AWS Security Blog
Author: Panos Kampanakis
How AWS KMS and AWS Encryption SDK overcome symmetric encryption bounds
If you run high-scale applications that encrypt large volumes of data, you might be concerned about tracking encryption limits and rotating keys. This post explains how AWS Key Management Service (AWS KMS) and the AWS Encryption SDK handle Advanced Encryption Standard in Galois Counter Mode’s (AES-GCM) encryption limits or bounds automatically by using derived key […]
Post-quantum (ML-DSA) code signing with AWS Private CA and AWS KMS
Following our recent announcement of ML-DSA support in AWS Key Management Service (AWS KMS), we just introduced post-quantum ML-DSA signature support in AWS Private Certificate Authority (AWS Private CA). Customers can use AWS Private CA to create and manage their own private public key infrastructure (PKI) hierarchies. Through this integration, you can establish and use […]
Customer compliance and security during the post-quantum cryptographic migration
Amazon Web Services (AWS) prioritizes the security, privacy, and performance of its services. AWS is responsible for the security of the cloud and the services it offers, and customers own the security of the hosts, applications, and services they deploy in the cloud. AWS has also been introducing quantum-resistant key exchange in common transport protocols used […]
Post-quantum hybrid SFTP file transfers using AWS Transfer Family
September 5, 2025: The AWS Transfer Family has upgraded its support of hybrid quantum-resistant key exchanges from Kyber to ML-KEM, which was standardized by NIST in FIPS 203. The SSH policy names that support post-quantum key exchange with ML-KEM are TransferSecurityPolicy-2025-03 and TransferSecurityPolicy-FIPS-2025-03. The supported post-quantum SSH key exchange methods included in this policy are mlkem768nistp256-sha256, mlkem1024nistp384-sha384, and mlkem768x25519-sha256 as specified in the post-quantum […]
Enable post-quantum key exchange in QUIC with the s2n-quic library
January 25, 2023: AWS KMS, ACM, Secrets Manager TLS endpoints have been updated to only support NIST’s Round 3 picked KEM, Kyber. s2n-tls and s2n-quic have also been updated to only support Kyber. BIKE or other KEMs may still be added as the standardization proceeds. At Amazon Web Services (AWS) we prioritize security, performance, and […]
Introducing s2n-quic, a new open-source QUIC protocol implementation in Rust
At Amazon Web Services (AWS), security, high performance, and strong encryption for everyone are top priorities for all our services. With these priorities in mind, less than a year after QUIC ratification in the Internet Engineering Task Force (IETF), we are introducing support for the QUIC protocol which can boost performance for web applications that […]