Google Publishes Post-Quantum Cryptography Roadmap

Earlier this month, Google Cloud published a roadmap for post-quantum cryptography (PQC). This roadmap aims for migration to PQC by 2029.

The migration strategy is centered on three domains: 

1. Defending today’s encrypted data against adversaries operating with a “harvest now, decrypt later” mindset 
2. Secure digital signatures to protect against falsified data and identities 
3. Construct systems capable of adapting to new cryptographic standards with minimal effort. 

Google is pursuing Merkle Tree Certificates with Cloudflare rather than inputting post-quantum signatures into X.509 certificates.

Jason Soroko, Senior Fellow at Sectigo, shares his insights on this roadmap below. 

Jason Soroko, Senior Fellow at Sectigo: 

Cryptographers, including teams at Google and Cloudflare, with contributions from Sectigo, have been developing a new approach. Merkle Tree Certificates (MTCs) do not force large post-quantum signatures into an infrastructure that wasn't designed for them. Instead, they rethink how certificates are built and delivered for the post-quantum era. 

Public key infrastructure (PKI) is ubiquitous in all our technology stacks. Cloud applications, AI-driven workloads, and billions of connected devices all rely on fast, constant TLS handshakes. If post-quantum authentication slows those handshakes down, everyone feels it.