AWS Key Management Service adds post-quantum ML-KEM support

Amazon Web Services (AWS) has announced that its Key Management Service (KMS) now supports the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM). This new capability adheres to the NIST FIPS 203 standard and is designed to provide post-quantum cryptography.

ML-KEM is intended to replace classical key-establishment schemes, such as RSA-based key transport and Diffie-Hellman (DH/ECDH) key agreement. The implementation addresses the “harvest now, decrypt later” threat, where adversaries record current encrypted exchanges to decrypt them once sufficiently powerful quantum computers become available.

KMS supports three specific ML-KEM key specifications: ML-KEM-512, ML-KEM-768, and ML-KEM-1024. The service utilizes FIPS 140-3 Level 3 validated hardware security modules (HSMs) to protect the private keys of ML-KEM key pairs. The update is available in all AWS Regions except for those in China and the Middle East (UAE and Bahrain).