With cryptographically relevant quantum computers (CRQC) on the horizon, transitioning to quantum-safe digital signatures is critical to safeguarding long-term data integrity and authenticity. Organizations are steadily recognizing this urgency.
For example, the U.S. government announced an update to the timelines by which departments and agencies must transition to quantum safe digital signatures. To help with the transition, we are announcing the general availability of our quantum-safe digital signatures (ML-DSA, SLH-DSA) and post-quantum key encapsulation (ML-KEM) in Google Cloud Key Management Service (Cloud KMS).
The immediate challenge for your organization is functional: You need to sign massive data payloads without encountering the bandwidth and processing issues inherent with post-quantum cryptography (PQC). To proactively address these emerging threats and help you support compliance with regulatory obligations, you can use the suite of PQC digital signature algorithms available in Cloud KMS, which includes ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), featuring dedicated support for the efficient external-µ variants.
PQC digital signature algorithms in Cloud KMS
As standards and regulatory institutions are setting requirements and timelines for adopting quantum-safe algorithms, such as the National Security Agency’s CNSA 2.0, they’re underscoring the need for organizations to start their migration planning. To help you choose the specific security strength and signing method necessary for your applications, Cloud KMS gives you a broad selection of ML-DSA and SLH-DSA algorithms that are publicly available.
Cloud KMS now supports the following PQC algorithms and variants:
|
Algorithm Name |
NIST Security Category |
Variant Type |
Description |
|
SLH-DSA-SHA2-128s |
Level 1 |
Pure, Pre-hash |
Stateless Hash-Based Digital Signature for defense-in-depth |
|
ML-DSA-44 |
Level 2 |
Pure, External-µ |
High performance, Level 2 quantum security (equivalent to a collision search on SHA-256) |
|
ML-DSA-65 |
Level 3 |
Pure, External-µ |
Balance of security and performance, Level 3 quantum security (equivalent to an exhaustive key search on AES-192) |
|
ML-DSA-87 |
Level 5 |
Pure, External-µ |
Highest security for long-term data protection, Level 5 quantum security (equivalent to an exhaustive key search on AES-256) |
The need for pre-hash and external-µ variants
The cryptographic elements used for digital signatures have a fixed or predictable size in memory. In contrast, the message being signed can range from a few bytes to massive files. This size disparity creates a major challenge when you use a separate, secure device, such as an HSM or a dedicated key management service.
These systems are often optimized for security and key operations, but they have limited bandwidth and processing power, making it impractical or impossible to securely transmit and process extremely large messages in the security boundary for signing. Therefore, the application first processes the large message locally using a cryptographic hash function (such as SHA2 or SHAKE) to create a fixed-size, small digest that is around 32 bytes. The application then sends this small digest to the hardware security module (HSM) or key management service for the actual signing operation using the private key.
NIST’s ML-DSA standard, FIPS 204 (Algorithm 7), uses an external-µ variant for its prehash functionality, which helps with this workflow. RFC 9881 Appendix D describes the details of external-µ. This method allows the application to calculate the digest (also called the message representative) externally and feed it into the pure ML-DSA signing algorithm. This offers the best of both worlds: The bandwidth efficiency of a pre-hash workflow, and full compatibility with pure ML-DSA verifiers.
These external-µ variants also bind the public key mathematically to the message representative to achieve non-resignability, an important security property that prevents an attacker from manipulating the message representative in a way that verifies under a different, possibly attacker-controlled key. You can learn more details here, and explore the BoringSSL implementation for a practical example of handling external-µ.
Google Cloud KMS now supports the pre-hash and external-µ variants. This enables high-performance, low-latency signing workflows that securely handles large payloads via external hashing, while integrating with pure verifiers.
Getting started with PQC signatures in Cloud KMS
Your applications can integrate these algorithms through the Cloud KMS API. Developers can use existing Cloud KMS capabilities to create, manage, and use PQC keys for signing operations. Detailed instructions and code samples are available in our KMS documentation to guide you through the process.
The PQC road ahead
The transition to a post-quantum cryptographic landscape is a collaborative journey. Adding PQC digital signatures in Google Cloud KMS is a significant milestone, helping you with your quantum-safe migration strategies.
We will continue to update our services to incorporate future NIST standards and guidance, helping you maintain the security of your critical systems. We look forward to collaborating with you on your specific cryptographic needs, and we welcome your feedback.
