What happened
Google Cloud announced the preview of quantum-safe key import in Cloud KMS for software-based cryptographic keys, building on earlier support for quantum-safe digital signatures and key encapsulation mechanisms.
The new import method uses hybrid public key encryption to wrap sensitive key material in a quantum-resistant transit envelope, integrated into the existing Cloud KMS API workflow. It supports X-Wing, ML-KEM-768, or ML-KEM-1024 for the KEM layer, HKDF-SHA-256 for key derivation, and AES-256-GCM with 12-byte nonces for symmetric wrapping.
Cloud KMS PQC insights is now generally available, offering a visual categorization of asymmetric keys by the algorithms they use to help plan post-quantum modernization.
Why it matters
Traditional key import methods rely on classical asymmetric encryption for wrapping keys in transit, which could become insecure if a cryptographically-relevant quantum computer emerges and decrypts intercepted keys. Quantum-safe key import wraps keys in a quantum-resistant envelope from day one.
As multicloud adoption grows, BYOK is a core part of data sovereignty and workload protection, making secure key transfer a critical step in long-term post-quantum resilience.
Key facts
Quantum-safe key import in Cloud KMS is in preview for software-based cryptographic keys.
The mechanism uses hybrid public key encryption and supports X-Wing, ML-KEM-768, or ML-KEM-1024.
Cloud KMS PQC insights is now generally available.
What to watch next
How organizations begin creating quantum-safe key import jobs and integrate them into existing Cloud KMS API workflows.
Google Cloud has signaled this is the first step of the next phase of its post-quantum cryptography migration timeline, with further milestones likely to follow.