Every few years a cryptographic algorithm or key size has to be retired. In many organisations each change becomes a painful, multi-year project because algorithms are hard-coded throughout applications and devices. The post-quantum transition is the largest such change yet — and the best time to fix the underlying problem. The fix is called crypto-agility.
What is crypto-agility?
Crypto-agility is the ability to change cryptographic algorithms, parameters and keys quickly and safely, with minimal changes to applications. An agile system treats cryptography as a replaceable component governed by policy, rather than code scattered across thousands of places.
Signs you are not crypto-agile
- Algorithm names and key sizes appear directly in application code.
- Teams use many different cryptographic libraries and versions.
- Certificates are issued and renewed manually.
- Nobody can quickly answer “where do we use RSA-2048?”.
Architecture patterns that help
- Centralise cryptographic services. Use a small set of approved libraries, key-management services and hardware security modules, wrapped by internal APIs.
- Configuration over code. Algorithms and parameters come from policy or configuration, with sensible defaults.
- Automate certificates and keys. Short-lived certificates with automated issuance and rotation make algorithm changes routine.
- Negotiate, don’t assume. Protocols like TLS 1.3 negotiate algorithms; keep them up to date so new options (including hybrid post-quantum key exchange) can be enabled centrally.
- Inventory continuously. Treat a cryptographic bill of materials like a software bill of materials — generated in CI/CD and monitored over time.
Crypto-agility in DevOps pipelines
Add checks to CI/CD that flag deprecated algorithms and unapproved libraries, scan dependencies for cryptographic usage, and fail builds that introduce hard-coded keys. This keeps new technical debt out while the migration tackles the old.
Planning for larger keys and signatures
Post-quantum algorithms generally have larger public keys, ciphertexts and signatures than RSA or elliptic-curve equivalents. Agile systems test for the knock-on effects — packet sizes, certificate chains, storage fields, constrained devices — before rollout.
Where to start
- Pick one platform team and standardise its cryptographic libraries and key management.
- Automate certificate lifecycle management.
- Add cryptographic checks to your CI/CD pipelines.
- Pilot hybrid post-quantum TLS on a non-critical service to learn the operational impact.
See how our Quantum Computing and DevOps teams build crypto-agility into platforms and pipelines.
Frequently asked questions
What is crypto-agility?
Crypto-agility is the ability to replace cryptographic algorithms, parameters and keys quickly and safely, with minimal changes to applications, typically by centralising cryptography and driving it through configuration and policy.
Why does crypto-agility matter for post-quantum cryptography?
Migrating to post-quantum algorithms affects many systems. Crypto-agile architectures make that migration — and future ones — far faster and less risky.
How do I start becoming crypto-agile?
Standardise libraries and key management, automate certificate lifecycles, add cryptographic checks to CI/CD and build an up-to-date cryptographic inventory.