Google Cloud’s Three-Stage Quantum Migration Plan
Google Cloud has broken its post-quantum security roadmap into three distinct risk domains, each with its own deadline. The first major milestone—mitigating store-now-decrypt-later (SNDL) risk—is set for the end of 2027.
The roadmap, published on August 12, draws directly from Google’s internal quantum threat model. It’s a pragmatic approach that acknowledges the uneven pace of quantum readiness across different parts of the cloud stack.
What’s Already Shipped
Some pieces are already live. Google Cloud API endpoints, including google.com and *.googleapis.com, now support quantum-safe key exchange using the NIST-standardized ML-KEM in hybrid mode.
Application and proxy load balancers offer hybrid key exchange for TLS 1.3, initially opt-in so customers can validate the change without breaking existing applications. Cloud KMS has reached general availability for ML-KEM, ML-DSA, and SLH-DSA, and quantum-confidential ALTS—Google’s internal traffic protocol—completed in 2025.
Still on the horizon: Cloud VPN and Interconnect in 2026 and 2027, Private CA in 2027, and quantum-safe Cloud IAM and Cloud HSM in 2028.
The Certificate Problem
Certificates present a unique constraint. Post-quantum signatures are large enough to slow down certificate chain validation. Google’s answer is Merkle Tree Certificates.
Jason Soroko, senior fellow at certificate lifecycle management provider Sectigo, explains the approach replaces multiple large signatures with one compact inclusion proof, keeping overhead near current levels.
It also folds transparency logging into issuance itself. As Soroko puts it: “If a certificate is not in the tree, it simply does not exist.”
Customers Carry Part of the Load
Google is explicit that this isn’t a purely server-side fix. Customers must update client-side software to negotiate post-quantum handshakes and manage their own asymmetric key lifecycles.
Hardware is another variable. The company says some physical components may not be fully transitioned until after 2029, since the shift depends partly on natural equipment replacement cycles.
That timeline matters. In March, Google warned that a cryptographically relevant quantum computer could arrive as early as 2029.
What This Means for Your Organization
If you’re running workloads on Google Cloud, the practical takeaway is to start inventorying your cryptographic assets now. The SNDL risk is the most urgent—data encrypted today could be decrypted by a future quantum machine.
For a deeper look at how the broader industry is preparing, check out our analysis of how cybersecurity vendors are preparing for the post-quantum era. You might also want to review lessons from Singapore’s quantum future planning for a government perspective.
The key question isn’t whether quantum computers will arrive. It’s whether your data will still be safe when they do. Google’s roadmap gives you a clear window to act—2027 for SNDL, 2028 for signatures and key management.
Use that time wisely. The clock is already ticking.
