AWS post-quantum cryptography migration plan

AWS has announced a comprehensive migration plan to post-quantum cryptography (PQC) to protect against future quantum computer threats that could break current public-key cryptographic algorithms.

• AWS will implement migration in four key workstreams focusing on different aspects of cryptographic systems
• Will use new NIST-approved PQC algorithms like ML-KEM for key encapsulation and ML-DSA for digital signatures
• Initial focus will be on encryption in transit, particularly public AWS service endpoints
• Will use "hybrid post-quantum key agreement" combining classical and post-quantum algorithms
• Services like AWS KMS and AWS Private CA will gradually integrate PQC capabilities

The migration aims to provide long-term data confidentiality and security, with AWS recommending customers prepare by ensuring software update capabilities and adopting TLS 1.3.