A federal contractor stores 7-year signed regulatory filings in S3 and must keep classical ECDSA verification working while adding quantum-resistant signatures for new filings with centralized key control and audit. Which post-quantum cryptography strategy using AWS KMS meets both requirements?
Select an answer to reveal the explanation.
Short Explanation
You get to keep what works while future-proofing, nice win. Dual signatures let verifiers check either path, and centralized keys keep control in KMS with full logging.
Full Explanation
ML-DSA is the NIST-standardized lattice-based signature algorithm designed for quantum resistance, and AWS KMS support lets you generate and use those private keys inside FIPS-validated HSMs without exporting key material, preserving centralized control, IAM authorization, and CloudTrail audit for every sign operation. Signing new filings with both existing ECDSA and new ML-DSA signatures provides backward compatibility for current validators while adding a quantum-resistant verification path stored alongside objects in S3. Using ML-KEM encapsulation keys for signing fails by concept because KEMs establish shared secrets for encryption rather than producing verifiable signatures. Relying on CloudHSM with rotation disabled fails by concept because it fragments custody and weakens hygiene without adding any post-quantum algorithm. Using S3-managed encryption fails by concept because server-side encryption provides confidentiality at rest, not origin authenticity or non-repudiation through signatures. For the exam, distinguish ML-DSA for signing from ML-KEM for key establishment, and in practice verify validator support for ML-DSA OIDs before enforcing PQC-only verification.