On 26 October 2026, AWS announced that AWS Key Management Service now supports ML-KEM for post-quantum key encapsulation. ML-KEM is the post-quantum key-establishment standard NIST published as FIPS 203, and AWS KMS now lets you create ML-KEM key pairs, keep the private key inside AWS-managed hardware security modules and use two new APIs, Encapsulate and Decapsulate, to set up shared secrets that hold up against future quantum computers.
For most teams, “post-quantum” still sounds like a problem for the next decade, but the data you send today is why it matters now. This guide explains what AWS KMS ML-KEM does, how the APIs work and how to start your post-quantum migration on AWS.
Why Post-Quantum Key Exchange Matters Today
Most secure communication starts with RSA or elliptic-curve Diffie-Hellman (ECDH) to agree on a symmetric key. A large enough quantum computer could break those classical schemes.
AWS describes the main risk as “harvest now, decrypt later”: an attacker records your key-establishment exchange today and recovers the shared secret once powerful quantum computers exist. Health, financial and other long-lived data is most exposed.
NIST’s draft transition report, NIST IR 8547, sets out how quantum-vulnerable algorithms will be replaced by post-quantum standards. AWS notes that ML-KEM is NIST’s planned replacement for classical key establishment such as DH/ECDH key agreement and RSA-based key transport.
What Is ML-KEM?
ML-KEM stands for Module-Lattice-Based Key-Encapsulation Mechanism. According to NIST FIPS 203, published on 13 August 2024, a key-encapsulation mechanism lets two parties establish a shared secret key over a public channel. That secret can then be used with symmetric algorithms for encryption and authentication. Its security rests on the Module Learning with Errors problem, and NIST says it is currently believed to be secure even against adversaries with a quantum computer.
FIPS 203 defines three parameter sets. In order of increasing security strength and decreasing performance, they are ML-KEM-512, ML-KEM-768 and ML-KEM-1024.
What AWS KMS ML-KEM Support Includes
Based on the AWS announcement and the AWS KMS key spec reference, here is what you get:
- Three key specs:
ML_KEM_512,ML_KEM_768andML_KEM_1024, all using theML_KEMencapsulation algorithm. - A new key usage: ML-KEM keys use the
ENCAPSULATE_DECAPSULATEkey usage. - HSM-protected private keys: the private key is protected in FIPS 140-3 Level 3 validated HSMs and never leaves AWS KMS unencrypted.
- Exportable public keys: you can call
GetPublicKeyand hand the public key to partners, client apps or external systems, which can encapsulate locally with libraries such as AWS-LC, OpenSSL or Bouncy Castle. - Wide availability: ML-KEM works in all Regions where AWS KMS is available except Middle East (UAE), Middle East (Bahrain) and the China Regions. That means Indian teams can use it in Mumbai and Hyderabad.
How Encapsulate and Decapsulate Work
1. The sender encapsulates
The Encapsulate API takes an ML-KEM key ID and returns two values: a 32-byte random SharedSecret and its encapsulated form, SharedSecretCiphertextBlob. Before Base64 encoding, the ciphertext is 768 bytes for ML_KEM_512, 1088 bytes for ML_KEM_768 and 1568 bytes for ML_KEM_1024. The sender keeps the secret and sends only the ciphertext.
2. The receiver decapsulates
The key owner passes the ciphertext to the Decapsulate API. AWS KMS uses the private key to recover the same 32-byte secret. Both sides can use it directly as key material or run it through a key derivation function to create several keys and nonces.
3. Confirm both sides match
There is one important detail. Decapsulate returns an InvalidCiphertextException only when the ciphertext length does not match the key spec. Otherwise it always returns a 32-byte pseudo-random value, even if the ciphertext was altered or made with a different key. AWS calls this implicit rejection, a protection against chosen-ciphertext attacks. So your protocol must confirm that both parties derived the same secret before using it, for example with a key-confirmation message.
Access is controlled in the key policy with kms:Encapsulate and kms:Decapsulate, and both support cross-account use.
Do You Need to Re-Encrypt Data at Rest?
No. The AWS post-quantum cryptography migration plan explains that data at rest in AWS is encrypted with 256-bit symmetric cryptography, and AWS does not believe existing customer data needs to be re-encrypted. KMS documentation calls its default AES-256-GCM keys quantum resistant.
The real risk is public-key key agreement over untrusted networks, which is where ML-KEM fits.
Where AWS KMS ML-KEM Fits in Real Architectures
- Partner and B2B data exchange: publish your ML-KEM public key to a partner so they can encapsulate a session key and send encrypted files that only your KMS key can unlock.
- Application-level encryption: establish keys between services, mobile apps or IoT devices when TLS terminates too early.
- Long-retention regulated data: fintech and healthtech data that must stay confidential for years.
Don’t Forget Post-Quantum TLS
ML-KEM keys in KMS are for your own protocols. Separately, AWS offers hybrid post-quantum TLS that combines ECDH with ML-KEM. The AWS KMS hybrid post-quantum TLS guide says KMS supports it on all endpoints in all Regions. CloudTrail’s tlsDetails.keyExchange field shows a value such as X25519MLKEM768 when a call used it.
The AWS Post-Quantum Cryptography page also notes that ML-KEM TLS policies are available for customer-owned resources such as load balancers, and switching to them is the customer’s responsibility under the shared responsibility model.
A Practical Post-Quantum Rollout Plan
- Inventory your cryptography: list where RSA and ECDH are used for key exchange, including partner integrations and third-party libraries.
- Prioritise by data lifetime: start with data that must stay secret for years and travels over networks you do not control.
- Upgrade clients: AWS recommends moving to TLS 1.3 and keeping SDKs and CLIs current so they can negotiate post-quantum key exchange.
- Pilot in non-production: create an ML-KEM key, test Encapsulate and Decapsulate, and add key confirmation.
- Test your network path: AWS warns that legacy proxies or deep-packet-inspection firewalls can block larger post-quantum handshakes.
- Govern and monitor: lock down
kms:Decapsulatein key policies, use thekms:KeySpeccondition key to control which key specs can be created, and log every call with CloudTrail.
On cost, AWS KMS pricing charges $1 per month for each customer managed key, including asymmetric keys, plus per-request charges. Requests such as GetPublicKey on asymmetric keys are excluded from the 20,000-request free tier, so check current request pricing before high-volume use.
Post-quantum work touches IAM, networking and code at once. Our AWS security services team helps with cryptographic inventory and KMS key policy design, and our security, governance and compliance practice helps regulated businesses build an audit-ready roadmap.
Frequently Asked Questions
Which ML-KEM key spec should I choose in AWS KMS?
FIPS 203 lists ML-KEM-512, ML-KEM-768 and ML-KEM-1024 in order of increasing security strength and decreasing performance, so pick the level your compliance requirements call for. The key spec cannot be changed after the key is created.
Can AWS KMS encrypt data directly with an ML-KEM key?
No. ML-KEM keys use the ENCAPSULATE_DECAPSULATE key usage. They establish a 32-byte shared secret, which you then use with a symmetric algorithm such as AES-GCM to encrypt the actual data.
Is AWS KMS ML-KEM available in India?
Yes. AWS says ML-KEM is available in every Region where AWS KMS is available except Middle East (UAE), Middle East (Bahrain) and the China Regions, so the Mumbai and Hyderabad Regions are covered.
Do I need ML-KEM if AWS already uses post-quantum TLS?
They solve different problems. Hybrid post-quantum TLS protects traffic to AWS endpoints, while ML-KEM keys protect key exchange in your own applications and partner integrations.
Need Help Preparing for Post-Quantum Security?
Shanav Technologies helps startups and growing businesses build secure, compliant AWS environments, from KMS and IAM design to encryption reviews. If you want to know where your workloads are exposed to “harvest now, decrypt later” risk, talk to our team and we will help you plan a practical, low-risk post-quantum roadmap.