View a markdown version of this page

Enable Post-Quantum Cryptography (PQC) on AL2023 - Amazon Linux 2023
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Enable Post-Quantum Cryptography (PQC) on AL2023

The system-wide cryptographic policies on AL2023 now supports post-quantum cryptography (PQC) via a new PQ subpolicy. After applying the PQ subpolicy, hybrid post-quantum key exchange using the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) and post-quantum digital signatures using the Module-Lattice-Based Digital Signature Standard (ML-DSA) will be enabled in the LEGACY, DEFAULT, FUTURE, or FIPS cryptographic policies.

AL2023 includes the following updated libraries with PQC support:

  • OpenSSL 3.5 added support for the ML-KEM hybrid key exchange algorithm, and ML-DSA (ML-DSA-44, ML-DSA-65, and ML-DSA-87) and SLH-DSA signature algorithms.

  • GnuTLS 3.8.10 supports ML-KEM hybrid key exchange algorithms and ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms for TLS communications.

  • NSS 3.112 introduced support for the ML-KEM hybrid key exchange algorithm and ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms for TLS communications.

Note

OpenSSH on AL2023 does not currently support ML-KEM hybrid key exchange algorithms.

For more information about Post-Quantum Cryptography on Amazon, see:

Prerequisites
Enable the PQ subpolicy on AL2023

  1. Ensure that the latest crypto-policies and crypto-policies-scripts packages are installed:

    sudo dnf -y install crypto-policies-scripts
sudo dnf -y update crypto-policies crypto-policies-scripts

  2. Use the update-crypto-policies command to enable the PQ subpolicy:

    sudo update-crypto-policies --set DEFAULT:PQ

  3. It is also possible to apply the PQ subpolicy to other policies, such as the LEGACY or FIPS policies, for example:

    sudo update-crypto-policies --set FIPS:PQ

  4. To check that you are using the PQ subpolicy, run the following command:

    update-crypto-policies --show

    For example, if you are using the DEFAULT policy you should see the following output:

    DEFAULT:PQ