🔧 Agility Assessment
Cryptographic Agility Assessment
Determine which of your systems can swap cryptographic algorithms easily (agile), require code changes (semi-agile), or need architectural redesign (brittle). Cryptographic agility determines your migration cost and timeline.
Agile
Algorithm configurable without code changes. Change a config file or certificate and the new algorithm is in use. Low migration cost.
Migration: Days to weeks
Semi-Agile
Algorithm requires a code change, library update, or module replacement. Possible without redesign but requires development effort.
Migration: Weeks to months
Brittle
Algorithm is hardcoded or deeply embedded. Migration requires architectural redesign, vendor upgrade, or replacement of the system entirely.
Migration: Months to years
Common System Patterns — Agility Reference
| System / Component | Typical Agility | Why | Migration Complexity |
|---|---|---|---|
| Nginx / Apache TLS config | Agile | Algorithm suites are config file parameters. Updating openssl/liboqs and editing ssl_protocols is sufficient. | Low — days |
| Modern cloud load balancer (ALB, Cloudflare) | Agile | PQC is a toggle in cloud provider config. AWS and Cloudflare support hybrid PQC today. | Very Low — hours |
| Let's Encrypt / ACME certificates | Semi-Agile | Depends on ACME client and CA support. certbot needs update; CA needs to offer PQC certs. | Low-Medium — weeks |
| OpenSSH (version 9.0+) | Agile | PQC hybrid is a config option in sshd_config. Requires OpenSSH 9.0+ which most distros now ship. | Low — days |
| OpenSSH (version < 8.x) | Brittle | Needs upgrade to 9.0+ first. May be blocked by OS vendor support cycle. | Medium — months |
| VPN (StrongSwan) | Semi-Agile | StrongSwan supports PQC plugins. Requires recompilation or updated package. | Medium — weeks |
| Enterprise Java application (JCA/JCE) | Semi-Agile | Bouncy Castle JCE provider supports PQC. Drop-in replacement possible for well-written apps. | Medium — weeks to months |
| Python (cryptography library) | Semi-Agile | Needs OQS-Python or updated cryptography package. Straightforward for apps using standard crypto APIs. | Low-Medium |
| Node.js / JavaScript TLS | Agile to Semi | Node.js inherits OpenSSL — update Node.js and OpenSSL to OQS version. | Medium |
| Custom C/C++ with hardcoded OpenSSL calls | Semi to Brittle | Depends on how algorithms are referenced. If using algorithm IDs directly, moderate work. If hardcoded RSA functions, significant refactor. | Medium-High |
| IoT / embedded devices | Brittle | Often use hardcoded algorithms, lack OTA update capability, constrained compute for PQC lattice operations. | Very High — possible replacement |
| Legacy mainframe / COBOL systems | Brittle | Cryptography often embedded in vendor middleware. Migration requires vendor PQC roadmap. | Very High — vendor dependent |
| HSM (Hardware Security Module) | Brittle | Firmware-dependent. Most current HSMs do not support PQC. Replacement or firmware upgrade required. | High — 12–18 months typical |
| Smart cards / hardware tokens | Brittle | Fixed hardware cryptography. Replacement of all tokens required. | Very High — full replacement |
| PKI / internal CA (ADCS) | Semi to Brittle | Microsoft ADCS PQC support in development. Likely requires upgrade and CA hierarchy rebuild. | High |
| Kubernetes / service mesh (Istio, Linkerd) | Semi-Agile | mTLS certificate rotation is designed-in. PQC certificates require cert-manager update and CA support. | Medium |
| AWS KMS, Azure Key Vault | Agile (when vendor deploys) | Fully managed — PQC support is vendor responsibility. Monitor roadmap. | Very Low — vendor migration |
| Code signing (Authenticode, GPG) | Semi to Brittle | Depends on tooling. signtool.exe PQC support in development. GPG RFC 9580 adds PQC. | Medium-High |
System Agility Scorer
Answer questions for each system to get an agility classification and migration complexity estimate.