Post-Quantum Crypto Is Here — What It Means on AWS

Fri, 10 Jul 2026 00:00:00 +0000

TL;DR: Post-quantum cryptography stopped being a research-paper topic. The reason to care today is “harvest-now, decrypt-later”: an adversary records your encrypted traffic now and decrypts it once a large quantum computer exists, so anything with a long secrecy lifetime is already exposed. In August 2024 NIST published the first finalized standards (FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA), which turned “someday” into a concrete plan. On AWS the practical news is that AWS KMS already supports hybrid post-quantum TLS (ML-KEM) for connections and ML-DSA (FIPS 204) post-quantum signatures, and data at rest under KMS already uses AES-256-GCM, which is quantum-resistant. The action that ages well is not a rushed migration; it is crypto-agility: know where your long-lived secrets are, and be able to swap algorithms without re-architecting.

Disclaimer: I’m a solutions architect, and this is an explainer plus field guidance, not authoritative security advice. Every “AWS supports X” claim links to official documentation; verify currency there, because service support moves quickly. Confirm the specifics for your own runtime, region, and compliance needs before you rely on them.

This is Part 3 of the “Whiteboard to Cloud” series, where I take an academic explainer and trace it to what you can actually do on AWS. The earlier parts covered vector search and why compression behaves like intelligence. This one starts at a whiteboard about quantum computers and ends at a KMS key spec.

schristoph.online

Post-Quantum Crypto Is Here — What It Means on AWS