Announcing quantum-safe key import in Cloud KMS

Google Cloud has announced a preview of quantum-safe key import in Cloud Key Management Service (KMS) for software-based cryptographic keys, marking the first step in its next phase of post-quantum cryptography (PQC) migration. This capability addresses the growing need for secure key transfer across networks amid advancing quantum computing, which could render traditional encryption methods obsolete. Enterprises can now protect sensitive keys before a cryptographically-relevant quantum computer emerges, aligning with their data sovereignty and security requirements.

The new quantum-safe key import method uses hybrid public key encryption (HPKE) to wrap keys during transit, mitigating risks from store now, decrypt later (SNDL) attacks. Traditional key import methods rely on classical asymmetric encryption, which will become insecure against quantum computers. The updated process integrates with existing Cloud KMS API workflows, minimizing disruption while enhancing security for multicloud environments.

To implement quantum-safe key import, clients initiate an import job via the Cloud KMS API, request a post-quantum HPKE method, and generate a post-quantum key encapsulation mechanism (KEM) private key. Supported cryptographic libraries like Tink or OpenSSL execute an HPKE Seal() operation to encrypt the target key material, which is then transmitted to Cloud KMS for secure unwrapping using the HPKE Open() operation within its protected boundary.

The KEM layer supports X-Wing, ML-KEM-768, or ML-KEM-1024, while key derivation uses HKDF-SHA-256 and symmetric encryption employs AES-256-GCM. Cloud KMS PQC insights, now generally available, provide visual monitoring of asymmetric keys to assess post-quantum readiness. Organizations can begin creating quantum-safe key import jobs to modernize their cryptographic strategies incrementally.