Quantum-Safe Key Import Hits Cloud KMS Preview

Google Cloud just dropped a fresh batch of quantum-safe armor for your keys. The new quantum-safe key import in Cloud KMS is now in preview, letting you wrap your software keys in a post-quantum envelope before they travel across the network. Think of it as giving your keys a life vest before they swim through the swamp—except this vest is woven from hybrid public key encryption (HPKE) and NIST-approved algorithms.

This move is the next step in Google’s post-quantum cryptography (PQC) migration timeline, following their earlier quantum-safe digital signatures and key encapsulation mechanisms. It’s all about staying ahead of the ‘store now, decrypt later’ (SNDL) attacks, where adversaries hoard encrypted data today, waiting for a quantum computer to crack it tomorrow.

Why You Should Care

If you’re using bring your own key (BYOK) in a multicloud setup, this is your jam. Traditional key import relies on classical encryption, which will crumble when a cryptographically-relevant quantum computer (CRQC) shows up. With quantum-safe key import, you’re wrapping your keys in a quantum-resistant envelope from day one, so they’re safe even if intercepted.

Plus, you can now monitor your post-quantum posture with Cloud KMS PQC insights, which is generally available. It gives you a visual breakdown of your asymmetric keys based on their algorithms, helping you plan for the quantum future.

How It Works

The new import method uses HPKE to wrap your key material. Here’s the flow:

• Initiate: Create an import job via the Cloud KMS API, requesting a post-quantum HPKE method.
• Generate: Cloud KMS generates a post-quantum KEM private key and shares the public key with you.
• Wrap: Using Tink or OpenSSL, you run an HPKE Seal() operation to encrypt your key material.
• Submit: Send the ciphertext back to Cloud KMS, which already has quantum-safe data-in-transit protection.
• Unwrap: Cloud KMS uses its private key to decrypt and securely store your key.

You can choose between X-Wing, ML-KEM-768, or ML-KEM-1024 for the KEM layer, with HKDF-SHA-256 for key derivation and AES-256-GCM for the final wrap. It’s a solid stack that fits right into your existing Cloud KMS workflow.

What This Means for Your Stack

This isn’t just a Google Cloud thing—it’s a signal for the whole ecosystem. As the swamp gets murkier with quantum threats, tools like Google Cloud are stepping up. If you’re comparing platforms, check out our Vercel review or Supabase review to see how they handle security. And for a broader view, our model pricing comparison might help you budget for AI workloads.

Quantum-safe key import is a big leap, but it’s just one milestone. The migration to PQC is a marathon, and Google’s making it easier to take that first step. So dive in, test it out, and let them know what you think.

Original announcement published on Google Cloud.