Crypto agility · Post-quantum cryptography · Security architecture

Crypto Agility
Is Not a Slogan

Everyone likes the phrase crypto agility. Almost no one can actually show it.

I keep coming back to one simple test that separates a post-quantum migration from a post-quantum strategy.

“When the next algorithm change arrives—and it will—do we have to rebuild everything again?”

If the answer is yes, we're just migrating. If the answer is no, we've built something that lasts: crypto agility.

The difference isn't effort. It's architecture.

Change Is Part of the Design

Algorithms fail. That is not a theoretical risk; it is recent history.

In 2022, a serious post-quantum candidate called SIKE was broken on a single CPU core in roughly an hour for its level-one parameter set.

NIST has therefore built diversity into its post-quantum portfolio. It standardised lattice-based ML-KEM and ML-DSA and hash-based SLH-DSA in 2024, then selected code-based HQC in 2025 as a future backup for ML-KEM. HQC has been selected for standardisation; its final standard is still in development.

Hybrid modes that combine classical and post-quantum algorithms are an important transition tool, but they do not remove the need to design for further change. For U.S. National Security Systems, CNSA 2.0 transition milestones run through 2030–2035. Other organisations will follow their own regulatory and risk-driven timelines, and the standards will continue to evolve.

This is not a one-off project. It is a permanent capability we either build now or keep paying for every few years.

Brittleness Hiding in Plain Sight

Look around any real environment and the brittleness is obvious:

• Algorithms hardcoded into source
• Certificate-validation logic that has evolved differently in every team
• Old devices that support only a narrow set of cipher suites
• Third-party platforms that hide key-management details
• Documentation that says only ‘TLS’ without recording the version, suites, library or certificate profile actually in use

“That's not agile. That's brittle, waiting for the next update to break.”

What Crypto Agility Actually Looks Like

The real work is quieter and more deliberate:

• Algorithm choice lives in configuration and policy, not scattered through statements that bind application logic to RSA or another primitive.
• Applications call ‘sign this’ or ‘establish a key’ through a clean interface; they do not reach for a specific primitive themselves.
• Well-designed protocols and formats carry algorithm identifiers so both sides can negotiate, and new identifiers can appear without breaking existing implementations.
• Size assumptions are removed. PQC keys, signatures and certificates are larger, and may change again; fixed-length database columns and buffers are migration risks.
• A living inventory tracks certificates, keys, protocols, libraries and deprecated algorithms, with a clear owner for every exception.
• The exit is tested, not hoped for.

Can we replace a certificate chain without downtime? Turn off a weak algorithm from a central point? Find every system still using a particular library? Move one service to a new algorithm in a controlled pilot and prove it worked?

If the answer to any of those is “we'd have to redeploy half the estate,” the roadmap is still just theory.

One Concrete Step This Month

Pull your architects into a one-hour tabletop:

“A critical flaw is announced in ML-KEM tomorrow. What do we change, where, and how long does it actually take?”

Then go further. In non-production, actually change one certificate profile, one TLS setting or one algorithm parameter.

Write down the steps, the owners, the evidence it worked and the rollback plan. Every time someone says “we'd have to redeploy X,” that becomes a backlog item with a name on it.

“Could your estate swap a signature algorithm today without touching application code?”

Sources

• NIST Post-Quantum Cryptography Standardization
• NIST: HQC announced as a fourth-round selection
• NSA Post-Quantum Cybersecurity Resources
• Castryck and Decru: An efficient key recovery attack on SIDH