Amazon Web Services (AWS) has added support for the post-quantum key encapsulation mechanism ML-KEM to AWS Key Management Service (KMS) , AWS Certificate Manager (ACM) , and AWS Secrets Manager , enhancing the security of TLS connections.
See also: Nova Sonic: Amazon's new AI voice model
ML-KEM (Module-Lattice-Based Keying Mechanism) is a post-quantum cryptographic algorithm designed to protect key exchanges from the hypothetical, but theoretically real, threat of quantum computers, which could break traditional encryptions such as RSA and ECC (elliptic curve cryptography).
The mechanism is based on CRYSTALS-Kyber, which was selected by NIST (National Institute of Standards and Technology) as the foundation for the cryptography standard of the post-quantum world, which was announced in its final form in August 2024.
Although quantum computers do not pose a direct threat to cryptography at this time, implementing algorithms that are safe against quantum computers prevents future disclosure of secrets through “harvest now, decrypt later” attacks.
AWS states that it has prioritized the security of its most critical services (KMS, ACM, Secrets Manager), which previously supported CRYSTALS-Kyber, which is scheduled to be deprecated in 2026.
To enable ML-KEM post-quantum TLS when using AWS services such as KMS, ACM, or Secrets Manager, users will need to update their client SDKs and explicitly enable the feature. AWS provides instructions for enabling ML-KEM for both Java SDK (2.30.22 and later) and Rust SDK users.
See also: Amazon introduced the new AI agent “Nova Act”
The cloud also suggests that administrators run load tests, benchmark tests, and connectivity tests on their environment to confirm compatibility and performance.
AWS's own benchmarking tests show that enabling ML-KEM hybrid post-quantum TLS has minimal impact on performance, even in the worst-case scenarios.
By reusing the TLS connection, which is the default setting in the SDKs, the performance loss is almost non-existent, measured at just 0,05%.
Without reuse, the drop reaches about 2.3%, due to the additional 1,600 bytes that ML-KEM adds to the TLS handshake process, requiring an additional computation time of 80 to 150 microseconds per connection.
Overall, enabling ML-KEM has minimal performance impact for almost all applications, and users are advised to take advantage of this new feature as soon as possible.
See also: AWS Key Hunter: The free tool for finding exposed keys
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Quantum risks refer to potential threats arising from the development and use of quantum computers. Quantum computers have the ability to process data in ways that are impossible for classical computers, exploiting properties of quantum physics, such as superposition and entanglement. Quantum computers could compromise the security of traditional encryption systems, as they may be able to solve problems that currently require enormous computational power to solve with classical computers.
Source: bleepingcomputer
