AWS Key Management Service now supports ML-KEM for post-quantum key encapsulation

AWS Key Management Service now supports ML-KEM, a post-quantum cryptography standard for establishing shared secrets between parties.

• Supports all three ML-KEM key specs: ML-KEM-512, ML-KEM-768, and ML-KEM-1024 from NIST FIPS 203
• Encapsulate API generates random 32-byte shared secrets; Decapsulate API recovers secrets from ciphertext
• Private keys protected in FIPS 140-3 Level 3 validated hardware security modules
• GetPublicKey API enables exporting public keys for external encapsulation operations
• Available in all AWS Regions except Middle East (UAE), Middle East (Bahrain), and China

ML-KEM addresses the "harvest now, decrypt later" threat by replacing classical key-establishment schemes vulnerable to future quantum attacks.