Amazon Web Services (AWS), Amazon’s cloud computing unit, now lets customers create quantum-resistant keys in its Key Management Service (KMS), which manages encryption keys and performs cryptographic operations. The announcement covers one specific job: helping two computers establish a shared secret.
Common methods for establishing a secret over a public network rely on math that a sufficiently powerful quantum computer could break. AWS’s documentation says no such machine exists today. But an attacker could record the exchange now and try to break it later, a tactic known as “harvest now, decrypt later.”
The method is called Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM). The National Institute of Standards and Technology (NIST) standardized it in 2024 as FIPS 203. One system uses a public key to generate a shared secret and information it sends to the other system. KMS uses the matching private key and that information to recover the same secret, without the secret itself being transmitted.
AWS says it protects the private key using hardware security modules (HSMs) validated to FIPS 140-3 Level 3.
A separate protection
In April 2025, AWS added support for a hybrid post-quantum method that protects connections to KMS itself when clients support it. The new keys instead let a company’s own systems establish quantum-resistant shared secrets, which they can use to encrypt data. AWS’s documentation treats the two as separate protections.
Developers must integrate the new keys into their applications, arrange for the parties to establish a shared secret and use that secret in a separate data-encryption process. The KMS update does not automatically change the encryption used by websites, databases or existing application connections.
NIST sets the clock
NIST published the final version of its transition report on Oct. 27. It says organizations may prioritize data that is especially sensitive or must stay secret for many years, and it tells them to examine their entire cryptographic supply chain, not only their own systems.
Executive Order 14412 directs federal agencies to move high-value assets and high-impact systems, excluding National Security Systems, to post-quantum key establishment by Dec. 31, 2030. The requirement applies to federal systems, but NIST says many organizations that work with the government will be affected too.
AWS says ML-KEM keys are available in every KMS region except Bahrain, the United Arab Emirates and China. A partner can perform its half of the exchange using compatible software, including libraries such as AWS-LC, OpenSSL or Bouncy Castle. The announcement gives no customer adoption figures or performance results.