Next-Generation Technologies & Secure Development
Google’s Accelerated PQC Timeline Demands Enterprise Action Now
Google set a public deadline for migrating to post-quantum cryptography, setting a strong signal for IT and security leaders that they too should transition their encryption into more robust algorithms.
See Also: How Threat-Led Defense Refines Cyber Strategy
In a blog post published this week, Google executives said the company has moved its deadline to complete its post-quantum cryptography transition to 2029, well-in advance of the 2035 target established by the U.S. National Institute for Standards and Technology. It’s also in advance of the NSA’s 2031 deadline to transition national security systems.
For enterprise security and technology leaders still treating quantum readiness as something on their future to-do list, Google’s move should be a wake-up call.
“It’s our responsibility to lead by example and share an ambitious timeline. By doing this, we hope to provide the clarity and urgency needed to accelerate digital transitions not only for Google, but also across the industry,” wrote Google’s Heather Adkins, vice president of security engineering, and Sophie Schmieg, senior cryptography engineer.
Google did not give any specific intelligence why it has shifted internal deadlines. The authors cited the threats posed by the “harvest now, decrypt later” problem and digital signatures. The “harvest now, decrypt later” threat anticipates that any data stolen today that has long-term value, such as health or financial records, intellectual property or legal documents, could be stored and decrypted later when a quantum computer has broken today’s encryption standards. Meanwhile, digital signatures are the foundation of cryptographic authentication across the internet and need to be replaced before a cryptographically relevant quantum computer is developed.
“That’s why we’ve adjusted our threat model to prioritize PQC migration for authentication services – an important component of online security and digital signature migrations. We recommend that other engineering teams follow suit,” they wrote.
Forrester analyst Sandy Carielli said the announcement sends an unambiguous signal to the technology world, even with the precise internal reasoning behind its timing remaining a mystery.
“I can’t speculate on exactly why Google made this announcement now, but given their role in the industry, I see it as a signal that quantum security migration is something to be taken seriously,” she said.
“Given that Google is a dependent part of many companies’ technology stacks, they were always going to have to be ahead of other deadlines. Companies that depend on Google will need time to upgrade, integrate and test Google’s quantum-ready products with the rest of their tech stack. If companies are dependent on Google to meet their own deadlines, then Google must be ready well before those deadlines,” she said.
The Other 2029 Deadline
Google’s PCQ migration deadline coincides with another important cybersecurity timeline. In 2029, the Certification Authority Browser Forum will also reduce the maximum validity of public TLS certificates from 398 days to 47 days.
“These parallel 2029 deadlines are not coincidental. They represent two sides of the same challenge: preparing for a world where cryptography must be updated far more frequently and with far greater agility,” said Jason Soroko, senior fellow at Sectigo.
“As Google advances the PQC timeline, and as certificate validity shrinks to 47 days, the ecosystem must move together. Continued collaboration through the IETF and the CA/Browser Forum will be essential to ensuring that organizations can rotate keys, algorithms, and certificates quickly and safely, building the agility needed to secure the quantum era,” he said.
What This Means for Enterprise Leaders
Preparing for the post-quantum world needs to be a priority, and there is a roadmap.
“There’s a process here that’s going to need to be addressed in order to get to where the organization needs to be,” Carielli said. “Discover, prioritize, remediate and add cryptographic agility.”
IT shops should start with taking inventory of their cryptography, mapping where RSA and elliptic curve cryptography functions. Figure out which data is most at risk and which has the most long-term value that would make it vulnerable to “harvest now, decrypt later.” Take stock of vendors and know their PQC roadmaps, and prepare for cryptographic agility, the ability to automate the rotate algorithms, keys and certificates quickly.
“You need to start now, and probably you need to have started a few years ago, because it is such a long journey,” Carielli said.