{"id":7766,"date":"2026-04-09T18:43:46","date_gmt":"2026-04-09T18:43:46","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=7766"},"modified":"2026-04-09T18:43:46","modified_gmt":"2026-04-09T18:43:46","slug":"cloudflare-actively-adjusting-quantum-priorities-in-wake-of-google-warning","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=7766","title":{"rendered":"Cloudflare \u2018actively adjusting\u2019 quantum priorities in wake of Google warning"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Google\u2019s accelerated post-quantum encryption deadline<\/a> has spurred other leaders in the industry, including Cloudflare, to consider pushing forward their own plans.<\/p>\n

The US<\/a> National Institute of Standards and Technology (NIST) has set a 2030 deadline for depreciating legacy encryption algorithms ahead of their planned retirement in 2035.<\/p>\n

Late last month Google brought forward its own post-quantum cryptography (PQC) deadline a year to 2029<\/a> because advances in quantum computers mean that legacy encryption and digital signature systems are at greater risk sooner than previously anticipated.<\/p>\n

Google is readying its products and services for PQC by adding support to its Chrome browser<\/a>, Android mobile operating system, and \u00a0cloud-based services<\/a>.<\/p>\n

Algorithmic breakthrough<\/h2>\n

Bas Westerbaan, principal research engineer at Cloudflare, and an expert in post quantum encryption, told CSO that Google\u2019s decision to pull forward its PQC<\/a> migration timeline to 2029 is a \u201cvery big deal.\u201d<\/p>\n

\u201cWe are starting to see some details of the three breakthroughs that scared Google, but crucial elements are being withheld due to their perceived risk as an aid for adversaries,\u201d says Westerbaan. \u201cGoogle even went to the effort to publish a state-of-the-art zero-knowledge proof to demonstrate they indeed made an algorithmic breakthrough without spilling the beans.\u201d<\/p>\n

Cloudflare is \u201cactively adjusting\u201d its priorities and \u201cwill share outcomes soon,\u201d Westerbaan explains.<\/p>\n

Preparations for the migration to PQC by Cloudflare are already well advanced.<\/p>\n

More than half the traffic on Cloudflare is already secure against the threat of harvest-now\/decrypt-later using ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism, a PQC standard ratified in 2024) as browsers roll out support.<\/p>\n

To protect browser connections against active attack, Cloudflare is planning to deploy post-quantum certificates in 2027.<\/p>\n

Quantum threat<\/h2>\n

The existing public key cryptographic systems that protect Internet and mobile transactions, Rivest-Shamir-Adelman (RSA) and Elliptic Curve Cryptography (ECC), are aging cryptosystems, developed in the 1970s and 1980s, respectively.<\/p>\n

Sufficiently powerful quantum computers pose a threat to legacy cryptographic standards, and specifically to encryption and digital signatures, because they have the capacity to break the mathematical foundations of legacy algorithms.<\/p>\n

For example, newer and faster algorithms have already been developed, such as the JVG algorithm, that require less quantum computational power (qubits) to factor large prime numbers, on which some legacy cryptosystems such as RSA are based.<\/p>\n

Google argues that advances in quantum computing, including hardware development, quantum error correction, and quantum factoring resource estimates, are bringing forward the time legacy cryptographic algorithms will become vulnerable to quantum computing, a phenomenon known as Q-Day.<\/p>\n

\u201cGoogle\u2019s accelerated 2029 deadline reflects a shift from trying to predict Q-day to managing pre-Q-day risk,\u201d says Mark Pecen, chair of technical committee on quantum technologies at the European Telecommunications Standards Institute (ETSI). \u201cThe real concern isn\u2019t when quantum computers arrive; it\u2019s that adversaries are already collecting encrypted data today to decrypt later.\u201d<\/p>\n

Data with long-term sensitivity, legal records, intellectual property, medical research, and critical infrastructure communications are most at risk.<\/p>\n

\u201cBy moving earlier than government timelines, Google is effectively forcing the industry to treat post-quantum migration as an immediate operational priority rather than a future compliance exercise,\u201d says Pecen.<\/p>\n

Matt Campagna, chair of the quantum-safe cryptography working group at ETSI, adds:<\/p>\n

\u201cBusinesses must develop their own PQC migration strategies and actively engage with vendors and suppliers to ensure alignment.\u201d<\/p>\n

Michael Klieman, global vice president for project management at Entrust, says that doubts about how close the industry is to a cryptographically relevant quantum computing breakthrough are creating uncertainty.<\/p>\n

\u201cToday, there\u2019s no universal way to measure performance across quantum systems, which makes it difficult to separate incremental progress from meaningful milestones toward Q-Day,\u201d according to Klieman.<\/p>\n

\u201cWhat the industry needs next are clear, standardized benchmarks for scale, error correction, and algorithmic performance \u2014 so organizations can understand where we are on the path to quantum risk, not just where vendors say we are,\u201d Klieman adds.<\/p>\n

Catalyst<\/h2>\n

Daryl Flack, partner at UK-based managed security service provider Avella Security, argues Google\u2019s accelerated roadmap is likely to act as a catalyst across the industry.<\/p>\n

Google\u2019s accelerated roadmap has the potential to disrupt a cycle of inaction driven by misaligned incentives: vendors waiting for customer demand, and organizations waiting for regulation, according to Flack.<\/p>\n

\u201cGoogle\u2019s decision to accelerate its post-quantum cryptography (PQC) migration to 2029 is a clear signal that the industry is moving from theoretical timelines to operational urgency,\u201d Flack says. \u201cWhile existing UK and EU roadmaps provide direction, they do not compel action, and that distinction is now becoming a material cybersecurity risk.\u201d<\/p>\n

Preparations \u2014 and in some cases even awareness \u2014 about the need to migrate to PQC is lagging amongst many enterprises.<\/p>\n

\u201cMany enterprises lack visibility into where cryptography is used, have not identified their most sensitive long-lived data, and do not yet have crypto-agility built into their systems,\u201d Flack warns. \u201cWithout addressing these fundamentals, any accelerated timeline, whether driven by regulators or vendors, will be difficult to meet.\u201d<\/p>\n

Enterprise CISOs should take ownership of PQC readiness<\/a>.<\/p>\n

\u201cPreparation should start with a structured approach: creating crypto inventories and catalogs, mapping cryptographic dependencies, identifying high-risk systems, and embedding crypto-agility into transformation programmes,\u201d Flack advises. \u201cJust as importantly, organizations must extend this thinking into their supply chains.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Google\u2019s accelerated post-quantum encryption deadline has spurred other leaders in the industry, including Cloudflare, to consider pushing forward their own plans. The US National Institute of Standards and Technology (NIST) has set a 2030 deadline for depreciating legacy encryption algorithms ahead of their planned retirement in 2035. Late last month Google brought forward its own […]<\/p>\n","protected":false},"author":0,"featured_media":7767,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-7766","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/7766"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7766"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/7766\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/7767"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}