Google Cloud announced general availability of quantum-safe digital signatures (ML-DSA and SLH-DSA) and post-quantum key encapsulation (ML-KEM) in Cloud KMS. The immediate challenge for organizations is signing large data payloads without bandwidth and processing issues inherent to post-quantum cryptography. Cloud KMS supports external-µ variants of ML-DSA that allow applications to compute the digest externally and send only a small fixed-size hash to the KMS for signing, addressing bandwidth constraints while maintaining compatibility with pure ML-DSA verifiers. These external-µ variants also bind the public key to the message representative to achieve non-resignability, preventing attackers from manipulating the representative to verify under a different key.

Supported algorithms include SLH-DSA-SHA2-128s (Level 1), ML-DSA-44 (Level 2), ML-DSA-65 (Level 3), and ML-DSA-87 (Level 5), with variants for pure, pre-hash, and external-µ. This helps organizations comply with evolving regulatory timelines like the U.S. government’s CNSA 2.0 requirements. The transition is driven by the anticipated arrival of cryptographically relevant quantum computers (CRQC) and the need to protect long-term data integrity and authenticity.

The external-µ workflow operates as follows: the application processes a large message locally using a cryptographic hash function (SHA2 or SHAKE) to produce a digest of around 32 bytes. This small digest is then sent to Cloud KMS for signing using the private key. NIST’s ML-DSA standard (FIPS 204, Algorithm 7) defines the external-µ variant for prehash functionality, and RFC 9881 Appendix D provides details. This approach offers the bandwidth efficiency of a pre-hash workflow with full compatibility with pure ML-DSA verifiers.

Developers can integrate these algorithms through the existing Cloud KMS API, with detailed instructions and code samples available in the KMS documentation. Google Cloud states it will continue to update services to incorporate future NIST standards and guidance, collaborating with organizations on their specific cryptographic needs.