Google Cloud sets 2027 quantum-security milestone

Google Cloud has set a deadline for 2027 to protect customer workloads and sensitive data against potential attacks from future quantum computers. This milestone is part of the company's plan to make its cloud infrastructure resistant to quantum-based threats by 2029. The company is focusing on "store now, decrypt later" attacks, where adversaries collect encrypted data now and decrypt it later when quantum computers become powerful enough to break current cryptographic systems.

Google Cloud has broken down its post-quantum cryptography program into risk domains, with the first domain - confidentiality and the "store now, decrypt later" threat - to be completed by the end of 2027. This first domain covers customer workloads, administrative and developer connections, data pipelines, several Google Cloud services, and storage and analytics transfers.

Google Cloud's API endpoints supporting quantum-safe key exchange, Cloud KMS providing key establishment and digital signatures, and Application Load Balancers are already available and operational. The company plans to enable quantum-resistant protection by default from October 2026, with customers able to defer adoption until October 2027.

After that, the post-quantum exchange will remain enabled without the deferral option. Following the US National Institute of Standards and Technology's (NIST) standardization of core post-quantum cryptographic algorithms in 2024, Google Cloud aims to extend its quantum-resistant protection to software supply chains, certificate authorities, identity systems, and digital attestations by 2028. This includes quantum-safe certificates, Cloud IAM, and hardware advancements.