Insider Brief
- Google has shortened its timeline for migrating to post-quantum cryptography, targeting 2029 to secure systems against future quantum threats.
- The company cited advances in quantum computing, error correction and factoring estimates, along with risks such as “store now, decrypt later” attacks, as drivers for accelerating the transition.
- Google is prioritizing authentication and digital signature systems, while deploying PQC across products like Android, Chrome and cloud services and urging broader industry adoption.
- Photo by Mitchell Luo on Unsplash
Google is accelerating its timeline to prepare for the risks posed by quantum computing, setting a target of 2029 for transitioning to post-quantum cryptography across its systems and urging the broader industry to move faster.
The new timeline, outlined in a recent company blog post, reflects what Google describes as growing urgency tied to advances in quantum hardware, improvements in quantum error correction, and updated estimates of how quickly a quantum machine could break today’s encryption standards. The company said it is shortening its expected window for migration to quantum-resistant systems, particularly for critical security functions such as authentication and digital signatures.
Prior to this announcement, Google did not officially pinpoint a date for PQC transition, the company indicated it was aligned with the NIST standards, generally assessed at 2030
Quantum computers, if sufficiently powerful, could undermine widely used encryption methods that protect financial transactions, communications and identity systems. While such machines do not yet exist at scale, the risk is not entirely theoretical. Google pointed to so-called “store now, decrypt later” attacks, in which encrypted data is collected today with the expectation that it can be decrypted in the future once quantum systems mature.
The company said it recognizes the threat model for digital security is changing. Encryption used to protect data in transit remains a concern, but Google now places greater emphasis on digital signatures — the cryptographic tools used to verify identity and ensure software integrity. Those systems must be updated before a cryptographically relevant quantum computer becomes available because compromised signatures could allow attackers to impersonate trusted entities or distribute malicious software, according to the post.
Google said it has adjusted its internal priorities accordingly, placing increased focus on migrating authentication systems to post-quantum standards. The company also recommended that other engineering teams and organizations adopt similar strategies, signaling a broader push to standardize timelines across the industry.
Accelerating the PQC Transition
The 2029 target marks one of the more specific timelines issued by a major technology company for full-scale migration to post-quantum cryptography, often referred to as PQC. These new cryptographic methods are designed to resist attacks from both classical and quantum computers.
For those wondering if this is a hint at quantum progress in general, Google did suggest that its role as both a quantum computing developer and a provider of widely used digital infrastructure places it in a position to set expectations. The company framed the timeline as an effort to provide clarity and urgency, rather than a guarantee tied to a specific technological milestone.
The timeline also reflects ongoing collaboration with standards bodies, including the National Institute of Standards and Technology, which has been developing and selecting PQC algorithms for widespread adoption.
Google outlined several steps already underway to integrate PQC into its products and services. The company said its upcoming Android 17 release will include post-quantum digital signature protection using ML-DSA, an algorithm aligned with emerging NIST standards.
The move builds on earlier deployments, including support for PQC in the Google Chrome browser and the company’s cloud offerings. Google said these efforts are intended to make quantum-resistant security available to users and enterprises ahead of broader industry mandates.
The company has also published guidance for organizations planning their own transitions, emphasizing that migration will require coordination across hardware, software and operational systems.
Industry Implications
Google’s updated timeline adds pressure on governments and enterprises to accelerate their own quantum-readiness plans. Migration to PQC is expected to be complex, involving updates to legacy systems, interoperability testing and long-term planning for cryptographic agility.
By setting a 2029 target, Google is effectively narrowing the window for action. The company said the goal is to ensure that critical systems are protected before quantum computers reach the point where they can break existing encryption, a threshold often referred to as a cryptographically relevant quantum computer.
The timeline does not assume that such a machine will arrive by 2029. Instead, it reflects what Google describes as a prudent approach to risk management in the face of uncertain but advancing capabilities.
The company said it will continue to provide updates as its transition progresses, signaling that timelines may evolve alongside developments in quantum computing and cryptographic research.
