AWS guides builders to ML-DSA quantum-safe signing for software integrity
New two-part series shows how to implement post-quantum signatures across AWS services to protect supply chains against future quantum computing threats.
Key points
- AWS outlines using ML-DSA keys in KMS and certificates in Private CA for signing binaries and SBOMs.
- Traditional algorithms like RSA and ECDSA could be broken by cryptographically relevant quantum computers.
- US and EU regulations set deadlines for adopting quantum-resistant signatures in software and firmware.
Amazon Web Services has published a technical guide on implementing Module-Lattice-Based Digital Signature Algorithm keys within its cloud infrastructure. The two-part series details how to construct and enforce post-quantum cryptographic standards for protecting software supply chains.
What happened
AWS Security Blog released Part 1 of a guide on building a quantum-resistant software supply chain using ML-DSA. The post explains how to combine ML-DSA keys from AWS Key Management Service with certificate hierarchies in AWS Private Certificate Authority. It also covers using trust anchors in AWS Identity and Access Management Roles Anywhere to sign binaries, container images, and software bills of materials.
Part 2 focuses on governance, showing security teams how to enforce algorithm policies using Service Control Policies and IAM controls. This series, published in October 2026, is described as the first end-to-end guide from a cloud provider for post-quantum signing across the supply chain.
Why it matters
Current digital signatures using RSA or ECDSA rely on mathematical problems that quantum computers could solve efficiently. The source warns of a "harvest now, forge later" threat where attackers record signed artifacts today to forge signatures later with a cryptographically relevant quantum computer. This risks software integrity rather than just data confidentiality. Regulatory pressures are increasing, with the US NSA requiring support for quantum-resistant signatures by 2030 and the EU Cyber Resilience Act taking effect in December 2027. These mandates compel organizations shipping to US federal agencies or selling in Europe to act now.
Next steps
- Review existing signing pipelines for reliance on RSA or ECDSA algorithms.
- Evaluate ML-DSA parameter sets based on security margins and signature size requirements.
- Implement policy controls to restrict algorithm choices within cloud environments.
- Plan for long-lifecycle firmware updates that cannot be recalled for re-signing.
Background: Digital signatures
Yes, digital signatures are legally binding in most jurisdictions, provided they meet specific technical and procedural standards. They must verify the signer’s identity, ensure the document has not been altered, and maintain a clear audit trail. Simple electronic marks lack this weight, while advanced cryptographic signatures offer the highest level of admissibility in court.
Read the full guide: Are digital signatures legally binding? The conditions for validity
What to do and how to stay safe: AWS
- Audit your software build systems to identify current digital signature algorithms in use.
- Consult vendor documentation for post-quantum cryptography support in key management services.
- Align cryptographic policies with upcoming regulatory deadlines for US and EU markets.
- Monitor official standards bodies for updates on NIST standardized signature schemes.
Step-by-step guide: Prevent Supply Chain Attacks: Practical Controls for Third-Party Risk
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the harvest now, forge later threat?
It is an attack where adversaries record signed software today to forge valid signatures on malicious code later using a quantum computer.
Which AWS services support ML-DSA?
AWS Key Management Service, AWS Private Certificate Authority, and AWS IAM Roles Anywhere support ML-DSA integration.
When do regulations require quantum-resistant signatures?
The US NSA mandates exclusive use by 2030, while the EU Cyber Resilience Act takes full effect in December 2027.
