Quantum-Safe Signatures Now in Cloud KMS

Quantum computers are creeping closer, and the swamp of cryptographic threats is getting murkier. But fear not, fellow capybaras—Google Cloud KMS has just dropped a life raft: general availability of quantum-safe digital signatures (ML-DSA, SLH-DSA) and post-quantum key encapsulation (ML-KEM). Time to future-proof your data integrity before the caimans catch up.

Why Quantum-Safe Matters Now

The U.S. government has tightened its timeline for migrating to quantum-safe algorithms, and regulatory bodies like NSA’s CNSA 2.0 are setting the pace. If you’re handling long-lived data, you need to start planning your migration yesterday. Cloud KMS now offers a suite of NIST-approved PQC algorithms to help you comply and stay secure.

What’s New in Cloud KMS

You get a choice of algorithms tailored to different security levels and performance needs. Here’s the lineup:

• SLH-DSA-SHA2-128s (Level 1): Stateless hash-based, great for defense-in-depth.
• ML-DSA-44 (Level 2): High performance, equivalent to SHA-256 collision search.
• ML-DSA-65 (Level 3): Balanced security and speed, like AES-192 key search.
• ML-DSA-87 (Level 5): Maximum security for long-term protection, akin to AES-256.

All ML-DSA variants support the external-µ mode, which lets you hash large payloads locally before sending a tiny digest to the signing service. This slashes bandwidth and latency—perfect for signing massive files without bogging down your HSM or key management service.

How External-µ Works

Instead of shoving entire multi-gigabyte files into the security boundary, your app computes a hash (say, SHA-256) and sends only that 32-byte digest to Cloud KMS. The external-µ variant binds the public key to the message representative, preventing attackers from swapping in their own key. It’s the best of both worlds: efficiency and pure ML-DSA compatibility.

Get Started Today

Integrate via the Cloud KMS API. Detailed docs and code samples are here. For more on post-quantum key encapsulation, check out the related article.

This is a big step in the collaborative journey to a quantum-safe world. We’ll keep updating as NIST standards evolve. Got feedback? Drop us a line.

Original announcement published on Google Cloud.