AWS publishes guide for ML-DSA quantum-resistant signing in software supply chains
Amazon Web Services released a two-part series detailing how to build and enforce post-quantum signing pipelines using NIST-standardized algorithms.
Key points
- AWS provides tools to implement Module-Lattice-Based Digital Signature Algorithm keys across its services.
- The US National Security Agency mandates quantum-resistant signatures for national security systems by 2030.
- The EU Cyber Resilience Act requires verifiable software integrity starting in December 2027.
Amazon Web Services published a two-part guide on October 2026 explaining how organizations can construct quantum-resistant software supply chains using Module-Lattice-Based Digital Signature Algorithm (ML-DSA) keys. The posts detail building signing pipelines and enforcing cryptographic policies within AWS environments.
The first post outlines an architecture combining AWS Key Management Service, AWS Private Certificate Authority, and IAM Roles Anywhere. This setup allows builders to sign binaries, container images, and software bills of materials with post-quantum signatures.
Regulatory and technical context
Traditional algorithms like RSA and ECDSA rely on mathematical problems that quantum computers could solve. If attackers capture signed artifacts today, they might forge signatures later using a cryptographically relevant quantum computer. This "harvest now, decrypt later" threat targets software integrity rather than just data confidentiality.
The US National Security Agency’s Commercial National Security Algorithm Suite 2.0 requires national security systems to prefer quantum-resistant signatures since 2025. Exclusive use is mandated by 2030. The EU Cyber Resilience Act also imposes strict integrity requirements effective in December 2027.
Implementation and policy enforcement
AWS Key Management Service supports three ML-DSA parameter sets: ML-DSA-44, ML-DSA-65, and ML-DSA-87. These correspond to NIST security categories 2, 3, and 5. ML-DSA-44 is the most compact, while ML-DSA-87 offers the largest security margin for long-lived artifacts.
The second post focuses on governance. It shows security teams how to use Service Control Policies and IAM to enforce algorithm choices. Organizations can block non-compliant parameter sets, ensuring only approved cryptographic standards are used across their cloud environments.
What should you do?
Organizations shipping software to US federal agencies or European markets should review their current signing mechanisms. Teams should evaluate which ML-DSA parameter sets fit their performance and security needs. Security teams should draft policies to enforce these choices using cloud governance tools.
What to do and how to stay safe: AWS
- Audit current software signing processes to identify reliance on RSA or ECDSA algorithms.
- Test ML-DSA signing workflows using AWS Key Management Service and Private Certificate Authority.
- Define organizational cryptographic policies specifying approved post-quantum parameter sets.
- Implement preventive controls to block non-compliant signing attempts in development pipelines.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which AWS services support ML-DSA keys?
AWS Key Management Service, AWS Private Certificate Authority, and IAM Roles Anywhere support ML-DSA keys for building quantum-resistant signing architectures.
What are the ML-DSA parameter sets available?
AWS supports ML-DSA-44, ML-DSA-65, and ML-DSA-87, corresponding to NIST security categories 2, 3, and 5 respectively.
When do regulatory deadlines for quantum-resistant signatures occur?
The NSA mandates exclusive use for national security systems by 2030, and the EU Cyber Resilience Act takes full effect in December 2027.
