When Google announced its 2029 Q-Day timeline in early April, the industry took notice. Now, with the Android 17 developer preview, the company is backing that warning with concrete engineering: ML-DSA (Module-Lattice-Based Digital Signature Algorithm), the NIST-standardized post-quantum signature scheme formerly known as CRYSTALS-Dilithium, is being integrated into Android's Hardware Root of Trust, Verified Boot, and Keystore APIs.
What ML-DSA Changes on Android
ML-DSA is not a key exchange algorithm — it handles digital signatures. That distinction matters because signatures are the backbone of device identity, software attestation, and firmware integrity. In practical terms, Android 17 brings post-quantum protection to three critical areas:
- Hardware Root of Trust: Device identity keys stored in secure hardware can now be generated using ML-DSA. This protects hardware attestation against future quantum-capable adversaries collecting certificates today
- Verified Boot: The Android Verified Boot Library is being extended with ML-DSA signature verification. Boot chain integrity — from bootloader to system image — gains quantum-resistant protection
- Android Keystore: Developers can generate and use ML-DSA keys through the standard Keystore API, backed by hardware security modules where available. This enables app-level post-quantum signatures without custom crypto libraries
NIST Context
ML-DSA was finalized as FIPS 204 in August 2024, alongside ML-KEM (FIPS 203) for key encapsulation. NIST's post-quantum standards are the result of an eight-year evaluation process. Google's decision to prioritize ML-DSA over ML-KEM on the signature side aligns with the immediate threat model: while harvest-now-decrypt-later attacks target key exchange, signature forgery enables supply-chain attacks, impersonation, and attestation fraud — threats that become acute as quantum hardware scales.
Why Enterprise Mobility Should Care
For enterprises managing device fleets, this is operationally significant. MDM (Mobile Device Management) systems rely heavily on device attestation and certificate chains. If those chains use classical algorithms, a sufficiently powerful quantum computer could forge device identity certificates, bypass enrollment controls, or tamper with firmware verification.
With ML-DSA in the Hardware Root of Trust, Android 17 devices can issue attestation certificates that remain trustworthy even in a post-quantum environment. For regulated industries — finance, healthcare, defense — this addresses a compliance gap that has been widening since NIST finalized its PQC standards.
Software Signing and the Play Store
Google has signaled that Play Store developer signatures will migrate to PQC. ML-DSA integration in Android 17 lays the groundwork: once the platform can verify ML-DSA signatures natively, the ecosystem can begin transitioning APK and app bundle signing without requiring sideloaded crypto libraries. The timeline for a full Play Store migration remains unclear, but the platform prerequisite is now in place.
Pandorex View
Post-quantum cryptography has spent years in standards committees and research papers. Android 17 is the inflection point where it hits consumer hardware at scale. Google is not waiting for 2029 — it is shipping the primitives now so the migration can happen incrementally rather than in a panic. The question for other platform vendors (Apple, Microsoft, Samsung) is whether they can match this pace or risk falling behind on a transition that has a hard, physics-driven deadline.
Sources: Google Security Blog (04/2026), NIST FIPS 204, Android 17 Developer Preview documentation.