View a markdown version of this page

Configure hybrid post-quantum TLS - Amazon Key Management Service
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Configure hybrid post-quantum TLS

In this procedure, add a Maven dependency for the Amazon Common Runtime HTTP Client. Next, configure an HTTP client that prefers post-quantum TLS. Then, create an Amazon KMS client that uses the HTTP client.

To see a complete working example of configuring and using hybrid post-quantum TLS with Amazon KMS, see the aws-kms-pq-tls-example repository on GitHub.

  1. Add the Amazon Common Runtime client to your Maven dependencies. We recommend using the latest available version.

    For example, this statement adds version 2.30.22 of the Amazon Common Runtime client to your Maven dependencies. Use version 2.30.22 or later to enable ML-KEM. 

    <dependency>
    <groupId>software.amazon.awssdk</groupId>
    <artifactId>aws-crt-client</artifactId>
    <version>2.30.22</version>
</dependency>

  2. To enable the hybrid post-quantum cipher suites, add the Amazon SDK for Java 2.x to your project and initialize it. Then enable the hybrid post-quantum cipher suites on your HTTP client as shown in the following example.

    This code uses the postQuantumTlsEnabled() method parameter to configure an Amazon common runtime HTTP client that prefers the recommended hybrid post-quantum cipher suite, ECDH with ML-KEM. Then it uses the configured HTTP client to build an instance of the Amazon KMS asynchronous client, KmsAsyncClient. After this code completes, all Amazon KMS API requests on the KmsAsyncClient instance use hybrid post-quantum TLS.

    // Configure HTTP client
SdkAsyncHttpClient awsCrtHttpClient = AwsCrtAsyncHttpClient.builder()
          .postQuantumTlsEnabled(true)
          .build();

// Create the Amazon KMS async client
KmsAsyncClient kmsAsync = KmsAsyncClient.builder()
         .httpClient(awsCrtHttpClient)
         .build();

  3. Test your Amazon KMS calls with hybrid post-quantum TLS.

    When you call Amazon KMS API operations on the configured Amazon KMS client, your calls are transmitted to the Amazon KMS endpoint using hybrid post-quantum TLS. To test your configuration, call an Amazon KMS API, such as ListKeys.

    ListKeysReponse keys = kmsAsync.listKeys().get();

    To confirm that your call used hybrid post-quantum TLS, inspect its CloudTrail log entry as described in Verifying Hybrid Post-Quantum TLS.