AWS Builder Center

Builder Center

Testing TLS Connections with Post-Quantum Cryptography using s2nc

Step-by-step guide to building s2nc from aws-lc and s2n-tls, testing quantum-resistant TLS connections to AWS services similarly you would use OpenSSL s_client for cryptographic validation.

Schnidrig, Christoph

As quantum computing advances, the threat of "harvest now, decrypt later" attacks grows—adversaries are capturing encrypted traffic today to decrypt once quantum computers become powerful enough. AWS's response is a modern cryptographic stack combining aws-lc  and s2n-tls  that support PQC (post-quantum cryptography)
aws-lc provides general-purpose cryptography (derived from BoringSSL/OpenSSL) with traditional primitives (AES, SHA, RSA, ECDSA) plus NIST post-quantum algorithms (ML-KEM, ML-DSA). s2n-tls implements TLS 1.3 on top, enabling hybrid post-quantum key exchange and authentication. This split delivers FIPS-validated quantum resistance today, positioning the stack ahead of traditional OpenSSL for future-proof deployments.
In this post, I'll show you how to build and use s2nc—the command-line TLS client from s2n-tls (similarly to openssl s_client) —to test post-quantum connections to AWS services.

Building s2nc with AWS-LC

Prerequisites

First, install the necessary build dependencies on an Amazon Linux 2023 instance.
Note: Use at least a t3.small instance, as t3.micro has insufficient memory for compilation.
1
2
# install build dependencies
sudo yum install ninja-build cmake3 clang perl golang

Step 1: Compile AWS-LC

1
2
3
4
5
6
7
8
9
10
11
$ git clone https://github.com/aws/aws-lc

$ cd aws-lc && \
mkdir build && \
cd build && \
cmake3 -G Ninja \
-DBUILD_SHARED_LIBS=ON \
-DCMAKE_INSTALL_LIBDIR=lib \
-DCMAKE_INSTALL_PREFIX=/lc-install .. && \
cmake3 --build . && \
sudo cmake3 --install .

Step 2: Build s2n-tls with AWS-LC Integration

1
2
3
4
5
6
7
8
9
10
11
12
$ cd
$ git clone https://github.com/aws/s2n-tls.git

$ cd s2n-tls && \
build s2n-tls \
cmake3 . -Bbuild \
-DCMAKE_BUILD_TYPE=Release \
-DCMAKE_INSTALL_PREFIX=./s2n-tls-install \
-DCMAKE_PREFIX_PATH=/lc-install
cmake3 --build build -j $(nproc)
CTEST_PARALLEL_LEVEL=$(nproc) ctest --test-dir build
cmake3 --install build

Testing Post-Quantum TLS Connections

Once built, you can test connections to AWS services with post-quantum cryptography enabled. Here's an example connecting to AWS Key Management Service:
1
2
$ cd /home/ec2-user/s2n-tls/build/bin
$./s2nc -c default_pq kms.eu-central-2.amazonaws.com
Example output:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
libcrypto: AWS-LC 1.66.2
CONNECTED:
Handshake: NEGOTIATED|FULL_HANDSHAKE|MIDDLEBOX_COMPAT
Client hello version: 33
Client protocol version: 34
Server protocol version: 34
Actual protocol version: 34
Server name: kms.eu-central-2.amazonaws.com
KEM Group: X25519MLKEM768 (PQ key exchange enabled)
Cipher negotiated: TLS_AES_256_GCM_SHA384
Server signature negotiated: RSA-PSS-RSAE+SHA256
Early Data status: NOT REQUESTED
Wire bytes in: 6276
Wire bytes out: 1609
s2n is ready
Connected to kms.eu-central-2.amazonaws.com:443
Notice the KEM Group: X25519MLKEM768 line, which indicates that post-quantum key exchange is enabled. In TLS 1.3, the key exchange mechanism and encryption algorithms are independent, allowing for hybrid approaches that combine classical and post-quantum algorithms.
# security-and-compliance# security# encryption
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article