What Is Crypto-Agility?
CyberRank Research
Crypto-agility is the ability to change cryptographic algorithms, key sizes and certificates without redesigning the system that uses them. It depends on centralised cryptographic libraries, algorithm choice set by configuration, and an accurate inventory. It decides how fast you can move to post-quantum cryptography. CyberRank shows, from the outside, which of your vendors' public services have already switched (Beta).
TL;DR
- Crypto-agility means swapping algorithms by configuration or a library update, not by rewriting applications.
- Post-quantum migration and later changes, such as backup algorithms like HQC, are far cheaper for crypto-agile systems.
- CyberRank's quantum-crypto exposure check (Beta) shows which vendors' public services already offer post-quantum or hybrid key exchange.
What does crypto-agility look like in practice?
An agile system keeps cryptography in one place, makes the algorithm a setting, and knows where every key and certificate is used.
Most systems were built assuming RSA or elliptic-curve cryptography would last. Algorithms hard-coded into application code, firmware or protocols then have to be found and rewritten one by one. Post-quantum migration is the first change where that cost hits almost every organisation and vendor at once, as explained in our main article on post-quantum third-party risk.
| Practice | What it means | Why it matters for PQC | How CyberRank helps |
|---|---|---|---|
| Central cryptographic services | What it meansApplications call one shared library or service instead of their own code | Why it matters for PQCOne update moves many applications to ML-KEM or ML-DSA | How CyberRank helpsShows the result on public services after the switch |
| Algorithm as configuration | What it meansAlgorithm and key size are settings, not constants in code | Why it matters for PQCHybrid modes such as X25519MLKEM768 can be enabled per service | How CyberRank helpsReports which key exchange each public service negotiates (Beta) |
| Cryptographic inventory (CBOM) | What it meansA record of algorithms, keys, certificates and libraries in use | Why it matters for PQCYou cannot migrate what you cannot find | How CyberRank helpsGives an outside-in starting point for vendors' public services |
| Performance headroom | What it meansSystems tolerate larger keys, signatures and handshakes | Why it matters for PQCPost-quantum keys and signatures are larger | How CyberRank helpsNot measured; test this in your own environment |
| Tested rollback | What it meansA change can be reversed without an outage | Why it matters for PQCStandards are still moving, with HQC and FN-DSA to come | How CyberRank helpsTracks vendor posture over time, so regressions show |
Why does crypto-agility matter beyond the first migration?
Because post-quantum cryptography is not the last change: NIST is still adding algorithms, and some implementations will need fixing.
NIST has selected HQC as a backup key encapsulation algorithm and is finalising FN-DSA for signatures. Immature implementations and misconfigured hybrid modes will need patches. A system that can only change by redesign pays the migration cost again each time.
Agility also limits harvest-now-decrypt-later exposure, because the faster key exchange can change, the shorter the window in which recorded traffic stays breakable, as explained in our short answer on harvest now, decrypt later.
How CyberRank helps: nightly reassessment of monitored vendors shows when a vendor's public services change algorithm, and whether a change sticks.
What does crypto-agility mean for Indonesian organisations?
BSSN is preparing a national post-quantum migration roadmap for 2027 to 2035, and its migration framework starts with inventory and risk assessment, the same foundations crypto-agility needs.
For organisations regulated by BSSN, OJK or sector authorities, the practical step is to require crypto-agility in new procurement now: configurable algorithms, a supplier CBOM and a named post-quantum date. Systems bought in 2027 will still be running in 2035. More on the agency is on our BSSN regulation page.
How CyberRank helps: an outside-in view of vendors supports the inventory and monitoring phases, as described in the guide to post-quantum cybersecurity risks and vendors.
Where CyberRank does not help
CyberRank cannot see how a vendor's code is structured, whether algorithms are hard-coded inside applications or firmware, or whether a CBOM exists. It observes only what public TLS and SSH services negotiate. Crypto-agility is an internal engineering property; assess it with architecture reviews, vendor questionnaires and contract terms.
References
Frequently asked questions
Check your vendors' quantum exposure
See which vendors already offer post-quantum or hybrid key exchange, with the post-quantum cryptography assessment.
Check your vendors' quantum exposure