Google's future-proofing Android 17 against tomorrow's quantum hackers

For more than the past three decades now, powerful encryption has been keeping the internet and the systems connected to it private and secure. That’s all built on complicated math problems that are designed to only work one way: Know the right key, and you can compute the answer, but it’s so complicated to solve without the key that it might as well be impossible. At least, that used to be the case, but quantum computers are about to change everything. Luckily for you and the security of your smartphone, Google is getting out ahead of this nascent threat.

Quantum computers fundamentally work a whole lot differently from regular systems, and while their design and operation involve tons of limitations, they theoretically have the potential to be really, really great at solving many of those one-way “unsolvable” problems we based so many of our old encryption algorithms on. They’re also getting better all the time, and while they’re not yet black boxes that can instantly crack existing encryption, that’s pretty much the direction we’re headed, and everybody can see it.

In order to avoid any upcoming disaster, Google today shares that it’s adopting government Post-Quantum Cryptography (PQC) standards in Android 17. That’s getting started in the very next Android 17 beta, and if everything goes well, we should see PQC standards baked in to the final, public Android 17 release.

Google points to a few specific areas where it’s planning to harden Android 17 through PQC upgrades, like upgrading the bootloader with quantum-resistant digital signatures to prevent attackers from interrupting the secure boot chain. In addition to that local solution, Google’s also updating the Android Keystore and transitioning to PQC-compliant architecture for remote attestation, helping secure communication against quantum attackers.

This even extends to your apps, with quantum-safe signatures attesting to your software’s integrity. Google’s trying to keep this shift as lightweight as possible for users and developers alike, and Google will soon be communicating the steps devs needs to take to make sure their app signatures are sufficiently future-proofed.