Cloud KMS now supports the following post-quantum computing (PQC) algorithms for digital signatures in Public Preview:

• PQ_SIGN_ML_DSA_65: Module-lattice-based digital signature algorithm
• PQ_SIGN_SLH_DSA_SHA2_128S: Stateless hash-based digital signature algorithm

To Retrieve a public key for a PQC key, you must use the gcloud CLI or the Cloud KMS REST API.

• For the gcloud CLI, use the --public-key-format nist-pqc flag.
• For the REST API, use the public_key_format=NIST_PQC header parameter.

For more information about PQC algorithms, see PQC signing algorithms. For more information about PQC digital signatures, see Post-quantum cryptography (PQC) digital signature.

You can now use custom constraints with Organization Policy to provide more granular control over specific fields for some Cloud KMS resources. For more information, see Create custom organization policy constraints for Cloud KMS.