AWS Application and Network Load Balancers Now Support Post-Quantum Key Exchange for TLS

AWS Load Balancers Support Post-Quantum Key Exchange for TLS

AWS Application Load Balancers (ALB) and Network Load Balancers (NLB) now support post-quantum key exchange options for the Transport Layer Security (TLS) protocol. This feature introduces new TLS security policies with hybrid post-quantum key agreement, combining classical key exchange algorithms with post-quantum key encapsulation methods, including the standardized Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) algorithm.

Post-quantum TLS (PQ-TLS) security policies protect your data in transit against potential "Harvest Now, Decrypt Later" (HNDL) attacks, ensuring long-term security for your applications and data transmissions.

What to do

• Update existing ALB HTTPS listeners or NLB TLS listeners to use a PQ-TLS security policy.
• Select a PQ-TLS policy when creating new listeners through the AWS Management Console, CLI, API, or SDK.
• Monitor the use of classical or quantum-safe key exchange using ALB connection logs or NLB access logs.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.