Google Sets 2029 Deadline for Quantum-Safe Encryption: Android 17 Leads the Charge

Google on Wednesday announced a decisive acceleration of its timeline to migrate all products to Post-Quantum Cryptography (PQC), setting an ambitious internal deadline of 2029 — a full year ahead of NIST’s industrywide 2030 mandate. The announcement, published simultaneously on the Google Security Blog and the Android Developer Blog, signals that the technology giant now views the threat from future quantum computers as sufficiently concrete to demand urgent, industry-wide action today.

Post-Quantum Cryptography refers to a new generation of encryption algorithms designed to remain secure even against the enormous computational power of cryptographically relevant quantum computers (CRQCs). The algorithms currently protecting most internet traffic — including the RSA and elliptic-curve cryptosystems that underpin banking, e-commerce, and government communications — are mathematically vulnerable to quantum attacks. While such machines do not yet exist at scale, the window for a safe transition is narrowing.

Google cited three converging forces behind its decision to accelerate: rapid progress in quantum computing hardware, breakthroughs in quantum error correction, and updated resource estimates for quantum-assisted prime factorization. Together, these developments have compressed the community’s best estimates of when a CRQC might arrive.

Of particular concern is the “store-now, decrypt-later” (SNDL) attack strategy — a practice already underway in which adversaries harvest and stockpile encrypted data today, betting they can decrypt it once sufficiently powerful quantum hardware becomes available. Data with a confidentiality shelf life extending beyond roughly ten years — such as health records, financial credentials, and biometric information — is already at practical risk under this model.

For digital signatures — the cryptographic tools used to verify software identity, authenticate OS boot sequences, and validate app integrity — the threat is understood to arrive later, but the migration itself is more complex. Heather Adkins, VP of Security Engineering, and Sophie Schmieg, Senior Staff Cryptography Engineer, framed the 2029 goal as a “responsibility to lead by example,” urging enterprises and government teams to treat the timeline as a catalyst for their own transitions.

The most tangible and immediate announcement concerns Android 17, which Google states will be the first mobile operating system to implement comprehensive PQC integration across its full security architecture. Testing begins in the next Android 17 beta, with general availability in the stable production release.

The upgrade targets four distinct pillars of Android’s security model, building a continuous quantum-resistant “chain of trust” from hardware power-on through to final app execution.

The engineering challenge is considerable. Lattice-based cryptography — the mathematical foundation of ML-DSA — requires significantly larger key sizes and memory footprints than classical elliptic-curve cryptography. Implementing it within the resource-constrained Trusted Execution Environment of a mobile device represents, in Google’s own words, a major engineering achievement. An ML-DSA-65 signature alone runs approximately 3,293 bytes, compared to roughly 64 bytes for a comparable ECDSA signature.

By centralizing PQC at the platform level, Google argues, individual app developers are shielded from the complexity of managing their own cryptographic migrations. The billions of Android users who never touch a security setting stand to benefit automatically.

For the typical Android user, the transition will be largely invisible — a strengthened foundation beneath familiar surfaces. The chain of trust securing every app download, every OS boot, and every hardware attestation will silently become quantum-resistant. No action is required.

Developers, however, face meaningful decisions. Those using Play App Signing will have PQC key generation handled automatically for new apps. Existing apps will be offered an opt-in migration path. Developers who manage their own signing keys will eventually need to generate ML-DSA keys and configure hybrid signature blocks. Google has signaled it will publish detailed migration documentation to support this transition.

For enterprise security teams and backend infrastructure operators, the announcement is a call to action. Google explicitly recommends that engineering teams adjust their own threat models: treat store-now-decrypt-later as a present threat, and begin planning digital signature migrations before a CRQC emerges — not after. Deploying PQC at a perimeter device such as a web application firewall, security researchers caution, does not guarantee end-to-end protection if the internal connection from the WAF to the origin server still relies on classical TLS only. The full connection path must be evaluated.

By setting a 2029 deadline and deploying PQC in its most widely distributed platform, Google is using Android’s global reach — spanning billions of active devices — as a forcing function for an industry-wide transition. The race to a quantum-safe internet has officially begun.