Google Cloud previews quantum-safe key import in KMS

Google Cloud has introduced a preview of quantum-safe key import in Cloud Key Management Service.

The feature applies to software-based cryptographic keys in bring your own key deployments.

It extends Google Cloud's post-quantum cryptography work in Cloud KMS, following earlier additions for quantum-safe digital signatures and key encapsulation mechanisms. It is aimed at organisations that move encryption keys across networks and want to reduce the risk that intercepted key material could later be exposed by more advanced quantum systems.

Bring your own key arrangements are widely used in multicloud environments because they let customers generate and control key material outside a cloud provider before importing it for use in hosted services. That model has become increasingly important for companies with data sovereignty requirements and stricter internal security controls.

Transit risk

The main concern is the prospect of so-called store now, decrypt later attacks. In that scenario, an attacker captures encrypted data or wrapped keys today and holds them in the hope that future quantum computers will be able to break the classical cryptography protecting them.

Traditional key import methods rely on established asymmetric encryption standards to wrap keys in transit. Those methods remain suitable against current threats, but security teams are concerned that sufficiently advanced quantum computers could make some of those standards obsolete.

The new import method in Cloud KMS uses hybrid public key encryption to create what Google Cloud describes as a quantum-resistant envelope for key transfers. The workflow begins when a client creates an import job through the Cloud KMS API and requests a post-quantum import method.

Cloud KMS then generates a post-quantum key encapsulation mechanism private key and makes the corresponding public key available to the client. The client uses a supported cryptographic library, including Tink or OpenSSL, to perform an HPKE Seal operation, derive a temporary AES key with HKDF-SHA256, and encrypt the target key material before sending it to Cloud KMS.

On receipt, the service performs an HPKE Open operation with its private wrapping key to decrypt the imported material within the Cloud KMS boundary. The approach is designed to fit into the existing API workflow, so customers do not need to rebuild their import process from scratch.

Algorithm options

Customers can choose X-Wing, ML-KEM-768, or ML-KEM-1024 for the key encapsulation mechanism layer. The key derivation stage uses HKDF-SHA-256, while the symmetric wrapper uses AES-256-GCM with 12-byte nonces.

Cloud KMS already includes quantum-safe protection for data in transit to the service endpoint. The new key import option focuses specifically on protecting imported software key material as it is wrapped and transferred into the managed environment.

Alongside the preview, Google Cloud said Cloud KMS post-quantum cryptography insights are now generally available. The visual reporting tool categorises asymmetric keys by the algorithms they use, giving security teams a way to assess their current cryptographic estate and identify where modernisation may be needed.

Wider shift

The announcement reflects a broader shift across the technology industry as cloud providers, hardware companies, and standards bodies prepare for the long transition to post-quantum cryptography. Security teams have been under pressure to identify systems that depend on algorithms vulnerable to quantum attacks, even though practical cryptographically relevant quantum computers have not yet emerged.

For cloud customers, key management has become one of the more immediate areas for action because imported keys often sit at the centre of encryption strategies for databases, applications, and regulated workloads. Any weakness in how those keys are transferred could create long-term exposure if adversaries are collecting encrypted material now for later analysis.

Google Cloud described the new import process as the next phase of its post-quantum cryptography migration work in Cloud KMS. Customers can now create a quantum-safe key import job and begin adapting applications and key workflows to post-quantum protections.

The service is available in preview for software-based cryptographic keys in Cloud KMS.