Google Pushes Forward Post‑Quantum Transition, Threatening Legacy Certificate Infrastructure

Google said this week that every one of its services must switch to post‑quantum cryptography (PQC) no later than 2029, pulling the industry schedule forward by six years relative to the timeline set by the National Institute of Standards and Technology (NIST) and arriving two years before the U.S. National Security Agency’s deadline for its own networks.

First reported by TechRadar, the announcement signals strong confidence in the quantum‑resistant algorithm suite that NIST has been reviewing since 2016. By moving the migration date up, Google is essentially wagering that the cryptographic community will be prepared to replace the RSA and elliptic‑curve certificates that currently secure most web traffic well before the wider ecosystem is compelled to do so.

Conventional digital certificates depend on mathematical problems—like integer factorisation and discrete logarithms—that are considered infeasible for classical computers yet vulnerable to large‑scale quantum computers. Should a sufficiently powerful quantum machine emerge, it could break the encryption protecting everything from personal emails to financial transactions. Consequently, certificate authorities (CAs) and enterprise PKI teams face mounting pressure to plan for a transitional period in which both classical and quantum‑resistant keys operate side by side.

Analysts observe that Google’s schedule forces vendors to speed up testing, certification and deployment of NIST‑chosen algorithms such as CRYSTALS‑KD and Kyber. While many CAs have already launched pilot projects, a full‑scale rollout across the global public‑key infrastructure will demand updates to browsers, operating systems and hardware security modules. The effort and expense could be considerable, especially for smaller providers that lack the resources of larger competitors.

Google’s early move also raises strategic questions about market dynamics. By establishing a precedent, the tech giant could push other major cloud and platform providers to adopt comparable deadlines, creating a de‑facto industry standard that outpaces official guidance. At the same time, regulators and standards bodies will need to keep watch to ensure interoperability and prevent a fragmented security landscape.

Looking forward, the next few years are likely to see intensified collaboration among government agencies, academia and the private sector to validate the security and performance of PQC schemes. Although the precise moment when quantum computers become a practical threat remains uncertain, Google’s 2029 target underscores the urgency of readying the internet’s foundational security mechanisms for a post‑quantum world.