AWS directconnect high security documentation change
Summary
Added bold formatting to key terms and introduced a new 'Key Distribution Channel' concept with security recommendations for TLS 1.3 and post-quantum ML-KEM algorithm during CKN-CAK association
Security assessment
Explicitly recommends quantum-resistant encryption (ML-KEM) and TLS 1.3 for key distribution, addressing future cryptographic vulnerabilities against quantum computing attacks
Diff
diff --git a/directconnect/latest/UserGuide/MACsec.md b/directconnect/latest/UserGuide/MACsec.md index fe462ef9d..dcdbca386 100644 --- a//directconnect/latest/UserGuide/MACsec.md +++ b//directconnect/latest/UserGuide/MACsec.md @@ -25 +25 @@ The following are the key concepts for MACsec: - * MAC Security (MACsec) — An IEEE 802.1 Layer 2 standard that provides data confidentiality, data integrity, and data origin authenticity. For more information about the protocol, see [802.1AE: MAC Security (MACsec)](https://1.ieee802.org/security/802-1ae/). + * **MAC Security (MACsec)** — An IEEE 802.1 Layer 2 standard that provides data confidentiality, data integrity, and data origin authenticity. For more information about the protocol, see [802.1AE: MAC Security (MACsec)](https://1.ieee802.org/security/802-1ae/). @@ -29 +29 @@ The following are the key concepts for MACsec: - * Connectivity Association Key Name (CKN) and Connectivity Association Key (CAK) — The values in this pair are used to generate the MACsec key. You generate the pair values, associate them with an Direct Connect connection, and then provision them on your edge device at your end of the Direct Connect connection. Direct Connect supports only static CAK mode but not dynamic CAK mode. Since only static CAK mode is supported, it's recommended that you follow your own key management policies for key generation, distribution, and rotation. + * **Connectivity Association Key Name (CKN)** and **Connectivity Association Key (CAK)** — The values in this pair are used to generate the MACsec key. You generate the pair values, associate them with an Direct Connect connection, and then provision them on your edge device at your end of the Direct Connect connection. Direct Connect supports only static CAK mode but not dynamic CAK mode. Since only static CAK mode is supported, it's recommended that you follow your own key management policies for key generation, distribution, and rotation. @@ -32,0 +33,2 @@ The following are the key concepts for MACsec: + * **Key Distribution Channel** — To deliver a new CKN-CAK pair to AWS, use the AWS Console or the Direct Connect CLI or SDK using `associate-mac-sec-key`. We recommend you only use TLS 1.3 and enforce a post-quantum key exchange algorithm such as ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism) when associating a new CKN-CAK pair with your dedicated connection. For more information, review the AWS [SDK and CLI guides](https://docs.aws.amazon.com/sdkref/latest/guide/pqtls-details.html). When using the AWS Console, use a web browser that supports ML-KEM and review the connection security. +