AWS lets customers exchange keys that future quantum computers can't crack

The scenario that worries security leaders has a name: “harvest now, decrypt later.” An adversary records encrypted exchanges today and waits for a quantum computer powerful enough to open them. On October 26, Amazon Web Services added a countermeasure to KMS, its encryption key management service.

KMS can now create ML-KEM keys, the key encapsulation mechanism standardized in August 2024 by NIST, the U.S. National Institute of Standards and Technology, in the FIPS 203 standard. Three security levels are available: ML-KEM-512, ML-KEM-768 and ML-KEM-1024. The feature is available in every region where KMS exists, except the United Arab Emirates, Bahrain and China. European regions are therefore covered.

What is an ML-KEM key for?

ML-KEM does not encrypt data directly: it lets two parties share a secret. The recipient creates a key pair in KMS and sends over the public key. The sender uses it to generate a random 32-byte secret and its encrypted version, which is sent back. The recipient asks KMS to decrypt this package and recovers the same secret. Both parties then derive symmetric keys from it to encrypt their data.

An important point: the private key stays inside FIPS 140-3 Level 3 certified hardware security modules and never leaves KMS in plaintext. The sender does not need AWS: they can perform the operation on their own with a library such as OpenSSL, Bouncy Castle or AWS-LC. Unlike elliptic-curve Diffie-Hellman (ECDH) key exchange, where each party contributes a key, here the secret is generated from the recipient's public key alone.

What is still missing

You have to assemble the steps yourself. AWS acknowledges in its documentation that a direct encryption function, chaining encapsulation, key derivation and AES encryption, would make things simpler. The company says it is closely following the IETF draft standard for post-quantum hybrid encryption (PQ-HPKE), which it sees as the replacement for RSA encryption. That mode is not yet available.

KMS already offered post-quantum signatures with ML-DSA (the FIPS 204 standard). To also protect communications with KMS itself, AWS points to post-quantum hybrid TLS.

Where to start

For a company that already uses AWS, this is an easy building block to test on a real use case: a secret exchange with a partner, or data that must stay confidential for years. The hardest part remains the upfront inventory of RSA and elliptic-curve usage, which our guide to post-quantum migration in six steps covers in detail. On the key management side, Cloudflare is moving in the same direction with its own regional keys.