Loading story…
Google said Android 17 will begin a broad migration to post-quantum cryptography as part of a plan to harden the platform against future quantum attacks on public-key systems. The company is introducing quantum-resistant protections across core trust components, including Android Verified Boot, Remote Attestation, KeyMint, and Android Keystore, with support centered on the NIST-standardized ML-DSA algorithm. Google said the move is intended to build a quantum-resistant chain of trust spanning device boot, identity verification, and hardware-backed security services.
Google also said Google Play will support hybrid app signing that combines classical and post-quantum signatures, and will begin generating quantum-safe ML-DSA signing keys for new apps while allowing existing apps to opt in. The company is targeting completion of its broader post-quantum migration by 2029, citing the risk of store-now-decrypt-later attacks and warning that organizations should begin adopting NIST-developed PQC standards before fault-tolerant quantum computers can break current encryption. Google added that future Play updates are expected to support hybrid key upgrades and prompt developers to rotate signing keys every two years.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Google said Google Play will support quantum-safe app signing by generating ML-DSA signing keys for new apps and opt-in existing apps, alongside hybrid signing support that combines classical and post-quantum signatures for APK authenticity and updates.
Google announced that Android 17 will begin a broad migration to post-quantum cryptography, introducing ML-DSA-based protections for Android Verified Boot, Remote Attestation, KeyMint, and Android Keystore as the first phase of a longer-term quantum-resistant chain of trust.
Google said it is preparing for the quantum era and aims to complete its post-quantum cryptography migration by 2029, citing risks such as store-now-decrypt-later attacks and updating its threat model to prioritize PQC for authentication services.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
cyberscoop.com
Open sourcescworld.com
Open sourceschneier.com
Open sourcehackread.com
Open sourceitpro.com
Open sourcedarkreading.com
Open sourceitsecurityguru.org
Open sourcehelpnetsecurity.com
Open sourcesecurity.googleblog.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Cloud published a post-quantum cryptography migration roadmap that maps service-level milestones to Google’s broader commitment to complete its PQC transition by 2029. The plan prioritizes protections against **store-now-decrypt-later** risks by the end of 2027, followed by digital signatures, attestations, foundational services, and key management by the end of 2028, while acknowledging that some hardware-rooted components may remain on longer replacement cycles beyond 2029. Google said several milestones are already complete, including quantum-confidential ALTS in 2025, PQC support for Google Cloud API endpoints and load balancers in 2026, and general availability in Cloud KMS for `ML-KEM`, `ML-DSA`, and `SLH-DSA`. The roadmap also notes dependencies on evolving standards for certificate and signature work, including Merkle Tree Certificates, and makes clear that customers will need to update client software, manage key lifecycles, and enable quantum-safe configurations to complete parts of the migration.
Aug 14, 2026
The U.S. government is accelerating post-quantum cryptography adoption across federal systems and the defense industrial base, with new executive and Defense Department directives setting milestones for agencies and contractors to support PQC by 2030 and use it by 2031. Reporting on the Pentagon’s strategy says the Cybersecurity Maturity Model Certification program will be updated with quantum-resistant requirements, while broader federal policy frames a two-track quantum strategy that combines defensive migration with continued national quantum advancement. Officials and industry sources warn that many contractors remain unprepared, even as governments and security agencies increasingly cite **Harvest Now, Decrypt Later** as a current risk to long-lived sensitive data. At the same time, industry is arguing that organizations cannot delay deployment waiting for better algorithms, even as implementation flaws raise fresh concerns around today’s standards. Cloudflare said `ML-DSA`, standardized alongside `ML-KEM`, is imperfect but the most practical near-term signature option and remains central to its plan for full post-quantum security by 2029. Separate research coverage highlighted practical key-recovery attacks against buggy `ML-DSA` implementations, including failures involving nonce reuse and corrupted signing randomness, underscoring that migration urgency must be matched by rigorous engineering, testing, and protections against side-channel and randomness-leakage failures.
Jul 14, 2026
Google has released **Android 17**, publishing the source code to AOSP under the tag `android-17.0.0_r1` and beginning rollout to supported Pixel devices, with broader availability planned across OEMs including HONOR, Lenovo, OnePlus, OPPO, vivo, Xiaomi, and others. Google also made **Generic System Images** available for `ARM64` and `x86_64`, while the platform adds major usability and device features such as foldable enhancements, App Bubbles, Handoff support, VVC/H.266 video, RAW14, HE-AAC, BLE hearing-aid improvements, and OpenJDK 25 integration. The release introduces a broad set of security and privacy changes, including tighter controls for **contacts**, **location**, and **local network** access, expanded one-time-password handling beyond SMS, stricter restrictions on **dynamic code loading**, stronger lost-device protections, improved threat detection, enhanced **Advanced Protection**, and stricter PIN retry limits. Google also added Certificate Transparency-related enhancements, support for **HPKE** cryptography and **ML-DSA** APK signatures, and continued restrictions on cleartext traffic, alongside Pixel-specific updates delivered through the June Pixel Drop.
Jul 12, 2026