Google Cloud’s PQC Roadmap: Quantum-Proofing Your Stack by 2029

Google Cloud just dropped its post-quantum cryptography (PQC) roadmap, and it’s a big deal for anyone building on their platform. The goal? Full quantum readiness by 2029, with a clear path to protect your data from future quantum threats. Let’s break down what this means for you, minus the jargon.

Why PQC Matters Now

Quantum computers are getting closer, and they could crack today’s encryption like a caiman cracks a log. Google’s been prepping for a decade, and now they’re sharing the blueprint. The key threats? ‘Store Now, Decrypt Later’ (SNDL) attacks, where bad guys hoard encrypted data today to decrypt it later, and forged signatures that could compromise integrity.

What’s Already Done

Google’s not just talking—they’ve shipped some serious PQC features already:

• API endpoints now support quantum-safe key exchange (ML-KEM) on google.com and *.googleapis.com.
• Load balancers offer hybrid PQC key exchange (X25519MLKEM768) for TLS 1.3, opt-in for now.
• Cloud KMS has NIST-standardized PQC algorithms (ML-KEM, ML-DSA, SLH-DSA) generally available.

The Roadmap: Three Domains

Google’s plan tackles three main areas, each with its own timeline:

1. SNDL Mitigation (by 2027)

This is about protecting data in transit and at rest from future decryption. Expect quantum-safe TLS for your workloads, secure admin flows (Cloud VPN, SDKs), and protected data pipelines (Cloud Storage, BigQuery).

2. Integrity & Non-Repudiation (by 2028)

Digital signatures get a quantum-proof upgrade. This includes securing the software supply chain (Binary Authorization, Cloud Build), issuing quantum-safe certificates (ML-DSA, SLH-DSA), and protecting identity (Cloud IAM).

3. Foundations & Key Management (by 2028)

Cryptographic agility is the bedrock. Cloud KMS already supports PQC, and they’re adding quantum-safe key import, hardware-backed security (Confidential Computing, Cloud HSM), and key sovereignty options (EKM, partner solutions).

Your Part in the Quantum Dance

Google handles the cloud’s security, but you’ve got homework too. Start by inventorying your crypto assets, updating your SDKs and tools to support PQC, and validating your apps against their quantum-safe endpoints. It’s a shared responsibility, but the swamp’s getting safer for everyone.

For more on how Google Cloud stacks up, check our Google Cloud review. And if you’re comparing platforms, our Vercel review and Supabase review might help you see the bigger picture.

Original announcement published on Google Cloud.