View a markdown version of this page

Post-Quantum Cryptography (PQC) on AL2027 - Amazon Linux 2027
How to disable Post-Quantum Cryptography (PQC) on AL2027
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Post-Quantum Cryptography (PQC) on AL2027

AL2027 Preview

AL2027 is currently available for preview. It is intended for evaluation and testing only and is not recommended for production workloads.

The system-wide cryptographic policies on AL2027 enable post-quantum cryptography (PQC) by default. Most users will not need to change this default configuration.

AL2027 includes the following updated libraries and applications with PQC support:

  • OpenSSH enables Post-Quantum Cryptography (PQC) key exchange by default.

  • OpenSSL 3.5 added support for the ML-KEM hybrid key exchange algorithm, and ML-DSA (ML-DSA-44, ML-DSA-65, and ML-DSA-87) and SLH-DSA signature algorithms.

  • GnuTLS 3.8.10 supports ML-KEM hybrid key exchange algorithms and ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms for TLS communications.

  • NSS 3.124 supports the ML-KEM hybrid key exchange algorithm and ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms for TLS communications.

For more information about Post-Quantum Cryptography on Amazon, see Amazon Cloud Security > Post-Quantum Cryptography

How to disable Post-Quantum Cryptography (PQC) on AL2027

In some cases users may need to disable the use of post-quantum cryptography. The system-wide cryptographic policies provides the NO-PQ subpolicy to accomplish this. After applying the NO-PQ subpolicy, hybrid post-quantum key exchange using the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) and post-quantum digital signatures using the Module-Lattice-Based Digital Signature Standard (ML-DSA) will no longer be enabled in the LEGACY, DEFAULT, FUTURE, or FIPS cryptographic policies.

Prerequisites

  • An existing AL2027 Amazon EC2 instance.

  • You must connect to your Amazon EC2 instance using SSH or Amazon Systems Manager.

Enable the NO-PQ subpolicy on AL2027

  1. Ensure that the latest crypto-policies and crypto-policies-scripts packages are installed:

    sudo dnf -y install crypto-policies-scripts
sudo dnf -y update crypto-policies crypto-policies-scripts

  2. Use the update-crypto-policies command to enable the NO-PQ subpolicy:

    sudo update-crypto-policies --set DEFAULT:NO-PQ

  3. To check that you are using the NO-PQ subpolicy, run the following command:

    update-crypto-policies --show

    For example, if you are using the DEFAULT policy you should see the following output:

    DEFAULT:NO-PQ