Secure supply chains: AWS details ML-DSA signing for NSA and EU compliance

Amazon Web Services has published a two-part series explaining how organizations can construct quantum-resistant software supply chains using the Module-Lattice-Based Digital Signature Algorithm (ML-DSA). The guides demonstrate how to integrate ML-DSA keys from AWS Key Management Service, certificate hierarchies from AWS Private Certificate Authority, and trust anchors from AWS Identity and Access Management Roles Anywhere into a unified signing architecture for binaries and container images.

The risk

Traditional digital signature algorithms like RSA and ECDSA rely on mathematical problems that a cryptographically relevant quantum computer could solve efficiently. According to the AWS Security Blog, this creates a "harvest now, forge later" threat where attackers record signed artifacts today and forge signatures on different artifacts in the future. This integrity threat parallels the confidentiality threat to encrypted data, allowing unauthorized code injection or fabrication of build attestations if legacy signatures are broken.

Who is exposed

Organizations shipping software to US federal agencies or selling products in the European market face converging regulatory deadlines. The US National Security Agency requires National Security Systems to support and prefer quantum-resistant signatures since 2025, with exclusive use mandated by 2030. The EU Cyber Resilience Act takes full effect in December 2027, requiring manufacturers to maintain verifiable software integrity throughout a product’s lifecycle, impacting embedded devices with long operational lifetimes.

Cost and compliance

AWS Key Management Service supports three ML-DSA parameter sets: ML-DSA-44, ML-DSA-65, and ML-DSA-87, targeting NIST security categories 2, 3, and 5. ML-DSA-44 offers the smallest signature and key sizes, while ML-DSA-65 and ML-DSA-87 provide larger security margins for long-lived artifacts. AWS states that as of October 2026, this series is the first end-to-end cloud provider guide for post-quantum signing across the software supply chain, covering both builder pipelines and governance controls.

Our take on the response

AWS provides a clear technical path for adopting post-quantum cryptography before regulatory deadlines force compliance. By separating the builder’s implementation guide from the security team’s enforcement policy, the company acknowledges that cryptographic standardization requires both engineering effort and organizational governance to prevent legacy algorithm drift.

What to do and how to stay safe: AWS

• Audit current software signing processes to identify use of RSA or ECDSA algorithms that are vulnerable to quantum decryption.
• Review AWS documentation for ML-DSA-44, ML-DSA-65, and ML-DSA-87 parameter sets to determine which fits your performance and security requirements.
• Configure AWS Key Management Service and Private Certificate Authority to generate and manage ML-DSA keys and certificates for your build pipelines.
• Implement IAM Roles Anywhere trust anchors to enforce ML-DSA verification for software artifacts deployed to your infrastructure.

Step-by-step guide: Multi-Factor Authentication Fatigue: Why Users Click Yes Too Fast

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which AWS services support ML-DSA quantum-resistant signing?

AWS Key Management Service, AWS Private Certificate Authority, and AWS Identity and Access Management Roles Anywhere support ML-DSA integration.

What is the deadline for quantum-resistant signatures in US National Security Systems?

Exclusive use of quantum-resistant signatures is mandated for US National Security Systems by 2030 according to NSA guidelines.

Does AWS support all NIST ML-DSA parameter sets?

Yes, AWS KMS supports ML-DSA-44, ML-DSA-65, and ML-DSA-87, which correspond to NIST security categories 2, 3, and 5.