Google brings quantum-safe signatures to Cloud KMS

Google has made quantum-safe digital signatures and post-quantum key encapsulation generally available in its Cloud Key Management Service, adding ML-DSA, SLH-DSA and ML-KEM to the managed cryptography service.

The move extends Google's push into post-quantum cryptography as governments and standards bodies set migration deadlines for digital signature systems designed to withstand future quantum attacks.

Organisations use Cloud KMS to create, store and use cryptographic keys for workloads running in Google Cloud and elsewhere. With the release, users can deploy post-quantum signing algorithms including ML-DSA and SLH-DSA, alongside ML-KEM for key encapsulation.

The digital signature options now available in Cloud KMS include SLH-DSA-SHA2-128s, ML-DSA-44, ML-DSA-65 and ML-DSA-87. Together, they span NIST security categories from Level 1 to Level 5.

The announcement reflects a wider market shift as companies prepare for cryptographically relevant quantum computers, which are expected to threaten some of today's widely used public-key systems. For digital signatures, the concern is not only confidentiality but also the long-term integrity and authenticity of records, software and transactions signed with current algorithms.

For cloud security teams, one practical challenge is signing very large data payloads without pushing them through a tightly controlled security boundary such as a hardware security module or remote key management service. Post-quantum cryptography can introduce larger keys and signatures, increasing the strain on bandwidth and processing.

Google's implementation includes support for pre-hash and external-μ variants designed to address that problem. In this model, an application hashes a large message locally into a small digest and sends that digest to the signing service, rather than transmitting the full payload for processing inside the secure environment.

That approach is intended to make post-quantum signatures more practical for systems handling large files and high transaction volumes. It also allows organisations to use pure ML-DSA verifiers while keeping the signing workflow focused on a much smaller message representative.

According to Google, the external-μ method follows the pre-hash functionality defined for ML-DSA in FIPS 204. It also highlighted support for pre-hash workflows in SLH-DSA, specified in FIPS 205.

Google said external-μ adds a security property by binding the public key to the message representative in a way that reduces the risk of a digest being manipulated to verify under a different key. The issue, known as non-resignability, has drawn attention in technical discussions around practical ML-DSA deployment.

Migration pressure

The release comes as regulatory pressure around quantum-safe migration continues to build. Google pointed to updated US government timelines for departments and agencies moving to quantum-safe digital signatures, and to the National Security Agency's CNSA 2.0 requirements, as signs that planning is moving from theory to implementation.

That matters for sectors with long data-retention cycles, including government, finance, healthcare and critical infrastructure. Records signed today may need to remain verifiable for many years, making the timing of algorithm transitions a strategic issue rather than a purely technical refresh.

Cloud providers have increasingly framed post-quantum tooling as a way for customers to begin migration in stages. Rather than replacing all cryptographic systems at once, many organisations are expected to test specific signing and key-exchange functions first, then widen deployment as standards, software libraries and compliance regimes mature.

Google had already introduced post-quantum key encapsulation mechanisms in Cloud KMS in preview, and this latest step moves both signatures and key establishment further into mainstream managed cloud services. By making the features generally available, it is signalling that customers can start using them in production environments where support and service commitments are expected.

Technical choices

The algorithms now listed in Cloud KMS cover both lattice-based and hash-based approaches. ML-DSA is aimed at users seeking different trade-offs between security level and operational efficiency, while SLH-DSA offers a stateless hash-based signature option for organisations that want an additional line of defence through algorithm diversity.

Applications can access the new functions through the Cloud KMS API, using existing methods to create, manage and use keys for signing operations. That means developers do not need a separate product to begin testing or deploying post-quantum signatures within systems already tied to Google's managed key infrastructure.

The broader challenge for the industry remains interoperability, operational cost and the pace of standards adoption across software stacks, hardware security modules and compliance frameworks. Still, the arrival of post-quantum signatures in a major cloud key management platform marks a concrete shift from research and previews to day-to-day deployment in production security workflows.

Google said Cloud KMS now supports "the pre-hash and external-μ variants" and that this "enables high-performance, low-latency signing workflows that securely handles large payloads via external hashing, while integrating with pure verifiers."