HSM / PKCS#11 / Cloud KMS Key Exchange
What you will do: Pick AWS KMS, Google Cloud KMS or Azure, then a flow: the classical RSA import, or the HPKE import on the PKCS#11 v3.2, v3.3 draft or candidate CKM_HPKE engine. Press Run simulation and read the measured sizes and where the key sits at each step.
Worked example: On AWS KMS choose Classical import and run it: the wrapped blob is the RSA part plus the AES-KWP part, and the recovered key matches the original. Switch to HPKE (candidate), pick X-Wing and run: the message grows to enc plus ciphertext, protected by a post-quantum KEM. Everything is a simulation; no cloud call is made.
Runtime and privacy: The cryptographic exercise runs in this browser. Review the site privacy terms before entering sensitive material; use synthetic inputs for learning and evaluation.
Browse all Crypto Lab tools · Learn with KMS & PQC Key Management
Exchanging keys with a cloud KMS
Move a key from a third-party HSM into AWS KMS, Google Cloud KMS or Azure, first the way the providers document it today, then with HPKE and a post-quantum KEM. At each step you see which call is modelled, which PKCS#11 mechanism runs, how many bytes cross the wire and where the key sits.
Live HSM Mode Active
SoftHSM3 · PKCS#11 v3.2 · Rust · session open
AWS KMS: import key material under an RSA wrapping key
Documented by the provider
The third-party HSM wraps an EC P-256 private key under the RSA public key that AWS KMS issues for the import, and AWS KMS unwraps it inside its HSM.
Verdict. RSA-based wrapping is not quantum-safe: a recorded blob stays only as safe as the RSA key. The call itself can ride hybrid post-quantum TLS, which protects the connection and not the wrapped blob.
- Step 1 of 4Cloud provider
Get a wrapping key and an import token
GetParametersForImport
- KMS key created with KeySpec = ECC_NIST_P256 and Origin = EXTERNAL
- WrappingAlgorithm = RSA_AES_KEY_WRAP_SHA_256
- WrappingKeySpec = RSA_3072
The provider returns an RSA public key and an import token. In the simulation the in-browser HSM generates the RSA key pair; the private half stays in the HSM.
Where the key sits: Inside an HSMQuantum-safe: not applicable - Step 2 of 4Third-party HSM
Create the EC P-256 key to export
C_GenerateKeyPair (CKM_EC_KEY_PAIR_GEN)
- P-256
- CKA_EXTRACTABLE = true on the private key (so the wrap mechanism can read it)
A fresh EC P-256 key pair is created in the third-party HSM. The private key is the key to export. CKM_RSA_AES_KEY_WRAP wraps asymmetric target keys, which is why this run exports an EC private key and not an AES key.
Where the key sits: Inside an HSMQuantum-safe: not applicable - Step 3 of 4Third-party HSM
Wrap it under the provider’s public key
C_WrapKey
- mechanism = CKM_RSA_AES_KEY_WRAP
- RSA-OAEP, hash = SHA-256
- temporary AES key = 256 bits (simulation choice)
RSA-OAEP protects a temporary AES key, and AES-KWP (RFC 5649) wraps the private key under it. The blob is the RSA part followed by the KWP part.
Where the key sits: Wrapped, in transitQuantum-safe: no - Step 4 of 4Cloud provider
Import the wrapped key
ImportKeyMaterial
- EncryptedKeyMaterial = the wrapped blob
- ImportToken from the first step
The provider’s HSM unwraps the blob with the RSA private key. The simulation then checks that a signature made with the recovered key verifies under the original public key.
Where the key sits: Inside an HSMQuantum-safe: no
What AWS KMS documents
AWS KMS imports key material under an RSA wrapping key (RSA_2048, RSA_3072 or RSA_4096), or an SM2 wrapping key in the China Regions, and cannot import key material into ML-DSA or ML-KEM KMS keys.
AWS KMS offers ML-DSA signing keys (ML_DSA_44, ML_DSA_65, ML_DSA_87) and ML-KEM key-establishment keys (ML_KEM_512, ML_KEM_768, ML_KEM_1024).
Source: Post-quantum keys in AWS KMS
AWS added ML-KEM keys to AWS KMS on 26 October 2026; they are not available in the China, Middle East (UAE) and Middle East (Bahrain) Regions.
Source: AWS Key Management Service now supports ML-KEM for post-quantum key encapsulation
AWS KMS Encapsulate works only with the public key of a KMS ML-KEM key.
AWS KMS Decapsulate returns the 32-byte ML-KEM shared secret in plaintext to the calling application.
AWS KMS GenerateDataKeyPair can return ML-KEM data key pairs, with the private key in seed format, encrypted under a symmetric KMS key.
AWS KMS supports hybrid post-quantum TLS that combines ECDH with ML-KEM on its service endpoints.
AWS lists hybrid post-quantum key exchange as launched on FIPS and non-FIPS endpoints for AWS KMS, AWS Payment Cryptography and the AWS CloudHSM control plane.
AWS’s readiness page lists hybrid post-quantum key exchange for AWS KMS on FIPS and non-FIPS endpoints in commercial and US GovCloud Regions, while its AWS KMS infrastructure security page says hybrid post-quantum TLS is not supported on FIPS endpoints in AWS GovCloud (US). Check the current AWS pages for your Region before relying on post-quantum TLS there.
Try it
- 1. Predict before you run it.
- 2. Run or change the tool above.
- 3. Explain what the result shows.
Run AWS KMS, Classical import. What does the measured wrapped blob consist of?
Next step
Turn it into a plan: Infrastructure Modernization PlannerThis tool practises the KMS & PQC Key Management module, phase 6 (Infrastructure & Performance); Infrastructure Modernization Planner produces a deliverable of that phase.
Related content
Next in HSM / PKCS#11