AWS Key Management Service now supports ML-KEM for post-quantum key encapsulation

AWS KMS Now Supports ML-KEM

AWS Key Management Service (KMS) now supports Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), a post-quantum cryptography standard under NIST FIPS 203. This enables two parties to establish a shared secret. ML-KEM addresses the "harvest now, decrypt later" threat to classical schemes.

KMS supports all three ML-KEM key specs: ML-KEM-512, ML-KEM-768, and ML-KEM-1024. The Encapsulate API produces a random 32-byte shared secret and its ciphertext form. The Decapsulate API recovers the shared secret from ciphertext using the corresponding private key. KMS protects the private key in FIPS 140-3 Level 3 validated hardware security modules (HSMs).

What to do

• Use the GetPublicKey API to export the public key for local operations.
• Ensure your applications are compatible with ML-KEM key specs.

ML-KEM is available in all AWS Regions where KMS is available, except the Middle East (UAE), Middle East (Bahrain), and China Regions. For more information, see Key spec reference in the AWS KMS Developer Guide.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.