Google Integrates Post-Quantum Cryptography: Q&A

The U.S. National Institute of Standards and Technology (NIST) recently published three new standards that replace current encryption methods with post-quantum cryptography (PQC). 

To mark the occasion, Google published a blog post explaining how organizations can adopt these new standards, why they are important and how Google uses PQC across its products, including Android, Chrome and Cloud.

Google has been at the forefront of PQC development since 2016 and has tested PQC in Chrome and used it to protect internal communications since 2022. 

In this Q&A, Nelly Porter, director of product management at Google Cloud, discusses Google's involvement in post-quantum cryptography (PQC) and the recent release of NIST standards.

She highlights Google's efforts since 2016, including integrating PQC into Chrome and Cloud services and emphasizes the importance of preparing for PQC migration due to its significant performance implications.

Enter Quantum: Why was it important that Google started adopting PQC so early?

Nelly Porter: Google had been working on enabling Chrome with previous versions of PQC many years before that. We had an opportunity to offer this capability sooner than others because we had done a huge number of experiments in this particular prospect. We also know that for our Google Cloud Platform (GCP) and home users, protecting their devices and personal data is super critical.

Related:NIST Releases Post-Quantum Cryptography Algorithms – Industry Reacts

But Chrome enablement is giving us opportunities to validate all of the different back ends. Google is making changes, and this will take us time to roll out for all Google infrastructure. Customers from home can go and connect to Google, starting with Chrome, which allows us and everybody in the world to start testing their own implementation.

It’s critical because PQC is a long journey. It’s strategically important to enable customers to validate that we – as an industry not just Google, per se – are ready. They feel more comfortable continuing business and not having to worry too much about when this scary moment is coming.

PQC is keeping our customers very co-opted. They begin reaching out, trying to figure out what they need to do and we’re trying to help them understand what they need to do and how they need to improve and deal with their cryptographic allocations.

Nelly Porter, director of product management at Google Cloud. Credit: Google

Google has been using PQC to protect its own internal development since 2022. Are you practicing what you preach or trying it before you put it out into the world?

It gave us perspective and the understanding that proper implementation is only a first step. The biggest problem is not about enabling PQC for 90% of use cases, it's understanding how we use cryptography. It's forced us internally to do an inventory of the cryptographic algorithms and data we use and gave us internally a lot of know-how to move into this brave new PQC world.

Related:Google DeepMind’s AI-Powered Robots Play Soccer

We're all working on transport layer security (TLS). TLS is everywhere so there’s going to be significant disruption because it’s complicated, so it’s important to give folks an early opportunity to explore that.

Google also has a quantum computing business. PQC may be many organizations’ first exposure to anything quantum. What message would you like them to hear about the opportunities quantum computing offers?

The opportunity to optimize and do what we cannot do today with quantum computing is unbelievable. But alongside the use cases, it brings consequences and PQC is the result of that.

Quantum computing is giving us an opportunity to use much less compute and much fewer resources to do what we need to do in a much more responsible way. It will take time until quantum will be realized and become practical for our day-to-day applications but the progress that is happening in this space is mind-blowing.

Outside of cryptography, quantum will help reduce the power and resources to train Gemini or any other generative AI model. If we could cut the expense and resources needed by 10 or 100 times, that would be good. Demand for resources is growing exponentially but with quantum, it’s linear, which will deliver significant value.