--- url: "https://xcademia.com/news/google-cloud-brings-quantum-safe-key-import-to-cloud-kms" title: "Google Cloud Brings Quantum-Safe Key Import to Cloud KMS" description: "Google Cloud previews quantum-safe key import in Cloud KMS, adding post-quantum protection for software-based cryptographic keys." publishedAt: "2026-08-22T11:34:03.74+00:00" updatedAt: "2026-08-23T06:23:37.599543+00:00" type: news category: "cloud-security" source_name: Google Cloud Blog source_url: "https://cloud.google.com/blog/products/identity-security/announcing-quantum-safe-key-import-in-cloud-kms" tags: - "#CloudSecurity" - "#PostQuantumCryptography" - "#PQC" - "#GoogleCloud" - "#CloudKMS" - "#Cryptography" - "#BYOK" - "#QuantumSecurity" --- # Google Cloud Brings Quantum-Safe Key Import to Cloud KMS > Google Cloud has introduced preview quantum-safe key import in Cloud KMS, giving organizations a post-quantum BYOK option designed to protect software-based cryptographic keys against future quantum threats. Source: **Google Cloud Blog** · 22 August 2026 ## Google Cloud Introduces Quantum-Safe Key Import for Cloud KMS ** ** Google Cloud has announced the preview of [**quantum-safe key import in Cloud Key Management Service**](https://docs.cloud.google.com/kms/docs/quantum-safe-key-import)** (Cloud KMS)** for software-based cryptographic keys. The capability extends Google Cloud's existing Bring Your Own Key (BYOK) approach with a post-quantum protection mechanism for keys while they are being imported into Cloud KMS. The announcement comes as enterprises increasingly operate across multicloud environments and continue to focus on data sovereignty and protection of sensitive workloads. At the same time, advances in quantum computing are prompting security teams to reconsider whether current cryptographic mechanisms will remain secure over the long term. Google Cloud positions quantum-safe key import as the next step in its broader **post-quantum cryptography (PQC) migration strategy**. The company has previously announced [quantum-safe digital signatures](https://cloud.google.com/blog/products/identity-security/announcing-quantum-safe-digital-signatures-in-cloud-kms) and [quantum-safe key encapsulation mechanisms](https://cloud.google.com/blog/products/identity-security/announcing-quantum-safe-key-encapsulation-mechanisms-in-cloud-kms) in Cloud KMS. The new capability focuses specifically on protecting software-based cryptographic keys during the import process. ## Why Quantum-Safe Key Import Matters ** ** Traditional key import mechanisms use classical asymmetric encryption to protect keys while they are transferred. These mechanisms are designed to protect against today's threats. However, sufficiently capable quantum computers could eventually undermine some of the underlying cryptographic algorithms. This creates a potential long-term risk known as [**Store Now, Decrypt Later**](https://www.ietf.org/archive/id/draft-reddy-uta-pqc-app-03.html#name-timeline-for-transition)** (SNDL)**. Under this scenario, an attacker could intercept encrypted information today and retain it until technology capable of breaking the underlying cryptography becomes available. For sensitive cryptographic keys, that creates an additional concern. Google Cloud's quantum-safe key import is designed to address this part of the migration challenge by using a quantum-resistant envelope when keys are transferred into Cloud KMS. ### The basic idea **Today** Encrypted key material is protected using existing cryptographic mechanisms. **Potential future threat** An attacker could retain intercepted material and attempt to decrypt it after cryptographically relevant quantum computing becomes available. **Quantum-safe approach** The key is wrapped inside a quantum-resistant transit envelope before being sent to Cloud KMS. This is intended to reduce exposure to SNDL attacks during key import. ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1787396657957-info-1--96-.webp) ## Building a Quantum-Resistant Envelope for Keys Google Cloud's new import mechanism uses [**Hybrid Public Key Encryption**](https://datatracker.ietf.org/doc/rfc9180/)** (HPKE)** as part of its post-quantum transit mechanism. The approach is integrated into the existing Cloud KMS API workflow. According to Google Cloud, the process works through several stages. **1. Create an import job** The client creates a new Cloud KMS import job and requests the post-quantum HPKE import method. **2. Cloud KMS generates a KEM key** The Cloud KMS server generates a post-quantum Key Encapsulation Mechanism (KEM) private key. The corresponding public key is exposed to the client. **3. The client wraps the key material** Using a supported cryptographic library, such as Tink or OpenSSL, the client performs an HPKE `Seal()` operation. The process uses the public key to establish a shared secret and derives an ephemeral AES key using HKDF-SHA256. The target key material is then encrypted. **4. The encrypted material is submitted** The client sends the encapsulated ciphertext together with the encrypted key material to the Cloud KMS endpoint. Google Cloud says the Cloud KMS endpoint already provides quantum-safe data-in-transit protection. **5. Cloud KMS unwraps the material** The Cloud KMS server uses its private portion of the wrapping key to execute an HPKE `Open()` operation. The key material is then decrypted within the Cloud KMS boundary. ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1787396681087-info-2--76-.webp) ## Supported Post-Quantum Algorithms The quantum-safe import mechanism provides multiple choices for the KEM layer. Organizations can choose: - [**X-Wing**](https://datatracker.ietf.org/doc/draft-connolly-cfrg-xwing-kem/) - [**ML-KEM-768**](https://csrc.nist.gov/pubs/fips/203/final) - [**ML-KEM-1024**](https://csrc.nist.gov/pubs/fips/203/final) The key derivation layer uses **HKDF-SHA-256**. The final symmetric encryption layer uses **AES-256-GCM** with standard 12-byte nonces. These components form the cryptographic layers used to construct the quantum-resistant transit envelope. Layer Technology KEM X-Wing, ML-KEM-768 or ML-KEM-1024 Key derivation HKDF-SHA-256 Symmetric encryption AES-256-GCM Encryption interface HPKE Cloud service Cloud KMS The announcement does not provide comparative performance figures for the available KEM options. **Additional details were not disclosed in the announcement.** ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1787396758058-info-3--70-.webp) ## Quantum-Safe BYOK and the Post-Quantum Migration The new capability is particularly relevant to organizations that use **Bring Your Own Key (BYOK)** as part of their cloud security and data sovereignty strategy. BYOK allows organizations to maintain control over cryptographic key material while using cloud services. However, protecting the key itself during transfer is an important part of that model. Google Cloud's announcement positions quantum-safe key import as an additional step toward addressing that concern. The company describes the capability as the first step of the next phase of its PQC migration timeline. **This follows previous Cloud KMS announcements covering:** - Quantum-safe digital signatures - Quantum-safe key encapsulation mechanisms - Quantum-safe key import Together, these capabilities represent different components of Google's broader effort to prepare cloud cryptographic services for the post-quantum era. # ## Cloud KMS PQC Insights Are Now Generally Available Alongside the quantum-safe key import preview, Google Cloud says [**Cloud KMS PQC insights**](https://docs.cloud.google.com/kms/docs/view-pqc-insights) are now generally available. The capability provides a high-level view of asymmetric keys based on the cryptographic algorithms they use. This can help organizations understand their current post-quantum cryptographic posture and plan future modernization. The distinction is important. Quantum-safe key import focuses on protecting keys during the import process, while PQC insights provide visibility into the algorithms associated with asymmetric keys. For organizations preparing a broader PQC migration, these address different parts of the planning and protection process. ## What the New Capability Means for Cloud Security Teams The announcement highlights a broader industry shift toward preparing cryptographic infrastructure before quantum computing creates a cryptographically relevant threat. For enterprises, this could mean that post-quantum planning needs to extend beyond replacing individual algorithms. Key movement, key management, application dependencies and existing cryptographic inventories can all become relevant to a longer-term migration strategy. Google Cloud's approach combines the new import mechanism with existing Cloud KMS capabilities and visibility through PQC insights. The company describes the overall migration as a process that will happen through multiple milestones rather than a single transition. Organizations using BYOK can therefore consider quantum-safe key import as one component of a broader cryptographic modernization program. # ## How the Key Import Process Fits Into Cloud KMS At a high level, the workflow can be viewed as: **Software Key** ↓ **Client-Side Quantum-Safe Wrapping** ↓ **Quantum-Resistant Transit Envelope** ↓ **Cloud KMS** ↓ **Protected Key Material** The important change is the protection applied before the key material reaches the Cloud KMS service. Rather than relying solely on traditional asymmetric encryption for the import operation, the new mechanism uses HPKE and post-quantum KEM options to establish the protection envelope. This allows organizations to begin incorporating post-quantum protections into their key import workflows without creating an entirely separate Cloud KMS process. ## What Organizations Should Consider The announcement does not provide a complete enterprise migration framework, but several practical considerations follow directly from the capabilities described by Google Cloud. **Review existing cryptographic inventories** Organizations preparing for PQC migration need visibility into the algorithms currently used by their asymmetric keys. Cloud KMS PQC insights can provide this visibility for relevant Cloud KMS environments. **Evaluate BYOK workflows** Organizations that import software-based cryptographic keys into Cloud KMS can assess whether the quantum-safe import capability fits their key-management requirements. **Consider long-lived sensitive data** The SNDL threat is particularly relevant to information that needs to remain confidential for extended periods. Organizations can evaluate which data and cryptographic assets have the longest protection requirements. **Plan migration incrementally** Google Cloud describes PQC migration as a process involving multiple milestones. This supports a staged approach rather than treating post-quantum migration as a single event. The announcement does not provide specific timelines for individual customer migration scenarios. ## A Milestone in Google's PQC Strategy Quantum-safe key import represents another step in Google Cloud's broader post-quantum cryptography strategy. The focus of this release is specific: **protecting software-based cryptographic keys during import into Cloud KMS using a post-quantum mechanism**. It does not mean that every cryptographic system has automatically become post-quantum secure. Instead, it provides an additional capability for organizations that need to protect key material during the import process. For security teams, the development reflects growing demand for cryptographic agility and preparation for a future in which today's public-key algorithms may no longer provide sufficient protection against quantum-enabled attacks. The preview gives organizations a way to begin incorporating quantum-safe protection into existing Cloud KMS key import workflows. ## Availability and Documentation Google Cloud has announced the feature in **preview** for software-based cryptographic keys. Organizations interested in implementation can consult the official documentation for: - Setting up [quantum-safe import jobs](https://docs.cloud.google.com/kms/docs/quantum-safe-key-import) - Preparing local key material - Using external cryptographic libraries - Managing quantum-safe key import solutions The source does not provide additional details about pricing, regional availability or performance benchmarks. **The company did not provide specific information about this area.** ## Original Analysis The announcement highlights a broader industry shift toward treating post-quantum cryptography as a migration program rather than a future-only research topic. The key point is not simply the availability of new algorithms. It is the integration of quantum-safe protection into an existing operational workflow for importing cryptographic keys. For enterprises, this could mean that PQC planning can increasingly be incorporated into existing key-management processes rather than handled as an isolated security project. The introduction of PQC insights alongside quantum-safe key import also points to two complementary requirements: organizations need to understand where classical cryptography is being used and determine where quantum-safe mechanisms should be introduced. Google Cloud's latest capability therefore represents a specific milestone in a much larger post-quantum migration effort. ## Original source https://cloud.google.com/blog/products/identity-security/announcing-quantum-safe-key-import-in-cloud-kms ## Tags `#CloudSecurity` · `#PostQuantumCryptography` · `#PQC` · `#GoogleCloud` · `#CloudKMS` · `#Cryptography` · `#BYOK` · `#QuantumSecurity` --- ## About this content This Markdown news article is the citation-grade twin of [Google Cloud Brings Quantum-Safe Key Import to Cloud KMS](https://xcademia.com/news/google-cloud-brings-quantum-safe-key-import-to-cloud-kms). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://xcademia.com/news/google-cloud-brings-quantum-safe-key-import-to-cloud-kms - Publisher: Xcademia — https://xcademia.com - Catalogue index: https://xcademia.com/llms-full.txt