Google recently announced that it will complete the comprehensive migration of its infrastructure to "quantum secure encryption" (post-quantum cryptographic algorithms) by 2029, several years ahead of the quantum security schedule originally set by most governments and industries. The decision is seen as the company's clearest signal yet that so-called "Q Day" - the day when quantum computers are powerful enough to break existing mainstream encryption systems - may arrive sooner than previously expected.
According to a blog post published by Google this week, the company announced a system-wide post-quantum cryptographic migration roadmap, and plans to replace current encryption schemes globally with a new generation of algorithms that can withstand quantum computing attacks. Heather Adkins, vice president of security engineering at Google, and Sophie Schmieg, senior cryptographic engineer, stated in the article that as a company at the forefront of quantum computing and post-quantum cryptography, Google “has the responsibility to lead by example and give an ambitious timetable” to create sufficient clarity and urgency within the company and throughout the industry.
Prior to this, most organizations referred to the time nodes of the U.S. government and defense departments, usually setting the goal of comprehensive quantum security transformation between 2030 and 2033. Brian LaMacchia, a cryptography engineer who was responsible for Microsoft's post-quantum transition from 2015 to 2022 and now works at Farcaster Consulting Group, commented that compared with various roadmaps disclosed so far, Google's timetable is significantly "tightened and accelerated" and even more radical than the requirements of the U.S. government, which has also triggered speculation about the motivations behind it.
Google did not explain in detail why it would advance the internal quantum security "dead line" to 2029, but its research work has repeatedly promoted the industry's re-evaluation of the quantum threat time window. Last year, a team led by Google scientist Craig Gidney published research pointing out that on a quantum computer with one million "noisy qubits", the time to crack a 2048-bit RSA key could be reduced to less than a week. This estimate is significantly lower than the mainstream judgment around 2019 that generally believed that about 20 million qubits were needed.
In addition to the overall infrastructure roadmap, Google also systematically disclosed for the first time its plan to make the Android platform quantum resistant. According to another security blog for developers, Google will join the digital signature algorithm ML-DSA standardized by the National Institute of Standards and Technology (NIST) starting from the Android 17 beta version and integrate it into Android’s hardware root of trust for post-quantum key support in the application signing and verification process.
Google said that ML-DSA has been added to the Android Verified Boot library to ensure that the system startup chain is not tampered with. The relevant engineering team is also migrating the Android remote authentication mechanism (used to prove device integrity to enterprises or cloud servers) to a post-quantum cryptography scheme. In future updates, ML-DSA support will also be extended to the Android Keystore for device-local security key generation, and then to the Play Store and its app signing process.
This migration will bring considerable challenges to the developer ecosystem: key workflows such as application signature, verification, and certification will need to be adjusted accordingly to adapt to the new algorithm and new key system. Google views this series of actions as part of its overall strategy, with the goal of prioritizing post-quantum migration in key security links such as authentication services, thereby laying the foundation for a larger range of digital signature and encryption transformations in the future.
For the cryptography community, estimates of Q-Day have been revised repeatedly for decades. Since mathematician Peter Shor proposed an algorithm in the 1990s that could exponentially speed up factoring of large integers on a sufficiently powerful quantum computer, the quantum resources required to break RSA encryption have continued to be revised downwards, and industry views on timelines have continued to change. Despite the uncertainty, cybersecurity planners have long regarded quantum threats as an urgent issue. The National Security Agency's current plan is to complete the migration of national security systems to post-quantum algorithms by 2033, and has set earlier deadlines of 2030 and 2031 for some specific applications.
In the commercial sector, some leading software and Internet service providers have begun to introduce limited introduction of NIST-approved post-quantum algorithms into their products, such as CRYSTALS-Kyber and ML-KEM-768. These include messaging service Signal, network infrastructure company Cloudflare and Apple, among others, although in many scenarios these algorithms are still deployed in "hybrid mode" or for limited use.
Google positions its internal 2029 timetable as both a project execution directive and an external warning signal. It remains to be seen whether the industry as a whole will accept Google's judgment on the time window for quantum risks. But what is certain is that with Google publicly setting a clear and aggressive deadline, the “race against time” surrounding Q-Day has accelerated from theoretical discussion to the stage of substantial implementation.