KMS & PQC Key Management
Master PQC key management patterns: envelope encryption with ML-KEM, hybrid key wrapping, and cross-provider KMS strategies.
Why this matters: The KMS is where every other system's keys live — get PQC key management wrong at this layer and you've broken envelope encryption for everything downstream, not just one application.
Start here: Run the Envelope Encryption step: it wraps a data key with ML-KEM and with RSA-OAEP and lays the two stored envelopes side by side, with the size difference.
For your role
- Security Architect
- Design the three-level key hierarchy (root KEK, zone KEK, DEK), compare ML-KEM envelope encryption with RSA-OAEP wrapping, explore the X25519 plus ML-KEM-768 combiner per provider, and write an AWS KMS key policy that enforces hybrid PQC.
- Researcher / Academic
- The envelope-encryption comparison and the hybrid combiner step are the primitives, and the KMIP v3.0 step maps PQC key types across providers.
- IT Ops / DevOps
- Plan PQC key rotation with provider-specific strategies and compliance windows in Step 4, and the KMIP operations in Step 5: the KMS is where every downstream key lives.
- Curious Explorer
- A key-management system holds the keys that protect everything else; the module shows how a data key is wrapped and rotated, and what changes when the wrapping key goes post-quantum.
Post-quantum cryptography fundamentally changes how organizations manage keys. establishes that ML-KEM is a Key Encapsulation Mechanism only — it cannot sign. Similarly, ML-DSA is for signatures only — it cannot encapsulate. This strict algorithm separation replaces the dual-use nature of RSA, which could both encrypt and sign.
“A KEM can only establish a shared secret, not directly encrypt arbitrary data. Applications that relied on RSA PKCS#1 v1.5 or RSA-OAEP for direct encryption must adopt an envelope encryption pattern when migrating to ML-KEM.”
— NIST SP 800-227, Recommendations for Key-Encapsulation Mechanisms
- • RSA-OAEP: direct encryption of data/keys
- • RSA-PSS: digital signatures
- • One key pair serves both purposes
- • Simple key inventory: 1 key pair per entity
- • ML-KEM: key encapsulation only (KEM)
- • ML-DSA: digital signatures only
- • Two key pairs per entity minimum
- • Key inventory doubles during transition
| Algorithm | Public Key | Private Key | Sig / CT | Security |
|---|---|---|---|---|
| RSA-2048 | 256 B | 1,192 B | 256 B | Level 1 (classical) |
| RSA-3072 | 384 B | 1,766 B | 384 B | Level 1 (classical) |
| ECDSA P-256 | 65 B | 32 B | 64 B | Level 1 (classical) |
| ML-KEM-512 | 800 B | 1,632 B | 768 B | NIST Level 1 |
| ML-KEM-768 | 1,184 B | 2,400 B | 1,088 B | NIST Level 3 |
| ML-KEM-1024 | 1,568 B | 3,168 B | 1,568 B | NIST Level 5 |
| ML-DSA-44 | 1,312 B | 2,560 B | 2,420 B | NIST Level 2 |
| ML-DSA-65 | 1,952 B | 4,032 B | 3,309 B | NIST Level 3 |
| ML-DSA-87 | 2,592 B | 4,896 B | 4,627 B | NIST Level 5 |
PQC keys are significantly larger than classical equivalents — 4–10× vs RSA baselines, and up to 40× vs ECDSA P-256 — impacting HSM storage, certificate sizes, and network bandwidth during key distribution.
Related Resources
Products shown here are a representative selection — not an exhaustive list. For the full vendor landscape with PQC readiness status, visit the Tools & Products tab in this module or browse the Migrate catalog →
Design key hierarchies, visualize envelope encryption, and plan PQC rotation strategies.
Check off all sections and mark this reading done.
Related modules
- Homomorphic Encryption (FHE) & HSM Key CustodySame track · Hardware Infrastructure · Same migration phase · Shares ML-KEM, FIPS 203
- PQC Hardware AccelerationSame track · Hardware Infrastructure · Same migration phase · Shares ML-KEM, FIPS 203
- ACVP Lab Workflow: From Vector Set to EvidenceSame migration phase · Shares ML-KEM, FIPS 203
- HSM & PQC OperationsSame track · Hardware Infrastructure · Same migration phase · Shares ML-KEM
In the Industry Landscape
- Cloud Computing / Data CentersCloud KMS / BYOK key wrapping · Cloud HSM root keys & FIPS modules · Backup & disaster-recovery encryption
- Cryptocurrency / BlockchainBy protocol · Exchange & custody key management
- Finance & BankingBy protocol · HSM key management & wrapping
- Hardware Security ModulesBy protocol · PKCS#11 / KMIP interface migration
Check your understanding
15 questions on KMS & PQC Key Management, each with its answer and the reason.
Take the quizNext step
Practice it: Envelope EncryptionEnvelope Encryption is the hands-on version of this module: the same ideas, run in your browser.
Learning module content can be inaccurate. Please double-check its information. Report inaccuracies in PQC Today GitHub Discussions.