AWS Key Management Service just shipped native ML-KEM support. Before you check the “post-quantum” box, know that it gave you three different algorithms to choose from — and picking the wrong one can leave you non-compliant while feeling done.
What launched: On October 26, AWS KMS added Encapsulate, Decapsulate, and GetPublicKey APIs for ML-KEM (FIPS 203), the lattice-based key-encapsulation mechanism replacing RSA and ECDH for key establishment. Private keys stay inside FIPS 140-3 Level 3 HSMs; public keys export so partner systems can run encapsulation locally with AWS-LC, OpenSSL, or Bouncy Castle.
Three specs, three different answers: KMS supports ML-KEM-512, -768, and -1024. NIST’s own transition guidance names ML-KEM-768 the default for general key establishment. CNSA 2.0 mandates ML-KEM-1024 for National Security Systems. The “right” key spec depends on your compliance regime, not on whichever one a tutorial used.
A building block, not a finish line: Encapsulate/Decapsulate gets you a shared secret. It doesn’t give you hybrid TLS key exchange (X25519MLKEM768, now standardizing at the IETF), authenticated handshakes, or quantum-safe certificate chains (ML-DSA, FIPS 204). Those are separate migrations layered on top of this one.
Bottom line: native cloud support for ML-KEM removes the “no tooling available” excuse for starting key-establishment migration. It doesn’t remove the need to know which parameter set each workload actually calls, or whether two teams standardized on different ones without telling each other. That’s an inventory problem before it’s an engineering one — which is exactly where QuantVision’s CBOM discovery earns its keep, mapping every ML-KEM call site back to the compliance mandate it needs to satisfy.
If you’re already on AWS KMS: do you know which ML-KEM parameter set your workloads are calling right now, and whether it’s the same one everywhere?
#PostQuantumCryptography #PQC #AWS #CryptoAgility #NIST #CISO #QuantumSafe #FIPS203 #KeyManagement #InfoSec
Sources:
AWS KMS – ML-KEM post-quantum key encapsulation: https://www.google.com/url?q=
NIST FIPS 203 (ML-KEM standard): https://www.google.com/url?q=