What Are Google Cloud Platform (GCP) Services?

Google Cloud Platform (GCP) services are Google’s suite of cloud computing products for compute, storage, networking, data analytics, and security. Its core data-security service is Cloud Key Management Service (Cloud KMS), which lets you create, use, rotate, and destroy cryptographic keys across five protection levels.

Google Cloud Platform (GCP) is Google’s public cloud, offering compute, storage, networking, analytics, and security services used by startups, enterprises, and governments. For data protection, GCP centers on Cloud Key Management Service (Cloud KMS), which manages encryption keys in software, in FIPS 140-2 Level 3 hardware security modules, or in an external key manager you control.

Key Takeaways

• Cloud KMS offers five protection levels: SOFTWARE, HSM (multi-tenant), HSM_SINGLE_TENANT, EXTERNAL, and EXTERNAL_VPC.
• Software keys use FIPS 140-3 Level 1 validated primitives of the BoringCrypto module; Cloud HSM keys are generated and used in FIPS 140-2 Level 3 validated HSMs (CMVP certificate #4399).
• Cloud KMS supports post-quantum algorithms: ML-DSA (FIPS 204) and SLH-DSA-SHA2-128s (FIPS 205) signing are generally available, and ML-KEM (FIPS 203) plus the X-Wing hybrid KEM for key encapsulation are in preview.
• Bring Your Own Key (BYOK) uses key import with an import job; the recommended method is RSA_OAEP_3072_SHA256_AES_256.
• Direct encryption is capped at 64 KiB for software keys and 8 KiB combined plaintext plus AAD for HSM keys; use envelope encryption for larger data.

What Is Google Cloud Platform (GCP)?

Google Cloud Platform (GCP) is the set of cloud computing services that Google runs on the same infrastructure it uses for its own products, spanning compute, storage, networking, databases, data analytics, machine learning, and security.

Organizations of every size use GCP alongside Amazon Web Services (AWS) and Microsoft Azure, and its strengths in data analytics and global network infrastructure make it a common choice for data-heavy workloads. For teams responsible for protecting data, the service that matters most is Cloud Key Management Service (Cloud KMS), Google’s managed platform for creating and controlling cryptographic keys.

Cloud KMS Protection Levels

Cloud KMS exposes five protection levels that differ by where key material lives and who can reach it. Google documents these as SOFTWARE, HSM, HSM_SINGLE_TENANT, EXTERNAL, and EXTERNAL_VPC. You use every protection level through the same Cloud KMS API and client libraries, so application code does not change when you move from software keys to hardware-backed keys.

Protection level	Where keys live	FIPS validation
SOFTWARE	Google software (BoringCrypto module)	FIPS 140-3 Level 1 (BCM primitives)
HSM (multi-tenant)	Shared Google-owned HSM clusters	FIPS 140-2 Level 3
HSM_SINGLE_TENANT	Dedicated HSM partitions you manage	FIPS 140-2 Level 3
EXTERNAL	External key manager over the internet	Depends on EKM provider
EXTERNAL_VPC	External key manager over a VPC network	Depends on EKM provider

Software keys are the cheapest option and suit workloads without a hardware requirement. Cloud HSM is for regulated workloads that must generate and use keys inside certified hardware. Single-tenant Cloud HSM adds cryptographic isolation from other customers. Cloud EKM (the two EXTERNAL levels) keeps key material in a partner key manager such as Thales or Fortanix, so Google cannot access your keys.

FIPS Validation: 140-2 and 140-3

Cloud KMS meets both FIPS 140-2 and FIPS 140-3, depending on protection level. Software keys run on the BoringCrypto module (BCM), which is FIPS 140-3 validated, so software cryptographic operations use FIPS 140-3 Level 1 validated primitives. Cloud HSM keys are generated and used inside FIPS 140-2 Level 3 validated hardware security modules under CMVP certificate #4399.

The 140-2 reference carries a caveat. NIST’s Cryptographic Module Validation Program (CMVP) has already moved certificate #4399 to its Historical List through its sunsetting process, and all remaining FIPS 140-2 certificates move to the Historical List on September 21, 2026. Historical status does not switch off a module, but CMVP describes historical modules as ones federal agencies should not include in new procurements. Teams with FedRAMP, CMMC, or DFARS obligations should confirm which of their cryptographic components have a path to FIPS 140-3.

Keys, Algorithms, and Encryption Modes

Cloud KMS supports symmetric and asymmetric keys across a defined set of algorithms. Symmetric encryption uses AES-256 in Galois/Counter Mode (GCM). Asymmetric options include RSA at 2048, 3072, and 4096 bits and elliptic-curve keys on P-256, P-384, and secp256k1. Each key has a purpose (such as ENCRYPT_DECRYPT or ASYMMETRIC_SIGN) that fixes which operations it can perform.

Signing and Encryption Algorithms

For asymmetric signing, Cloud KMS supports RSA (RSASSA-PSS and RSASSA-PKCS1-v1_5) and elliptic-curve signing (ECDSA on P-256, P-384, and secp256k1, plus Ed25519). Google recommends EC_SIGN_P256_SHA256 for elliptic-curve signing and RSA_SIGN_PSS_3072_SHA256 for RSA. For asymmetric encryption, Cloud KMS uses RSAES-OAEP with a recommended default of RSA_DECRYPT_OAEP_3072_SHA256.

Post-Quantum Algorithms

Cloud KMS now supports NIST post-quantum cryptography. For signatures it offers ML-DSA-44, ML-DSA-65, and ML-DSA-87 (FIPS 204) and SLH-DSA-SHA2-128s (FIPS 205), all generally available. For key establishment it offers, in preview, ML-KEM-768 and ML-KEM-1024 (FIPS 203) and the X-Wing hybrid KEM, which combines ML-KEM-768 with X25519. Google recommends the X-Wing hybrid for key encapsulation because it layers a classical and a post-quantum scheme. These algorithms defend long-lived data against harvest-now, decrypt-later attacks.

Bring Your Own Key (BYOK) and Key Import

Bring Your Own Key (BYOK) in Cloud KMS is implemented through key import. You create an import job, wrap your key material with the import job’s public key, and Cloud KMS unwraps it inside the target protection level so the raw key is never exposed in transit. The recommended import method is RSA_OAEP_3072_SHA256_AES_256.

That method is a hybrid wrap. Cloud KMS encrypts a one-time AES-256 key with RSAES-OAEP (using MGF1 and the chosen digest), then encrypts your target key with that AES-256 key using AES Key Wrap with Padding, defined in RFC 5649. The two results are concatenated into the wrapped key blob. This is the same construction as the PKCS #11 CKM_RSA_AES_KEY_WRAP mechanism.

Data Size Limits and Envelope Encryption

Cloud KMS is designed to protect key-encryption keys, not bulk data, so direct encryption has size limits. For software, external, and external VPC keys, the plaintext per encrypt call must be no larger than 64 KiB. For HSM keys, the combined plaintext and additional authenticated data (AAD) must be no larger than 8 KiB.

For larger data, use envelope encryption: generate a local data-encryption key (DEK), encrypt your data with the DEK, then use a Cloud KMS key-encryption key (KEK) to wrap the DEK. You store the ciphertext next to the wrapped DEK, and the KEK never leaves Cloud KMS.

How Encryption Consulting Helps

Encryption Consulting’s Cloud Data Protection Services help you design and operate key management on Google Cloud, from choosing the right Cloud KMS protection level to wiring customer-managed encryption keys (CMEK) into BigQuery, Cloud Storage, and Compute Engine. Our GCP Data Protection Service covers key hierarchy design, BYOK and Cloud EKM setup, rotation policy, and audit logging so your deployment maps to your compliance obligations. For teams planning ahead, our PQC Advisory Services guide adoption of the post-quantum algorithms now available in Cloud KMS. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.

Frequently Asked Questions

Is Google Cloud KMS FIPS 140-2 or FIPS 140-3 compliant?

Google Cloud KMS meets both, depending on protection level. Software keys use the BoringCrypto module (BCM), which is FIPS 140-3 validated, so software cryptographic operations use FIPS 140-3 Level 1 validated primitives. Cloud HSM keys are generated and used inside FIPS 140-2 Level 3 validated HSMs (CMVP certificate #4399). NIST has already moved certificate #4399 to its Historical List, and all remaining FIPS 140-2 certificates move there on September 21, 2026.

What is the difference between Cloud KMS software keys, Cloud HSM, and Cloud EKM?

The three differ by where key material lives and who controls it. Software keys run cryptographic operations in Google software at FIPS 140-3 Level 1. Cloud HSM stores keys in FIPS 140-2 Level 3 hardware security modules, with multi-tenant and single-tenant options. Cloud EKM keeps keys in an external key manager such as Thales or Fortanix, reached over the internet or a VPC network, so Google cannot access the key material.

Does Google Cloud KMS support post-quantum cryptography?

Yes. Cloud KMS supports NIST post-quantum algorithms for signing and key establishment. Signing with ML-DSA-44, ML-DSA-65, and ML-DSA-87 (FIPS 204) plus SLH-DSA-SHA2-128s (FIPS 205) is generally available. Key encapsulation with ML-KEM-768, ML-KEM-1024 (FIPS 203), and the X-Wing hybrid KEM that combines ML-KEM-768 with X25519 is in preview. These protect long-lived data against harvest-now, decrypt-later attacks.

How does Bring Your Own Key (BYOK) work in Google Cloud KMS?

BYOK in Cloud KMS uses key import backed by an import job. You wrap your key material with the import job public key, then Cloud KMS unwraps it inside the target protection level. The recommended method, RSA_OAEP_3072_SHA256_AES_256, encrypts a one-time AES-256 key with RSAES-OAEP, then wraps your key with that AES key using AES Key Wrap with Padding (RFC 5649).

How much data can Google Cloud KMS encrypt directly?

Cloud KMS is built to protect key-encryption keys, not bulk data. For software, external, and external VPC keys the plaintext limit per encrypt call is 64 KiB. For HSM keys the combined plaintext and additional authenticated data limit is 8 KiB. For anything larger, use envelope encryption: generate a local data-encryption key, encrypt the data with it, then wrap that key with Cloud KMS.

Secure Your Google Cloud Keys with Confidence

Map your Cloud KMS design to your compliance needs and plan post-quantum readiness with Encryption Consulting. Explore Cloud Data Protection Services, ISO/IEC 27001:2022 and SOC 2 certified