Google Cloud has divided its post-quantum migration into interim deadlines, targeting its first major risk domain for completion by the end of 2027.
The roadmap, published on August 12, organized the work into three risk domains drawn from Google’s own quantum threat model.
Mitigating store-now-decrypt-later (SNDL) risk, where data harvested today could be decrypted by a future quantum computer, is targeted for the end of 2027.
Hardening digital signatures against forgery and rebuilding key management for cryptographic agility both run to the end of 2028, ahead of the 2029 date Google set alongside Cloudflare and Microsoft.
Read more: How Cybersecurity Vendors Are Preparing for the Post-Quantum Era
What Has Already Shipped
Google Cloud API endpoints, including google.com and *.googleapis.com, now offer quantum-safe key exchange using NIST-standardized ML-KEM in hybrid mode.
Application and proxy load balancers support hybrid key exchange for TLS 1.3, initially opt-in so customers can validate without disrupting existing applications.
Cloud KMS reached general availability for ML-KEM, ML-DSA and SLH-DSA, and quantum-confidential ALTS, Google’s internal traffic protocol, completed in 2025.
Still to come are Cloud VPN and Interconnect in 2026 and 2027, Private CA in 2027 and Cloud IAM and a quantum-safe Cloud HSM in 2028.
The Certificate Problem
Certificates involve a further constraint. Post-quantum signatures are large enough to affect certificate chain validation performance, which Google is addressing through Merkle Tree Certificates.
Jason Soroko, senior fellow at certificate lifecycle management provider Sectigo, said the approach replaces multiple large signatures with one compact inclusion proof, keeping overhead near current levels.
It also folds transparency logging into issuance rather than bolting it on, he said: “If a certificate is not in the tree, it simply does not exist.”
Read more on quantum threats: Preparing for the Quantum Future – Lessons from Singapore
Google was explicit that customers carry part of the load, needing to update client-side software to negotiate post-quantum handshakes and manage their own asymmetric key lifecycles.
On hardware, it said the timeline for some physical components may extend beyond 2029, since the transition depends partly on natural equipment replacement cycles.
The company warned in March that a cryptographically relevant quantum computer could arrive as early as 2029.
