Back to DashboardStrategyFoundationsintermediate40 min

Crypto Agility & Architecture Patterns

Design systems that can rapidly swap cryptographic algorithms — the key to PQC migration readiness.

Why this matters: The one certainty is that algorithms will change again; agility is what lets you swap them without re-architecting every system.

Start here: Toggle between the RSA-2048, ML-KEM-768 and X25519MLKEM768 backends in the Abstraction Layer demo: the application code never changes while the backend config flips to quantum-safe.

For your role

Executive / Business Leader: Score your organisation across four crypto-agility dimensions in the last step: the result says whether the next algorithm change is a configuration change or a rebuild.
GRC / Risk & Compliance: The scan of a sample enterprise for quantum-vulnerable algorithms and the four-dimension agility score are the two artefacts a governance review wants: what is exposed and how fast it can change.
Developer / Engineer: The first step shows algorithm-agnostic APIs swapping backends without code changes; the scanner then finds the hardcoded algorithms in a sample enterprise, which is what your codebase would look like.
Security Architect: Abstraction layers, CBOM scanning and the seven-phase migration framework are the design pattern; the agility score across four dimensions tells you which layer to fix first.
Researcher / Academic: The seven-phase framework and the four-dimension scoring model are stated explicitly; the module is the reference the rest of the curriculum's migration steps cite.
IT Ops / DevOps: Walk the seven-phase migration framework: it is the operating sequence the Command Center tools follow, and the scanner step shows what discovery has to find before rollout.
Curious Explorer: The one certainty is that algorithms will change again; this module shows, with a swap-the-backend demo, what it takes to be able to change them without rebuilding everything.

Practice in the Simulation

What is Crypto Agility?

is the ability to rapidly switch cryptographic algorithms, protocols, and implementations without significant changes to application code or infrastructure. It's NIST's top recommendation for PQC transition preparedness.

“Organizations should begin preparing for the migration to post-quantum cryptography by designing systems with cryptographic agility.”

— NIST IR 8547, November 2024

Algorithm Agility

Swap algorithms ( → ) via configuration changes, not code rewrites.

Protocol Agility

Support multiple protocol versions simultaneously ( 1.2/1.3, hybrid key exchange).

Implementation Agility

Switch between crypto providers (OpenSSL, BoringSSL, AWS-LC) without application changes.

Architecture Patterns

Crypto agility isn't just about code — it's an architectural decision. Organizations typically use one or more of these three macro-patterns to achieve agility:

Provider Model

Applications link to a crypto library through an abstraction API (like JCA or OpenSSL Providers). Agility is achieved at the application level via config changes.

App Code

↓

Provider API

↓

Algorithm

Service Mesh / Proxy

Cryptography for data-in-transit (mTLS) is completely offloaded to an infrastructure proxy (Envoy, Istio). Zero app code changes required.

App (Plaintext)

↔

Sidecar Proxy

↔

PQC Network

External /

Crypto operations are outsourced over the network to a central service (AWS KMS, Azure Key Vault). Upgrading the central KMS upgrades the enterprise.

App (API Request)

↔

Cloud KMS API

↔

Hardware Security Module

CBOM: Cryptographic Bill of Materials

Before you can migrate, you need to find every cryptographic algorithm in your organization. A provides this visibility using the CycloneDX standard.

What a CBOM tracks

• Algorithm name and key size
• Where it's used (component, service, protocol)
• Classical and quantum security levels
• Compliance framework requirements
• Migration recommendation

Tools for CBOM generation

• IBM Quantum Safe Explorer
• Keyfactor CBOM Generator
• InfoSec Global AgileSec
• Cryptosense Analyzer
• Manual audit + code scanning

7-Phase Migration Framework

migration follows a structured framework aligned with , CISA guidance, and NSA timelines. Each phase builds on the previous.

Assessment & Inventory

Discover all crypto assets, build CBOM

Risk Prioritization

Rank by data sensitivity and compliance

Preparation & Tooling

Select PQC-ready libraries and HSMs

Testing & Validation

Pilot hybrid deployments

Hybrid Migration

Deploy dual-algorithm configurations

Production Deployment

Full PQC across all systems

Monitoring

Continuous compliance and optimization

Industry Case Studies

Cloudflare

Enabled hybrid PQC key exchange (X25519Kyber768, later ) across its network in 2024. TLS handshake times increased ~4%; hybrid client key share is 1,216 bytes vs 32 bytes for X25519 alone.

Google Chrome

Enabled hybrid PQC key exchange (X25519Kyber768) by default in Chrome 124 (April 2024); upgraded to standardized X25519MLKEM768 in Chrome 131 (November 2024).

Apple

iMessage adopted PQ3 protocol (P-256 ECDH + Kyber-1024 initial keys, Kyber-768 rekeying ratchet — both now standardized as ML-KEM-1024 / ML-KEM-768 per FIPS 203) in iOS 17.4. Phased rollout leveraging protocol agility.