To protect against the "Store Now, Decrypt Later" threat, Google Cloud is implementing Post-Quantum Cryptography (PQC) across its services. For more information on Google Cloud's approach, see Post-Quantum Cryptography on Google Cloud.
Post-quantum key exchange
To support post-quantum key exchange, the Google Cloud client libraries use a hybrid key exchange mechanism combining ML-KEM-768 with classical X25519 for TLS 1.3 connections.
Rust SDK support
No additional configuration or code changes are required when using standard
client library releases (released on or after January 28, 2026). The underlying
TLS engine (rustls with the default aws-lc-rs provider) automatically
negotiates post-quantum key exchange when connecting to supported Google Cloud
services.
If you override the cryptography provider (for example, by configuring
rustls to use ring), post-quantum key exchange will be disabled unless your
chosen provider explicitly supports it. For more information, see
Switch the default crypto provider.