--- title: Future-proofing data integrity: Quantum-safe digital... description: Google Cloud is announcing general availability of quantum-safe digital signature algorithms (ML-DSA/FIPS 204 and SLH-DSA/FIPS 205) and post-quantum key... canonical: https://daily.dev/posts/future-proofing-data-integrity-quantum-safe-digital-signatures-in-cloud-kms-48ecf07wc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Future-proofing data integrity: Quantum-safe digital signatures in Cloud KMS | daily.dev og:description: Google Cloud is announcing general availability of quantum-safe digital signature algorithms (ML-DSA/FIPS 204 and SLH-DSA/FIPS 205) and post-quantum key... og:url: https://daily.dev/posts/future-proofing-data-integrity-quantum-safe-digital-signatures-in-cloud-kms-48ecf07wc og:image: https://api.daily.dev/og/posts/48ECF07WC.png og:image:alt: Future-proofing data integrity: Quantum-safe digital signatures in Cloud KMS og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Future-proofing data integrity: Quantum-safe digital signatures in Cloud KMS **[Google Cloud](https://daily.dev/sources/gcp)** · 4 min read · 2 upvotes · 1 comments ## Summary Google Cloud is announcing general availability of quantum-safe digital signature algorithms (ML-DSA/FIPS 204 and SLH-DSA/FIPS 205) and post-quantum key encapsulation (ML-KEM) in Cloud KMS. The post explains the practical challenge of signing large data payloads with PQC algorithms on HSMs or KMS services due to bandwidth and processing constraints, and how the external-µ and pre-hash variants of ML-DSA address this by allowing applications to hash large messages locally before sending a small digest to the KMS for signing. This approach maintains bandwidth efficiency while preserving compatibility with pure ML-DSA verifiers and providing non-resignability security properties. The move aligns with U.S. government mandates and NSA CNSA 2.0 requirements for transitioning to quantum-safe cryptography. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What post-quantum digital signature algorithms does Google Cloud KMS support now? Google Cloud KMS supports ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) as generally available quantum-safe digital signature algorithms, along with ML-KEM for post-quantum key encapsulation. It offers a broad selection of security strengths and signing methods, including dedicated support for the efficient external-µ variants of ML-DSA. _Teams planning a quantum-safe migration can track KMS algorithm updates like these on daily.dev._ ### What is the external-mu variant of ML-DSA and why is it needed? The external-µ variant, defined in FIPS 204 Algorithm 7 and detailed in RFC 9881 Appendix D, lets an application compute the message digest locally and feed it into the pure ML-DSA signing algorithm instead of sending the full large message to an HSM or KMS. This preserves bandwidth efficiency for signing massive payloads while staying compatible with pure ML-DSA verifiers and binding the public key to the message representative to prevent resignability attacks. _Developers wiring large-payload signing into an HSM can compare pre-hash approaches like this on daily.dev._ ### Why are organizations moving to quantum-safe digital signatures now? Organizations are accelerating migration to quantum-safe digital signatures because cryptographically relevant quantum computers are anticipated, and regulators are setting hard deadlines. The U.S. government updated its transition timelines for quantum-safe digital signatures, and the NSA's CNSA 2.0 guidance sets requirements for national security systems to adopt quantum-resistant algorithms. _Security teams tracking regulatory deadlines for quantum-safe crypto can follow developments like this on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@trevorsuna** · 1 upvotes > The local pre-hash approach makes this feel much more usable for real workloads. Post-quantum migration can sound far away, but key lifetimes and “harvest now, decrypt later” mean teams need a plan well before the deadline shows up. ## Similar posts on daily.dev - [PQC in Plaintext: Google Cloud’s post-quantum cryptography roadmap](https://daily.dev/posts/pqc-in-plaintext-google-cloud-s-post-quantum-cryptography-roadmap-bmttgmgmo) · Google Cloud · 0 upvotes · 0 comments - [Announcing quantum-safe key import in Cloud KMS](https://daily.dev/posts/announcing-quantum-safe-key-import-in-cloud-kms-jrusae7fr) · Google Cloud · 0 upvotes · 0 comments - [Post-Quantum Cryptography for Authentication: The Enterprise Migration Guide 2026](https://daily.dev/posts/post-quantum-cryptography-for-authentication-the-enterprise-migration-guide-2026-i5hayeibm) · Security Boulevard · 0 upvotes · 0 comments - [Why we cannot wait for better post-quantum signature algorithms](https://daily.dev/posts/why-we-cannot-wait-for-better-post-quantum-signature-algorithms-3zasaxenh) · Cloudflare · 1 upvotes · 0 comments --- Tags: [#quantum-computing](https://daily.dev/tags/quantum-computing), [#gcp](https://daily.dev/tags/gcp), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/future-proofing-data-integrity-quantum-safe-digital-signatures-in-cloud-kms-48ecf07wc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Future-proofing data integrity: Quantum-safe digital signatures in Cloud KMS","url":"https://daily.dev/posts/future-proofing-data-integrity-quantum-safe-digital-signatures-in-cloud-kms-48ecf07wc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/future-proofing-data-integrity-quantum-safe-digital-signatures-in-cloud-kms-48ecf07wc"},"datePublished":"2026-07-28T17:13:23.326Z","dateModified":"2026-09-14T07:02:58.090Z","description":"Google Cloud is announcing general availability of quantum-safe digital signature algorithms (ML-DSA/FIPS 204 and SLH-DSA/FIPS 205) and post-quantum key...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b559a17bb032216a7853ac1742b2da5b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b559a17bb032216a7853ac1742b2da5b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Google Cloud","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Google Cloud","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/gcp","url":"https://daily.dev/sources/gcp"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/future-proofing-data-integrity-quantum-safe-digital-signatures-in-cloud-kms-48ecf07wc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"quantum-computing,gcp,cryptography","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Google Cloud","item":"https://daily.dev/sources/gcp"},{"@type":"ListItem","position":3,"name":"Future-proofing data integrity: Quantum-safe digital signatures in Cloud KMS"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/future-proofing-data-integrity-quantum-safe-digital-signatures-in-cloud-kms-48ecf07wc","comment":[{"@type":"Comment","text":"The local pre-hash approach makes this feel much more usable for real workloads. Post-quantum migration can sound far away, but key lifetimes and “harvest now, decrypt later” mean teams need a plan well before the deadline shows up.","datePublished":"2026-07-29T04:19:26.884Z","url":"https://daily.dev/posts/48ECF07WC#c-jplVhfVjF","author":{"@type":"Person","name":"Trevor Suna","url":"https://daily.dev/trevorsuna","image":"https://media.daily.dev/image/upload/s--dZ7gXxpp--/f_auto/v1784081551/avatars/avatar_EMoP47rpuw8DNjhp6R1b6?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/future-proofing-data-integrity-quantum-safe-digital-signatures-in-cloud-kms-48ecf07wc#faq","mainEntity":[{"@type":"Question","name":"What post-quantum digital signature algorithms does Google Cloud KMS support now?","acceptedAnswer":{"@type":"Answer","text":"Google Cloud KMS supports ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) as generally available quantum-safe digital signature algorithms, along with ML-KEM for post-quantum key encapsulation. It offers a broad selection of security strengths and signing methods, including dedicated support for the efficient external-µ variants of ML-DSA. Teams planning a quantum-safe migration can track KMS algorithm updates like these on daily.dev."}},{"@type":"Question","name":"What is the external-mu variant of ML-DSA and why is it needed?","acceptedAnswer":{"@type":"Answer","text":"The external-µ variant, defined in FIPS 204 Algorithm 7 and detailed in RFC 9881 Appendix D, lets an application compute the message digest locally and feed it into the pure ML-DSA signing algorithm instead of sending the full large message to an HSM or KMS. This preserves bandwidth efficiency for signing massive payloads while staying compatible with pure ML-DSA verifiers and binding the public key to the message representative to prevent resignability attacks. Developers wiring large-payload signing into an HSM can compare pre-hash approaches like this on daily.dev."}},{"@type":"Question","name":"Why are organizations moving to quantum-safe digital signatures now?","acceptedAnswer":{"@type":"Answer","text":"Organizations are accelerating migration to quantum-safe digital signatures because cryptographically relevant quantum computers are anticipated, and regulators are setting hard deadlines. The U.S. government updated its transition timelines for quantum-safe digital signatures, and the NSA's CNSA 2.0 guidance sets requirements for national security systems to adopt quantum-resistant algorithms. Security teams tracking regulatory deadlines for quantum-safe crypto can follow developments like this on daily.dev."}}]} ```