Google will begin testing post-quantum cryptography improvements in the next beta release of Android 17, with these capabilities becoming generally available alongside the system’s production release. This represents the first announced phase of Android’s transition to an architecture resistant to threats that quantum computers may pose in the future, by integrating the post-quantum cryptography standards finalized by the U.S. National Institute of Standards and Technology (NIST) across multiple platform layers.
Google says its goal is not limited to updating individual applications or specific transport protocols, but extends to building a chain of trust that covers the platform from device startup through the execution of applications distributed globally. The company is relying on preparatory work it began in 2016, including experiments in post-quantum cryptography, incorporating its capabilities into its products, and publishing threat models and technical papers.
Boot Protection and the Root of Trust
Android 17 includes two major upgrades to the core protection layers. The first is the integration of the lattice-based ML-DSA digital-signature algorithm into the Android Verified Boot (AVB) library. This algorithm is used to provide quantum-resistant signatures, with the aim of protecting software loaded during the boot sequence from unauthorized modification.
The second upgrade involves beginning the migration of Remote Attestation to an architecture fully compatible with post-quantum cryptography requirements under current standards. KeyMint certificate chains will support quantum-resistant algorithms, allowing devices to attest to their state to parties that rely on this attestation while maintaining trust in a post-quantum environment.
Developer Support Through Android Keystore
Google is updating Android Keystore to natively support ML-DSA, enabling applications to use post-quantum signatures inside the device’s secure hardware while isolating sensitive key material from the main operating system. This allows developers to benefit from hardware-based roots of trust without having to build their own cryptographic applications.
The Android SDK exposes the ML-DSA-65 and ML-DSA-87 options, which can be integrated using the standard KeyPairGenerator interface. Google describes implementing lattice-based cryptography inside the trusted execution environment (TEE) as an engineering challenge, because this type requires much larger key sizes and memory footprints than traditional elliptic-curve cryptography.
Hybrid Signing for Google Play Apps
Google is expanding the protection chain to include application signatures, as the platform will verify post-quantum signatures on APK files to resist signature forgery during application installation or updates. Google Play will support this transition through Play App Signing, which enables the creation of hybrid signature blocks combining traditional keys with post-quantum keys.
The service uses Google Cloud KMS to protect signing keys in the cloud. During the Android 17 release cycle, Google Play will create ML-DSA signing keys for new applications and for existing applications whose developers choose to participate, regardless of the application’s target API level. At a later stage, developers will be able to select their traditional keys and ML-DSA keys and authorize Google Play to upgrade the hybrid keys.
Google Play will also begin reminding developers to upgrade their application signing keys at least once every two years. The roadmap indicates that post-quantum key encapsulation will later be integrated into KeyMint, Key Attestation, and Remote Key Provisioning, expanding protection across the identity lifecycle from hardware-level DICE measurements to remote attestation servers.