AWS Quietly Adds Post-Quantum Encryption to Guard Against Future Decryption Attacks

Adversaries can intercept and store today's encrypted internet traffic, then decrypt it later once powerful quantum computers become available — a strategy known as 'harvest now, decrypt later.' The key vulnerability lies in elliptic-curve Diffie-Hellman key exchange, which Shor's algorithm could eventually break, exposing session keys and all data transmitted over those connections. To counter this, AWS has been rolling out post-quantum cryptography across services like Secrets Manager, using a hybrid approach that combines the classical X25519 algorithm with ML-KEM-768, a lattice-based key encapsulation mechanism standardized by NIST as FIPS 203 in 2024. The hybrid design ensures that even if one algorithm is compromised, the session key remains protected by the other. AWS plans to phase out the earlier draft standard, CRYSTALS-Kyber, from its endpoints by 2026 in favor of the finalized ML-KEM standard.