Meta tags:
description=Understand post-quantum TLS capabilities in Google Cloud load balancers to secure workloads against quantum computing threats.;

Headings (most frequently used words):

quantum, post, key, exchange, tls, and, attacks, against, stay, organized, with, collections, save, categorize, content, based, on, your, preferences, how, computing, threatens, security, what, next, authentication, symmetric, ciphers, are, not, threatened, enable, rollout, products, pricing, support, resources, engage,

Text of the page (most frequently used words):
load (78), and (58), set (44), balancer (44), the (37), #quantum (35), backend (35), cloud (34), overview (32), backends (29), key (28), exchange (28), with (26), post (26), tls (22), neg (21), balancers (18), application (18), instance (17), google (16), ssl (16), group (16), balancing (15), for (14), hybrid (14), external (14), that (13), global (13), zonal (13), use (12), management (12), traffic (11), regional (10), capabilities (10), managed (10), proxy (9), internal (9), buckets (9), custom (9), architecture (8), support (8), other (8), policies (8), using (8), against (8), attacks (8), service (8), thumb (7), enabled (7), when (7), you (7), network (7), cross (7), storage (7), url (7), negs (7), internet (7), mtls (7), add (7), https (7), resources (6), this (6), are (6), security (6), policy (6), create (6), connections (6), used (6), authentication (6), target (6), serverless (6), premises (6), shared (6), vpc (6), http (6), run (6), code (5), see (5), more (5), october (5), only (5), now (5), will (5), enable (5), clients (5), your (5), x25519mlkem768 (5), classic (5), region (5), computers (5), certificates (5), based (5), forwarding (5), troubleshooting (5), metrics (5), tcp (5), redirect (5), down (4), information (4), 2026 (4), content (4), setting (4), can (4), decrypt (4), client (4), frontend (4), computing (4), tools (4), maps (4), ipv6 (4), rules (4), services (4), view (4), logs (4), monitor (4), troubleshoot (4), configure (4), terraform (4), examples (4), headers (4), samples (3), under (3), next (3), 2027 (3), default (3), deferred (3), protection (3), enabling (3), harvest (3), later (3), not (3), cryptographic (3), between (3), symmetric (3), sessions (3), cryptographically (3), relevant (3), able (3), attacker (3), identity (3), could (3), web (3), technology (3), guides (3), networking (3), health (3), connectivity (3), explore (3), tutorials (3), connected (3), networks (3), directory (3), registration (3), distribution (3), udp (3), migrate (3), 한국어 (2), 日本語 (2), עברית (2), português (2), brasil (2), italiano (2), indonesia (2), français (2), español (2), américa (2), latina (2), deutsch (2), english (2), sign (2), third (2), terms (2), site (2), about (2), youtube (2), started (2), status (2), pricing (2), products (2), understand (2), need (2), last (2), updated (2), utc (2), licensed (2), its (2), license (2), send (2), feedback (2), what (2), after (2), disabled (2), timeline (2), following (2), rollout (2), attached (2), until (2), recommend (2), however (2), which (2), learn (2), how (2), uses (2), connecting (2), from (2), don (2), unaffected (2), supported (2), mechanisms (2), mitigate (2), risk (2), ciphers (2), such (2), encrypt (2), handshake (2), threatened (2), aes (2), break (2), keys (2), attack (2), threaten (2), algorithms (2), even (2), cryptography (2), developed (2), standards (2), documentation (2), sdk (2), languages (2), frameworks (2), infrastructure (2), costs (2), usage (2), access (2), observability (2), monitoring (2), migration (2), industry (2), solutions (2), distributed (2), multicloud (2), databases (2), data (2), analytics (2), pipelines (2), compute (2), hosting (2), development (2), logging (2), pools (2), tags (2), checks (2), optimizations (2), authorization (2), workload (2), protocol (2), failover (2), multiple (2), protocols (2), concepts (2), pool (2), convert (2), capacity (2), over (2), request (2), routing (2), app (2), engine (2), functions (2), error (2), constraints (2), console (2), product (2), reference (2), areas (2), close (2), subscribe, newsletter, our, decade, climate, action, join, manage, cookies, privacy, tech, twitter, events, blog, engage, training, certification, center, getting, github, system, release, notes, community, forums, contact, sales, marketplace, all, easy, easytounderstand, solved, problem, solvedmyproblem, otherup, hard, hardtounderstand, incorrect, sample, incorrectinformationorsamplecode, missing, missingtheinformationsamplesineed, otherdown, tell, except, otherwise, noted, page, details, java, registered, trademark, oracle, affiliates, developers, apache, creative, commons, attribution, always, shows, planned, because, offered, important, begin, affect, have, required, defer, provides, immediate, correctly, implemented, expected, experience, issues, incompatible, lets, delay, giving, time, make, compatible, either, attaching, new, existing, modifying, already, targetsslproxy, targethttpsproxy, advertises, mechanism, advertise, particular, form, method, means, secured, both, classical, once, completes, chacha20, 256, 128, certificate, authorities, allowing, falsely, assert, server, man, middle, allow, manipulate, contents, encrypted, unlike, cannot, done, retrospectively, recorded, significantly, integrity, during, revealing, exposing, layer, plaintext, true, perfect, forward, secrecy, methods, ecdhe, who, records, entire, session, today, years, future, become, available, called, two, critical, components, threatens, designed, resist, theoretical, these, were, vetted, national, institute, nist, their, conforms, being, ietf, advances, long, believes, asymmetric, research, progress, continues, current, pace, broken, soon, 2029, save, categorize, preferences, stay, organized, collections, home, clean, setup, check, audit, operate, maintain, map, size, quota, units, proxies, subnets, endpoint, groups, dns, names, firewall, connection, draining, advanced, customize, authenticated, private, user, provided, mutual, encryption, self, secure, switch, deploy, hub, spoke, hop, common, address, party, appliances, hops, affinity, weighted, passthrough, testing, optimize, latency, deliver, same, published, domain, faster, performance, improved, multi, best, practices, fail, high, availability, rewrite, header, query, parameter, roll, back, responses, response, project, bucket, organization, iam, conditions, roles, permissions, get, feature, comparison, resource, model, choose, discover, start, free, skip, main,

Text of the page (random words):
post quantum tls cloud load balancing google cloud documentation skip to main content technology areas close ai and ml application development application hosting compute data analytics and pipelines databases distributed hybrid and multicloud industry solutions migration networking observability and monitoring security storage cross product tools close access and resources management costs and usage management infrastructure as code sdk languages frameworks and tools console english deutsch español américa latina français indonesia italiano português brasil עברית 中文 简体 中文 繁體 日本語 한국어 sign in load balancing start free overview guides reference resources technology areas more overview guides reference resources cross product tools more console discover cloud load balancing overview choose a load balancer cloud load balancing resource model load balancer feature comparison get started roles and permissions iam conditions for forwarding rules organization policy constraints overview use custom constraints application load balancer http https overview external load balancer architecture overview request distribution overview set up global load balancer managed vm instance group backend cloud storage backend buckets external backend internet neg cloud run app engine or cloud run functions backends serverless neg on premises or other cloud backends zonal and hybrid neg add capabilities traffic management overview set up traffic management set up http to https redirect set up a load balancer with shared vpc set up load balancer with cross project backend service and backend bucket create custom headers in backend services custom error response overview configure custom error responses set up global load balancer classic terraform examples managed vm instance group backend cloud storage backend buckets external backend internet neg cloud run app engine or cloud functions backends serverless neg on premises or other cloud backends zonal and hybrid neg migrate resources overview migrate to global external application load balancer roll back to classic application load balancer add capabilities traffic management overview create custom headers in backend services set up custom header and query parameter based routing set up url redirect set up http to https redirect set up url rewrite set up regional load balancer managed vm instance group backend cloud storage backend buckets cloud run backends serverless neg on premises or other cloud backends zonal and hybrid neg external backend internet neg add capabilities traffic management overview set up traffic management set up high availability set up http to https redirect set up a load balancer with backend service using shared vpc set up a load balancer with backend buckets using shared vpc create custom headers in url maps fail over to regional load balancers monitor and troubleshoot overview global load balancers regional load balancers troubleshooting best practices explore tutorials request routing to a multi region external https load balancer faster web performance and improved web protection for load balancing deliver http and https content over the same published domain optimize application latency with load balancing application capacity optimizations with global load balancing capacity management with load balancing internal load balancer architecture overview set up cross region load balancer managed vm instance group backend cloud storage backend buckets on premises or other cloud backends zonal and hybrid neg cloud run backends serverless neg set up regional load balancer terraform examples vm instance group backends cloud run backends serverless neg cloud storage backend buckets on premises or other cloud backends zonal and hybrid neg external backend internet neg add capabilities traffic management overview set up traffic management set up http to https redirect create custom headers in url maps set up regional internal load balancer with backend service using shared vpc set up cross region load balancer with backend buckets using shared vpc set up a regional internal application load balancer with backend buckets using shared vpc service directory registration load balancing and connected networks monitor and troubleshoot view logs and metrics troubleshooting convert load balancer to ipv6 use custom metrics load testing backends proxy network load balancer tcp ssl proxy overview external load balancer architecture overview set up global load balancer global ssl proxy with vm instance group backends global tcp proxy with vm instance group backends set up global load balancer classic terraform examples global ssl proxy with vm instance group backends global tcp proxy with vm instance group backends set up regional load balancer vm instance group backends zonal neg backends hybrid connectivity hybrid negs external backend internet neg internal load balancer architecture overview set up cross region load balancer managed vm instance group backends on premises or other cloud backends zonal and hybrid neg set up regional load balancer managed vm instance group backends zonal neg backends hybrid connectivity hybrid negs external backend internet neg add capabilities load balancing and connected networks view logs and metrics convert load balancer to ipv6 passthrough network load balancer tcp udp overview external load balancer backend service based architecture traffic distribution concepts target pool based architecture set up load balancer vm instance group backends tcp udp only vm instance group backends multiple protocols zonal neg backends target pool based load balancer add capabilities configure failover configure weighted load balancing migrate from target pools to backend services service directory registration explore tutorials use udp with network load balancers monitor and troubleshoot view logs and metrics troubleshooting internal load balancer architecture overview traffic distribution concepts set up load balancer terraform examples vm instance group backends vm instance group backend for multiple protocols zonal neg backends add capabilities configure failover zonal affinity load balancers as next hops overview set up load balancing for third party appliances forwarding rules that use a common ip address service directory registration load balancing and connected networks explore tutorials set up load balancer as next hop with tags deploy a hub and spoke network set up a load balancer with internal ipv6 only backends monitor and troubleshoot view logs and metrics troubleshooting protocol forwarding overview set up protocol forwarding switch between a target instance and a backend service secure ssl certificates overview use self managed ssl certificates use google managed ssl certificates encryption to the backends troubleshooting ssl policies overview use ssl policies mutual tls frontend mtls overview set up frontend mtls with user provided certificates set up frontend mtls with a private ca backend mtls overview set up backend authenticated tls set up backend mtls backend mtls with managed workload identity overview set up backend mtls using managed workload identity post quantum tls authorization policies overview set up authorization policies customize load balancer advanced load balancing optimizations backend buckets backend services connection draining firewall rules forwarding rules health checks overview use health checks internal dns names ipv6 network endpoint groups overview hybrid connectivity negs internet negs serverless negs zonal negs overview set up zonal negs proxy only subnets tags target pools target proxies url maps overview use url maps url map size and quota units operate and maintain audit logging information health check logging information clean up a load balancer setup ai and ml application development application hosting compute data analytics and pipelines databases distributed hybrid and multicloud industry solutions migration networking observability and monitoring security storage access and resources management costs and usage management infrastructure as code sdk languages frameworks and tools home documentation networking load balancing guides send feedback post quantum tls stay organized with collections save and categorize content based on your preferences advances in quantum computing threaten the cryptographic mechanisms long used by tls google believes that the security of asymmetric cryptography used in tls could be broken by quantum computers as soon as 2029 if research progress continues at its current pace to mitigate this risk google cloud load balancers support post quantum key exchange capabilities designed to resist the theoretical capabilities of quantum computers these algorithms were developed and vetted by the national institute of standards and technology nist and their use in tls conforms with standards being developed under the ietf to learn more see post quantum cryptography in google cloud how quantum computing threatens tls security cryptographically relevant quantum computers will be able to enable attacks against two critical components of tls security key exchange and authentication attacks against key exchange cryptographically relevant quantum computers will be able to break the key exchange algorithms used during the tls handshake revealing the symmetric keys that encrypt tls sessions and exposing application layer traffic in plaintext this is true even for tls connections that use perfect forward secrecy key exchange methods such as ecdhe an attacker who records an entire tls session today could even decrypt it years in the future when quantum computing capabilities become available in what is called a harvest now decrypt later attack attacks against authentication cryptographically relevant quantum computers will be able to break the keys used in tls certificates or certificate authorities allowing an attacker to falsely assert a client or server identity used with a man in the middle attack this could allow an attacker to see and manipulate the contents of tls encrypted sessions unlike attacks against key exchange attacks against authentication cannot be done retrospectively against recorded traffic however attacks against authentication significantly threaten the integrity of web authentication symmetric ciphers are not threatened the symmetric cryptographic ciphers such as aes 128 aes 256 and chacha20 used to encrypt tls sessions once the handshake and authentication completes are not threatened by quantum computing post quantum key exchange to mitigate the risk of harvest now decrypt later attacks we recommend that you enable post quantum key exchange for connections between clients and load balancers post quantum key exchange is supported only for frontend tls connections that is for connections between the client and the load balancer post quantum key exchange can be enabled for the following load balancers global external application load balancers classic application load balancers regional external application load balancers cross region internal application load balancers regional internal application load balancers global external proxy network load balancers classic proxy network load balancers x25519mlkem768 is the particular form of post quantum key exchange supported in google cloud load balancers this is a hybrid key exchange method which means that it is secured by both classical and post quantum cryptographic mechanisms when post quantum key exchange is enabled the load balancer uses it when connecting to clients that advertise support for tls 1 3 and x25519mlkem768 connections to clients that don t support tls 1 3 or x25519mlkem768 are unaffected when post quantum key exchange is enabled the load balancer uses it when a connecting client advertises support for tls 1 3 and the x25519mlkem768 key exchange mechanism connections from clients that don t support tls 1 3 or x25519mlkem768 are unaffected enable post quantum key exchange you can enable post quantum key exchange on your load balancer by using the post quantum key exchange setting in an ssl policy either by attaching a new ssl policy to your existing targethttpsproxy or targetsslproxy or by modifying an already attached ssl policy to learn more about how to create ssl policies with the post quantum key exchange setting see create ssl policies we recommend that you enable post quantum key exchange now as it provides immediate protection against harvest now decrypt later attacks correctly implemented clients are not expected to experience issues however if your client application is incompatible you can set post quantum key exchange to deferred which lets you delay enabling post quantum key exchange until october 2027 giving you time to make your application compatible post quantum key exchange rollout because the security protection offered by post quantum key exchange is important google cloud will begin enabling it by default in october 2026 this will affect load balancers that have no ssl policy attached or that use an ssl policy with no post quantum key exchange setting if required you can defer enabling post quantum key exchange until october 2027 by using the deferred setting the following timeline shows the planned rollout of post quantum key exchange support for load balancers timeline post quantum key exchange status now disabled by default enabled only when set to enabled after october 2026 enabled by default disabled when set to deferred after october 2027 enabled always what s next ssl policies send feedback except as otherwise noted the content of this page is licensed under the creative commons attribution 4 0 license and code samples are licensed under the apache 2 0 license for details see the google developers site policies java is a registered trademark of oracle and or its affiliates last updated 2026 07 17 utc need to tell us more easy to understand easytounderstand thumb up solved my problem solvedmyproblem thumb up other otherup thumb up hard to understand hardtounderstand thumb down incorrect information or sample code incorrectinformationorsamplecode thumb down missing the information samples i need missingtheinformationsamplesineed thumb down other otherdown thumb down last updated 2026 07 17 utc products and pricing see all products google cloud pricing google cloud marketplace contact sales support community forums support release notes system status resources github getting started with google cloud code samples cloud architecture center training and certification engage blog events x twitter google cloud on youtube google cloud tech on youtube about google privacy site terms google cloud terms manage cookies our third decade of climate action join us sign up for the google cloud newsletter subscribe english deutsch español américa latina français indonesia italiano português brasil עברית 中文 简体 中文 繁體 日本語 한국어