain on replacement cycles extending beyond the overall 2029 readiness target.