AWS KMS now supports ML-KEM for post-quantum key encapsulation
AWS KMS supports ML-KEM, a NIST FIPS 203 post-quantum cryptography standard, enabling two parties to establish a shared secret and mitigate quantum threats
AWS KMS supports the NIST FIPS 203 compliant module lattice-based key encapsulation mechanism (ML-KEM), a post-quantum cryptographic standard specified by NIST for replacing classical key establishment methods like DH/ECDH key agreement and RSA key transport. This addresses the harvest-now-decrypt-later threat from quantum computers. KMS supports three key sizes: ML-KEM-512, ML-KEM-768, and ML-KEM-1024. The Encapsulate API generates a random 32-byte shared secret and its ciphertext using a public key, while the Decapsulate API recovers the shared secret from the ciphertext using the corresponding private key. KMS protects ML-KEM private keys in FIPS 140-3 level 3 validated HSMs. The GetPublicKey API allows exporting the public key for distribution to partners, client applications, or external systems to perform Encapsulate operations locally using libraries like AWS-LC, OpenSSL, or Bouncy Castle. ML-KEM is available in all AWS regions except Middle East (UAE), Middle East (Bahrain), and China regions.
Why it matters
AWS KMS is a service for managing cryptographic keys, and this update enhances protection against quantum computing threats by supporting ML-KEM
Regions: Same as AWS KMS