A Framework for Cryptographic Agility
summary
Framework defines an abstract crypto API that replaces hardcoded algorithm choices with named key identifier plus metadata, adds key lifecycle with key transformation and versioning so a CISO can declaratively migrate ECDSA → MLDDSA without changing application code, and pushes decisions into a policy control plane tied to identity and access. Backends are pluggable (OpenSSL, Go crypto, PKCS#11 HSMs, cloud KMS), and the proposed workflow preserves verification of old signatures while enabling live migration.
AI-written summary · about
chapters (17)
- 0:00Cryptographic agility framework intro
- 1:26Building crypto roadmap
- 3:35Decoupling crypto from code
- 6:26Abstract crypto API
- 8:32Key lifecycle management
- 10:39Scope-based key policies
- 12:26Governance and identity
- 14:52Federated algorithm agility
- 15:55Backend flexibility
- 17:18Demo: crypto agile workflow
- 20:49Adoption path
- 21:52Q&A: backward compatibility
- 23:36Standardizing crypto agility
- 24:19Comparison with KMS
- 25:22Hardware crypto limits
- 26:25Policy separation benefits
- 27:30Closing remarks
related talks
13mEnabling Crypto Agility by Immunizing Processors Against the Exploitation of Software Bugs
26mCryptographic Agility: Preparing Modern Apps for Quantum Safety and Beyond
10mSecuring Multi-Cloud APIs Against Quantum Threats
34m"The Cryptography State of the Union"
46mAchieving Quantum Readiness: A Comprehensive Approach
39mKeynote: Towards High-Assurance Cryptographic Software
19mAgile is the new black – Why Preparing for Postquantum Crypto also Matters to You!
27mCoupling Key-Ring and Linux Crypto-API Framework(LCF) via Crypto-Transformation(tfm)