AWS Cryptography focuses research and engineering efforts on the continuation of providing cryptographic security for our customers, while developing new cryptographic systems that exceed current customers’ demands and protect against projected future adversaries. This document contains notes about the design of the Post-Quantum (PQ) Cryptography provided by AWS-LC, and documentation on our current PQ integrations.

In 2023 the U.S. Government passed the Quantum Computing Cybersecurity Preparedness Act, which creates requirements for government agencies to have a cryptographic inventory and plans to migrate to post-quantum (PQ) cryptography. These requirements extend to information technology providers like AWS. The NSA has also announced the Commercial National Security Algorithm Suite (CNSA) 2.0 that provides timelines for Cloud providers wishing to support National Security Systems, with support of PQ by 2025, and exclusively use PQ by 2033.

To support these initiatives, the U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) published three PQ algorithms as part of the Federal Information Processing Standards (FIPS):

• FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard
• FIPS 204: Module-Lattice-Based Digital Signature Standard
• FIPS 205: Stateless Hash-Based Digital Signature Standard

AWS-LC supports the post-quantum Key Encapsulation Mechanisms (KEMs) FIPS 203 ML-KEM and the post-quantum digital signature scheme FIPS 204 ML-DSA. For details on the KEM API and how it can be used please see README.

These three parameter sets were designed to meet security strength categories defined by NIST. These security strength categories are explained further in SP 800-57, Part 1. Concretely, ML-KEM-512 is claimed to be in security category 1, ML-KEM-768 is claimed to be in security category 3, and ML-KEM-1024 is claimed to be in security category 5.

Performance benchmarks for key generation, encapsulation, and decapsulation are included for ML-KEM within the speed tool. To run:

aws-lc-build % ./tool/bssl speed -filter ML-KEM

The parameter set ML-DSA-44 is claimed to be in security strength category 2, ML-DSA-65 is claimed to be in category 3, and ML-DSA-87 is claimed to be in category 5.

To utilize Post-Quantum key exchange in TLS we recommend using our open-source TLS implementation s2n-tls. However, AWS-LC libssl also supports Post-Quantum key exchange in TLS. Namely, ML-KEM-based cipher suites for TLSv1.3 (draft-kwiatkowski-tls-ecdhe-mlkem)

In addition, AWS-LC libssl supports "pure" ML-KEM cipher suites (https://datatracker.ietf.org/doc/html/draft-connolly-tls-mlkem-key-agreement.html).

PQ TLS is also available in the Java V2 SDK. Support for post-quantum algorithms is provided by AWS-LC when configured to use the AWS Common Runtime (CRT) library for TLS.