Did you know RDS for PostgreSQL already supports post-quantum TLS?
Hey everyone, it's me, Shii-chan! Today's news feels a little futuristic: it's about cryptography.
AWS What's New
aws.amazon.com
What was announced?
On the AWS What's New page, AWS announced that Amazon RDS for PostgreSQL now supports post-quantum TLS (PQ-TLS) key exchange. This gives you cryptography options for in-transit encryption that are designed to resist decryption by future quantum computers.
It's available on PostgreSQL 18 and higher, where you can change the ssl_groups parameter to select cryptographic groups from RDS for PostgreSQL's allow list that match your organization's security standards.
The story so far
Classical TLS key exchange algorithms aren't breakable by today's computers, but they could become vulnerable once practical quantum computers exist. That's fueled ongoing concern about "harvest now, decrypt later" attacks, where encrypted traffic is recorded today with the intent of decrypting it once quantum computing catches up.
What changes
If you're running PostgreSQL 18 or later, you can now switch to a post-quantum-resistant cryptographic group just by setting the ssl_groups parameter. You can create or update your database through the Amazon RDS Management Console or the AWS CLI. For teams handling data that needs long-term confidentiality, this is a new option to start hardening against future threats now.
Wrap-up
- RDS for PostgreSQL now supports post-quantum TLS key exchange
- Available on PostgreSQL 18+ via the
ssl_groupsparameter, with a choice of quantum-resistant cryptographic groups - Configure it through the RDS Management Console or the AWS CLI
- Classical TLS key exchange has long faced "harvest now, decrypt later" concerns
- Worth trying if your team cares about the long-term confidentiality of your data
