What Crypto-Agility Is
Crypto-agility is the capability to replace cryptographic algorithms, parameters, processes, and technologies in deployed systems without disrupting normal operation and without introducing new security risks. NIST CSWP 39 (December 2025 draft) formalized the definition after a decade of industry use.
Why It Matters for PQC
The shift from RSA/ECC to ML-KEM/ML-DSA is the largest cryptographic migration of the 21st century. Most systems were not designed with crypto-agility in mind. Retrofitting it is expensive; building it in for new systems is cheap.
The Four Pillars of Crypto-Agility
- Abstraction: cryptographic primitives behind stable interfaces (PKCS#11, JCA, OpenSSL provider, libsodium).
- Negotiation: protocols that can negotiate algorithms (TLS 1.3, Noise).
- Inventory: continuous discovery of cryptographic dependencies.
- Governance: policy for deprecating weak algorithms.
How to Build It
- Use well-designed cryptographic libraries (liboqs-OpenSSL, Botan 3, AWS-LC, BoringSSL).
- Avoid hardcoding algorithm choices; configuration-driven selection.
- Protocol design: TLS 1.3 key_shares with multiple groups. SSH with multiple KEX algorithms.
- Tokenization: wrap data encryption keys with DEKs that can be re-encapsulated under new algorithms.
- Certificate management: hybrid and cross-signed certificates.
- Code signing: multi-signature schemes supporting legacy + PQC.
Common Anti-Patterns
- Hardcoded OIDs for RSA in custom protocols.
- Stored ciphertexts with algorithm choice in non-modifiable headers.
- Key management systems that cannot express new algorithm families.
- Client or agent software that cannot be updated in the field.
What NIST CSWP 39 Says
NIST's formal definition is worth quoting: "The capabilities needed to replace and adapt cryptographic algorithms, parameters, processes, and technologies without introducing unacceptable security risks and without disrupting the normal operation of systems and business processes." The CSWP emphasizes that crypto-agility must be designed in rather than retrofit, and that transition plans are a governance deliverable.
Frequently Asked Questions
Is crypto-agility a product?
No. It is an architectural discipline. Products can support it (libraries, KMS, protocol implementations) but crypto-agility is a property of the overall system.
How much crypto-agility is enough?
Enough to execute a Post Quantum Cryptography migration within 3-5 years without service disruption. Systems requiring 10+ year replacement cycles should be redesigned for crypto-agility.
Does TLS 1.3 have crypto-agility?
Yes. Key_shares, cipher_suites, and signature_algorithms are all negotiated. New PQ algorithms can be added without protocol changes.
What is NIST CSWP 39?
NIST Cybersecurity White Paper 39, published December 2025 as a draft. Formalizes the definition and framework for crypto-agility.
Sources
Related Articles
Protect Your Data Before Q-Day Arrives
QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.
Try QNSQYOriginally published at quantumsequrity.com/blog/crypto-agility-explained.