Google will start implementing government Post-Quantum Cryptography (PQC) standards with Android 17. In a blog post, the company announced that the process will start with the next Android 17 beta, followed by a widespread general availability with the final production release of the upcoming operating system.
Among the areas where Google plans to improve the security of Android 17 is the bootloader, which will get upgraded quantum-resistant digital signatures. That would prevent attackers from making unauthorized modifications to the software loaded during the boot sequence. Other upgrades include the Android Keystore and a new PQC-compliant architecture for remote attestation that would make the software resilient against future quantum threats.
The post-quantum chain of trust on Android 17. | Image by Google
Part of Google’s idea is to make the shift to PQC standards as easy as possible for users and developers alike. The measures also extend to apps, which will utilize quantum-safe signature to attest to the integrity of the software. The company will soon communicate what steps developers will have to take to future proof their app signature.
Google’s preoccupation with quantum threats may seem premature, considering that the technology is still at an experimental stage. However, quantum computers have the potential to make current cryptography obsolete.
Modern encryption works with math problems that are so complicated to solve without a key that it’s practically impossible to break them. However, if you use a quantum computer, at least theoretically, those problems could suddenly become very easy to solve. That could potentially make existing encryption easy to crack, leading to major security issues.
Google is far from the first company to add some post-quantum security measures, though that’s the first time they’re applied at the OS level. In 2024, Apple introduced the PQ3 cryptographic protocol for iMessage, and last year’s Galaxy S25 phones came with some PQC security features.
Considering Android is the most popular mobile operating system, Google’s security measures are certainly going to have very big reach. I don’t think many people would understand or look specifically for PQC security features, but they will be protected by them anyways.
Leave a comment