Google Cloud KMS is Google Cloud's encryption-at-rest backbone, the same role AWS KMS and Azure Key Vault play in their respective clouds. Google has a unique position in the post-quantum migration story: the company that maintains BoringSSL, the library powering Chrome's hybrid post-quantum TLS deployment, is also the company running Google Cloud. The same engineers and the same code paths can be brought to bear inside Google Cloud KMS.
This article walks through what Google Cloud KMS supports for post-quantum cryptography in 2026, how Google's BoringSSL work feeds into Cloud KMS, the role of Cloud HSM, and what customers should plan for. Information here is drawn from cloud.google.com PQC pages, Google Cloud release notes, the BoringSSL repository, and Google Online Security Blog posts.
How Google Cloud Cryptography Is Built
Google Cloud's cryptography stack rests on a few pieces:
- BoringSSL: Google's TLS library, used internally and via Cloud Load Balancing
- Tink: Google's high-level cryptography library, exposed at developers.google.com/tink
- Cloud KMS: managed key service with software-protected and HSM-backed keys
- Cloud HSM: dedicated FIPS 140-3 Level 3 HSM service
- Internal Google services: integrated with the same backend through Google's Confidential Computing tier
This structure mirrors AWS and Azure but with Google-specific components. Tink in particular is Google's cross-language cryptography library that abstracts over BoringSSL and other backends.
For background on the underlying BoringSSL work, see BoringSSL PQ status.
Where Google Cloud KMS Stands on Post-Quantum
The status as of mid-2026:
| Feature | Status in Google Cloud |
|---|---|
| Hybrid TLS to KMS endpoints | Available (X25519MLKEM768) |
| ML-KEM in BoringSSL | Available |
| Cloud KMS PQ-backed keys (HSM-backed) | Roadmap; preview features in some regions |
| Cloud KMS PQ-backed keys (software) | Roadmap |
| Cloud HSM PQ key support | Roadmap; depends on HSM firmware |
| Tink PQ algorithms | Engineering progress |
| FIPS-validated PQC | In progress through CMVP |
Google's pacing has been similar to AWS's: TLS-level PQ first, key-level PQ next.
How Google Got Hybrid TLS to Cloud KMS
The path went through Google's general TLS infrastructure rather than a Cloud-KMS-specific buildout. Google Cloud KMS is fronted by Google's load balancers, which use BoringSSL. As Chrome adopted hybrid post-quantum TLS, the same BoringSSL code was running on the load balancers, including those serving Google Cloud KMS endpoints.
This means hybrid TLS to Cloud KMS got switched on essentially when BoringSSL's hybrid TLS group became the default for the matching load-balancer fleet. The customer-visible change came through:
- SDK updates that enable client-side negotiation of hybrid groups
- Load balancer rollouts that advertise hybrid groups on the server side
- Documentation updates at cloud.google.com explaining the new capability
Once the negotiation works on both sides, every API call to KMS goes over a post-quantum-protected TLS pipe.
Cloud HSM and PQ Key Material
Cloud HSM is Google's dedicated HSM offering. It runs on FIPS 140-3 Level 3 hardware and gives customers single-tenant key storage. PQ-backed keys in Cloud HSM depend on:
- HSM firmware that implements ML-KEM and ML-DSA
- Cloud HSM service code that exposes new key types and operations
- Cloud KMS API extensions that surface the new types to customers
This pipeline mirrors AWS Managed HSM and Azure Managed HSM. The HSM firmware is the gating factor; once vendors ship firmware with PQ support and Google qualifies it, the service can expose PQ key types.
For the parallel AWS story, see AWS KMS PQC implementation.
Google's Internal Confidential Computing Tier
Google operates a confidential computing tier for its own internal services, and this tier has post-quantum protections that have been described in Google's security and engineering blog posts. The tier covers:
- Internal service-to-service traffic
- Storage of long-lived data with crypto wrapping
- Authentication tokens with quantum-aware schemes
The customer-facing Cloud KMS is one consumer of this internal infrastructure. As Google's internal PQC posture matures, customer-visible services inherit the protections.
Tink and Application-Level PQC
Tink is Google's high-level cryptography library, available at github.com/google/tink. Tink wraps lower-level libraries (BoringSSL, others) with safer high-level APIs. It supports Java, Python, Go, C++, and Objective-C.
Tink's PQC support has been progressing:
- ML-KEM is being added to Tink's primitives
- ML-DSA is on the roadmap
- KEM-based hybrid encryption schemes are being designed
Tink is the recommended path for Google Cloud customers building applications that need direct cryptographic operations, as opposed to KMS-managed operations.
For algorithm-level details, see ML-KEM explained.
How Cloud KMS Customer Migration Looks
For Google Cloud customers, the practical migration plan to use PQ-protected KMS connections:
- Update Cloud KMS client libraries to current versions in Java, Python, Go, JavaScript, C#, Ruby, PHP, and Node.js.
- Verify that hybrid TLS is being used for KMS API calls. Inspect handshake traces or use tooling that shows negotiated TLS groups.
- For high-value, long-retention data, prioritize PQC TLS protection now. Plan for PQ-backed Cloud KMS keys when Google releases them.
- For applications using Tink, monitor Tink releases for PQC primitives.
- For Cloud HSM workloads, plan to evaluate PQ-backed key types when the firmware updates roll out.
For broader migration context, see AWS KMS quantum migration.
Google's Public Communications on PQC
Google publishes post-quantum updates through:
- Google Online Security Blog at security.googleblog.com
- Google Cloud Blog at cloud.google.com/blog
- cloud.google.com documentation under Cloud KMS and Cloud HSM
- Tink release notes
- BoringSSL commit history (lower-level)
- Talks at industry conferences (Real World Crypto, Black Hat, Defcon)
The Cloud Blog often has bridge posts between research-style announcements (like a BoringSSL feature) and customer-facing implications (like a Cloud KMS endpoint update).
How Cloud KMS Compares to AWS and Azure
By 2026, all three major clouds have substantial PQC stories. The differences:
- AWS leans heavily on AWS-LC (BoringSSL fork) and ships hybrid TLS through SDKs
- Azure leans on SymCrypt for cross-platform consistency and exposes PQC via .NET, Java, and Python SDKs
- Google leans on BoringSSL and Tink, with deep integration in Chrome and Google's internal services
For users comparing the clouds, the practical answer is that all three deliver hybrid TLS protection for KMS API calls today and have HSM-backed PQ key roadmaps for the next 1-2 years.
For the parallel cloud stories, see AWS KMS PQC implementation and Azure Key Vault PQC implementation.
Cloud KMS Encryption Models
Cloud KMS exposes two main models:
- Customer-managed keys (CMEK): customer creates the key in Cloud KMS or imports it
- Customer-supplied keys (CSEK): customer holds the key entirely outside Google Cloud
For PQC, CMEK migration depends on Cloud KMS supporting PQ key types. CSEK migration depends on the customer's own key generation infrastructure (which can use software like QNSQY or BouncyCastle to produce PQ-backed keys today, and pass them as CSEK material to Google Cloud services that accept it).
For data already encrypted with classical KMS keys, re-encryption is generally not required for the symmetric layer (AES-256 is post-quantum acceptable). Migration to PQ wrapping is a customer-scheduled task once PQ keys are available.
What's Not Available Yet
To set realistic expectations:
- No general availability of PQ-backed Cloud KMS or Cloud HSM keys (preview features only as of writing)
- No automatic migration of existing keys to PQ wrappers
- No PQC support in legacy Cloud KMS API versions (recent SDK versions required)
- No hybrid certificate support in Cloud KMS contexts
- No FIPS 140-3 validation of complete PQC modules in Google Cloud (in progress)
Track cloud.google.com release notes for specific milestones.
Best Practices for Google Cloud Customers
For organizations using Google Cloud KMS and Cloud HSM:
- Update SDKs across applications. Newer Cloud KMS client libraries support hybrid TLS.
- For cryptographic operations done by the application (not delegated to KMS), use Tink as it adopts PQC primitives.
- For Cloud HSM workloads, monitor announcements about PQ key types and firmware support.
- For high-value data, document the PQC posture and migration plan. Compliance and audit requirements for PQ readiness are coming.
- For multi-cloud customers, plan PQC across providers. The technical patterns are similar; the timeline of GA features differs.
For complementary migration patterns, see Azure Key Vault post-quantum.
Tink's Specific Role
Tink is worth a separate note because it represents a different layer from Cloud KMS. Cloud KMS is a service for managing keys; Tink is a library for using keys safely in applications.
Tink helps prevent bad cryptographic practices: padding oracle bugs in custom AES-CBC code, IV reuse in AES-GCM, and similar foot-guns. Tink's PQC primitives extend this safety to the post-quantum era.
For Google Cloud applications that build cryptographic protocols themselves, Tink is the recommended path. Cloud KMS is the recommended path for delegated key management. The two work together: Cloud KMS holds the master keys; Tink uses derived keys safely.
How Google Search and Other Internal Services Inherit PQC
Google's internal services use BoringSSL (and Tink for higher-level operations) extensively. As BoringSSL's PQC support matures, Google's internal service-to-service communication picks up post-quantum protection. This is invisible to customers but matters for Google's ability to make broader claims about the PQC posture of services that depend on internal infrastructure.
Customer-facing services like Gmail, Google Photos, and Google Drive run on the same internal infrastructure. The TLS leg between users and Google's edge benefits from BoringSSL's PQC; the leg between edge and internal services also benefits. End-to-end PQC for Google's product surface is increasingly the norm.
Google Workspace and Customer Data
Google Workspace customers (Gmail, Drive, Docs) trust Google with their data. The cryptographic posture of Google Workspace involves TLS protection for data in transit and AES-based encryption for data at rest. The TLS leg has been hardened with PQC protection for some time. The at-rest encryption is AES, which is post-quantum acceptable for the symmetric layer.
Customer-managed key features (Cloud KMS as the root of trust for Workspace data) inherit Cloud KMS's PQC roadmap. Once PQ-backed Cloud KMS keys reach general availability, customers can plan to use them as Workspace root keys.
Google's Open Source Investments in PQC
Beyond BoringSSL and Tink, Google has invested in open-source PQC tooling:
- Test vectors and conformance tests contributed to NIST and IETF
- Reference implementations of certain PQC algorithms shared with the community
- Funding for academic research on PQC analysis
- Engineering on hybrid TLS schemes adopted by IETF
These investments shape the broader PQC ecosystem. Customers using non-Google services that adopt the same algorithms benefit indirectly from Google's open-source contributions.
For broader open-source context, see openssl PQC status 2026.
Frequently Asked Questions
Is my Cloud KMS data already quantum-safe?
The data encrypted with Cloud KMS keys is AES-GCM, which is post-quantum acceptable. The KMS API connections are protected by TLS; recent SDKs use hybrid TLS, which is post-quantum protected.
Can I use ML-KEM through Cloud KMS today?
Through hybrid TLS at the API layer, yes. As a key type in Cloud KMS that you can use directly, not yet at general availability. Preview features are appearing.
Is BoringSSL FIPS-validated for PQC?
BoringCrypto, the FIPS-validated subset of BoringSSL, is going through CMVP for updated PQC validation. Some Google Cloud regions use FIPS-validated builds; PQC support in those builds is progressing.
How does Tink relate to Cloud KMS?
Tink is a library for application-level cryptography. Cloud KMS is a managed service for key storage and operations. Tink can call Cloud KMS for key operations; they complement each other.
Where can I find Google's PQC roadmap?
Google Online Security Blog and Google Cloud Blog. For lower-level details, the BoringSSL repository at github.com/google/boringssl and the Tink repository at github.com/google/tink.
Sources
- BoringSSL repository, github.com/google/boringssl
- Google Online Security Blog, security.googleblog.com
- NIST FIPS 203 (Module-Lattice-Based Key-Encapsulation Mechanism), August 2024
- Google Cloud KMS documentation, cloud.google.com/kms
- Tink repository, github.com/google/tink
- IETF draft-kwiatkowski-tls-ecdhe-mlkem
Related Articles
- What is post-quantum cryptography
- BoringSSL PQ status
- Hybrid encryption
- AWS KMS quantum migration
- Azure Key Vault post-quantum
Protect Your Data Before Q-Day Arrives
QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.