AWS adds post-quantum ML-KEM encryption to its Key Management Service

[Diane82]

Amazon Web Services has added post-quantum protection to one of its core security services. Quantum Zeitgeist reports that AWS Key Management Service now supports ML-KEM, the post-quantum key encapsulation method standardised by NIST in FIPS 203

The aim is to defend against harvest now, decrypt later attacks, where encrypted data is stolen today in the hope of decrypting it with a future quantum computer

A new Encapsulate function uses a public key to produce a 32 byte shared secret and a ciphertext, while a Decapsulate function recovers the secret with the matching private key. Private keys stay inside hardware security modules validated to FIPS 140-3 Level 3. Customers can also export public keys and encapsulate locally using libraries such as AWS-LC, OpenSSL or Bouncy Castle, for example when exchanging data with outside partners

Three key sizes are available, ML-KEM-512, ML-KEM-768 and ML-KEM-1024. The feature is not yet available in AWS's Middle East and China regions, and no date has been given for those

This is a meaningful step, because AWS KMS is used by a huge number of organisations to manage encryption keys. Making post-quantum options available in such a widely used service lowers the barrier for companies starting their migration. The announcement is light on performance figures, but the direction is clearly right

Will you start using post-quantum options in cloud services? And how quickly should big providers make them the default?

AWS Adds A New Encryption Method To Guard Data From Future Quantum Attacksquantumzeitgeist.com