Google Cloud has added new post-quantum encryption options to its Key Management Service (Cloud KMS). The update is currently in preview and introduces support for post-quantum Key Encapsulation Mechanisms (KEMs) – a form of encryption built to resist attacks from cryptographically relevant quantum computers.
Cloud KMS is a managed service that lets users create, use, rotate, and manage encryption keys for data and applications hosted on Google Cloud. It’s commonly used by organisations that rely on identity and access management (IAM) systems to protect sensitive data and meet compliance targets.
The new feature is designed to address a threat known as “Harvest Now, Decrypt Later”. The theory is that malicious actors collect encrypted data today with the goal of decrypting it in the future when quantum computers become more available.
Brent Muir, a principal consultant at Google Cloud, emphasised the urgency of early preparation. Writing on LinkedIn, he said: “It [is] crucial to protect sensitive data requiring long-term confidentiality, even if the quantum threat seems distant.”
Transitioning from classical encryption systems like RSA to post-quantum KEMs brings new technical challenges. Unlike traditional methods, where the sender chooses and encrypts a shared key, a KEM generates the secret key during the encapsulation process. That means developers can’t swap out an existing encryption function, but will likely need to rework parts of their architecture.
To ease the transition, Google recommends using Hybrid Public Key Encryption (HPKE), a standardised approach that supports both classical and post-quantum algorithms. HPKE is already available through Google’s open-source Tink library.
Another challenge is size. Post-quantum keys and ciphertexts are much larger than their classical counterparts. For example, the ML-KEM-768 key is roughly 18 times the size of a P-256 key. The difference has the potential to affect performance for systems with tight limits on bandwidth, memory, or storage.
Cloud KMS now supports several new options:
- ML-KEM-768 and ML-KEM-1024 – implementations of the US National Institute of Standards and Technology’s (NIST) standardised Module-Lattice-based KEM (FIPS 203).
- X-Wing (Hybrid KEM) – a dual-layer method that combines the classical X25519 algorithm with ML-KEM-768, designed for most general-purpose applications.
Google Cloud plans to integrate post-quantum algorithms into its own infrastructure by 2026. The company’s open-source cryptographic libraries – BoringCrypto and Tink – already include the new implementations, with expanded HPKE support coming to Java, C++, Go, and Python later this year.
Many organisations remain unprepared for quantum threats. In a blog post, Toyosi Kuteyi, a privacy and compliance specialist at Actalent, pointed out that awareness doesn’t necessarily mean readiness. “Only 9% of organisations have a post-quantum roadmap,” she wrote, citing data from Bain & Co. “Reports from PwC and Microsoft show most organisations are still ‘evaluating options.’ Many assume they’re not targets – creating a false sense of security.”
According to Google, integrating new quantum-safe KEMs into existing security workflows is straightforward via the Cloud KMS API.
(Photo by Manuel)
See also: Google expands in Belgium and faces US AI antitrust scrutiny
Want to learn more about Cloud Computing from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and co-located with other leading technology events. Click here for more information.
CloudTech News is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.