Future-proofing data integrity: Quantum-safe digital signatures in Cloud KMS

Google Cloud announced the general availability of quantum-safe digital signatures (ML-DSA, SLH-DSA) and post-quantum key encapsulation (ML-KEM) in Cloud Key Management Service (Cloud KMS), enabling organizations to protect long-term data integrity against future cryptographically relevant quantum computers. The new algorithms support NIST security categories 1 through 5 and include efficient external-µ variants to address bandwidth and processing challenges when signing large data payloads.

With cryptographically relevant quantum computers CRQC on the horizon, transitioning to quantum-safe digital signatures is critical to safeguarding long-term data integrity and authenticity. Organizations are steadily recognizing this urgency. For example, the U.S. government announced an update to the timelines https://www.whitehouse.gov/presidential-actions/2026/06/securing-the-nation-against-advanced-cryptographic-attacks/ by which departments and agencies must transition to quantum safe digital signatures. To help with the transition, we are announcing the general availability of our quantum-safe digital signatures https://docs.cloud.google.com/kms/docs/algorithms pqc signing algorithms ML-DSA, SLH-DSA and post-quantum key encapsulation https://docs.cloud.google.com/kms/docs/key-encapsulation-mechanisms ML-KEM in Google Cloud Key Management Service Cloud KMS https://cloud.google.com/security/products/security-key-management . The immediate challenge for your organization is functional: You need to sign massive data payloads without encountering the bandwidth and processing issues inherent with post-quantum cryptography PQC . To proactively address these emerging threats and help you support compliance with regulatory obligations, you can use the suite of PQC digital signature algorithms available in Cloud KMS, which includes ML-DSA FIPS 204 https://csrc.nist.gov/pubs/fips/204/final and SLH-DSA FIPS 205 https://csrc.nist.gov/pubs/fips/205/final , featuring dedicated support for the efficient external-µ variants. As standards and regulatory institutions are setting requirements and timelines for adopting quantum-safe algorithms, such as the National Security Agency’s CNSA 2.0 https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/3148990/nsa-releases-future-quantum-resistant-qr-algorithm-requirements-for-national-se/ , they’re underscoring the need for organizations to start their migration planning. To help you choose the specific security strength and signing method necessary for your applications, Cloud KMS gives you a broad selection of ML-DSA and SLH-DSA algorithms that are publicly available. Cloud KMS now supports the following PQC algorithms and variants: | Algorithm Name | NIST Security Category | Variant Type | Description | | | Level 1 | Pure, Pre-hash | Stateless Hash-Based Digital Signature for defense-in-depth | | | Level 2 | Pure, External-µ | High performance, Level 2 quantum security equivalent to a collision search on SHA-256 | | | Level 3 | Pure, External-µ | Balance of security and performance, Level 3 quantum security equivalent to an exhaustive key search on AES-192 | | | Level 5 | Pure, External-µ | Highest security for long-term data protection, Level 5 quantum security equivalent to an exhaustive key search on AES-256 | The cryptographic elements used for digital signatures have a fixed or predictable size in memory. In contrast, the message being signed can range from a few bytes to massive files. This size disparity creates a major challenge when you use a separate, secure device, such as an HSM or a dedicated key management service. These systems are often optimized for security and key operations, but they have limited bandwidth and processing power, making it impractical or impossible to securely transmit and process extremely large messages in the security boundary for signing https://keymaterial.net/2024/11/05/hashml-dsa-considered-harmful/ . Therefore, the application first processes the large message locally using a cryptographic hash function such as SHA2 or SHAKE to create a fixed-size, small digest that is around 32 bytes. The application then sends this small digest to the hardware security module HSM or key management service for the actual signing operation using the private key. NIST’s ML-DSA standard, FIPS 204 https://csrc.nist.gov/pubs/fips/204/final Algorithm 7 , uses an external-µ variant for its prehash functionality, which helps with this workflow. RFC 9881 Appendix D https://datatracker.ietf.org/doc/html/rfc9881 appendix-D describes the details of external-µ. This method allows the application to calculate the digest also called the message representative externally and feed it into the pure ML-DSA signing algorithm. This offers the best of both worlds: The bandwidth efficiency of a pre-hash workflow, and full compatibility with pure ML-DSA verifiers. These external-µ variants also bind the public key mathematically to the message representative to achieve non-resignability, an important security property that prevents an attacker from manipulating the message representative in a way that verifies under a different, possibly attacker-controlled key. You can learn more details here https://keymaterial.net/2024/11/05/hashml-dsa-considered-harmful/ , and explore the BoringSSL implementation https://boringssl.googlesource.com/boringssl/+/refs/heads/main/include/openssl/mldsa.h 128 for a practical example of handling external-µ. Google Cloud KMS https://docs.cloud.google.com/kms/docs now supports the pre-hash and external-µ variants. This enables high-performance, low-latency signing workflows that securely handles large payloads via external hashing, while integrating with pure verifiers. Your applications can integrate these algorithms through the Cloud KMS API https://docs.cloud.google.com/kms/docs/reference/rest . Developers can use existing Cloud KMS capabilities to create, manage, and use PQC keys for signing operations. Detailed instructions and code samples are available in our KMS documentation https://docs.cloud.google.com/kms/docs/digital-signatures to guide you through the process. The transition to a post-quantum cryptographic landscape is a collaborative journey. Adding PQC digital signatures in Google Cloud KMS is a significant milestone, helping you with your quantum-safe migration strategies. We will continue to update our services to incorporate future NIST standards and guidance, helping you maintain the security of your critical systems. We look forward to collaborating with you on your specific cryptographic needs, and we welcome your feedback mailto:cloudkms-feedback@google.com .