Home / Crypto-agility
Crypto-agility · cryptographic agility
Changing an algorithm should not be a project
Crypto-agility, also called cryptographic agility, is the ability of an organization and its systems to change cryptographic algorithms, parameters, keys and certificates without rewriting applications or stopping operations. It is the condition that makes post-quantum migration possible, and the one that keeps the next migration from becoming another emergency. Every Cyte encryption product, starting with Web-Armor, ships with it by default.
In one sentence: an organization is crypto-agile when the algorithm is a configuration parameter and not a line of code, when it knows where every key and certificate is, and when rotating them is an operational routine with a date on the calendar, not a project with a steering committee.
Rigid cryptography is technical debt
Historical cryptography was not designed to change. It was embedded in code with the algorithm, key size and format written by hand, and it is still there twenty years later. Every time an algorithm fell, the industry took years to replace it: MD5 and SHA-1 in certificates, 1024-bit RSA, 3DES in payments, SSLv3 and TLS 1.0 on the web. In every case the problem was not the new algorithm, which already existed, but finding and touching every place the old one lived.
Post-quantum migration is the largest of those changes, but it will not be the last. NIST itself selected HQC in 2025 as a backup to ML-KEM because the two rest on different mathematical assumptions: if an attack on lattices appeared tomorrow, everything would have to change again. Whoever migrates to post-quantum without crypto-agility will have paid twice for the same problem.
What NIST requires
NIST devoted a document of its own to crypto-agility, Cybersecurity White Paper 39 "Considerations for Achieving Crypto Agility" (2025), and made it a transition requirement in NIST IR 8547. The central idea is that systems must be able to update their algorithms and parameters through configuration, negotiate among several during the transition, and prove to auditors which ones they use and since when.
The European Union, in its 2025 coordinated roadmap, and the financial supervisors already asking for the post-quantum plan follow the same line: the cryptographic inventory and the ability to change are assessed together, because one without the other is useless.
The five principles of crypto-agility
Abstraction
The application asks to "encrypt" or "sign" without knowing which algorithm. The decision lives in a common cryptographic layer, not scattered across each system.
Configuration, not code
Algorithm, key size and mode are defined by policy and deployed without recompiling or rewriting. Moving from RSA to ML-KEM is a configuration decision.
Hybrid classical + PQC
During the transition, the same channel negotiates both the classical and the post-quantum algorithm. If one falls, the other holds; and interoperability with those who have not migrated yet is preserved.
Living inventory
A continuous CBOM that says, at any moment, which algorithm sits in which system protecting which data. Agility without an inventory is speed without a map.
Automated lifecycle
Scheduled key rotation and certificate renewal with no manual intervention, post-quantum ones included. What is done by hand is not done on time.
Continuous verification
The change is checked in production and measured again with the CBOM: agility is proven with evidence, not with a written policy.
How it is measured
Crypto-agility is a capability, and capabilities are measured. These are the indicators Cyte uses with its clients to know what maturity level they are at and how far there is to go.
- Time to replace an algorithm across the whole organization: from months or years to days.
- Percentage of systems whose cryptography changes through configuration rather than development.
- Percentage of certificates and keys with automatic renewal and rotation.
- CBOM age: how long since the inventory was last updated.
- Percentage of channels already negotiating in hybrid classical-plus-post-quantum mode.
- Number of cryptographic dependencies in code with no identified owner.
Web-Armor and every encryption product
Crypto-agility by default: how Cyte's products are built
Every Cyte encryption product is built on an in-house cryptographic core in which the algorithm is a configuration parameter, not a line of code in the application that uses it. Moving from RSA to ML-KEM, from ECDSA to ML-DSA or from ML-KEM to HQC is a policy decision deployed without touching the applications. That is why Cyte was able to take post-quantum cryptography into banking production a year before the standard existed, and why its clients will not have to rewrite anything when the next change comes.
Web-Armor is the most visible case: it adds hybrid ML-KEM encryption over TLS, end to end, and the algorithm is chosen by policy. In proxy mode the application does not change a single line, so the organization gains crypto-agility across an entire channel without a development project. The same principle applies to the rest of the family.
Web-Armor®
Hybrid ML-KEM encryption over TLS for web, Android and iOS. The algorithm is defined by policy and proxy mode deploys it without touching the application: crypto-agility across an entire channel, by default.
Crypto-Vault®
File and transaction encryption with configurable algorithms and managed keys: Colombia's ACH channel changed algorithms without a single bank rewriting its integration.
Crypto-Vault® Ultra
Managed file transfer where post-quantum and classical encryption coexist through configuration, with a record of which algorithm protected each transfer.
Fields-Encrypt®
Field-level encryption and tokenization with NIST-approved algorithms, swappable by policy and integrated with any HSM, without altering the applications that query the database.
Crypto-Vault® PDF
Document signing and encryption with configurable algorithms, so that today's signature remains verifiable when tomorrow's signature is post-quantum.
Notyfind®
It does not encrypt, but it makes lifecycle agility possible: it keeps the CBOM alive and renews certificates automatically, post-quantum ones included.
Hybrid: agility during the transition
The post-quantum transition does not happen on the same day across the whole chain. A bank can migrate its channel while a gateway, a correspondent or a customer still negotiates with elliptic curves. Hybrid mode resolves that asymmetry: the channel combines the classical algorithm with the post-quantum one and keeps talking to those who have not migrated, without giving up the new protection.
That is why hybrid is the practical expression of crypto-agility. A system that negotiates classical plus ML-KEM today will be able to negotiate ML-KEM plus HQC tomorrow, or post-quantum only when the regulator requires it, with the same configuration decision and the same CBOM verifying that it happened.
How Cyte solves it
Crypto-agility is not a product you buy or a project you run once: it is a capability. Cyte installs it with products that ship with it by default and with services that leave it in your team's hands.
Web-Armor®
Hybrid ML-KEM encryption over TLS with the algorithm set by policy. Crypto-agility by default in web and mobile applications.
Notyfind®
A living CBOM and automatic certificate renewal: the inventory and the lifecycle that agility needs.
Q-Safe suite
Every Cyte encryption product, with the NIST standards and built-in crypto-agility.
Quantum Center of Excellence
The quantum maturity ladder ends at the crypto-agility level: changing an algorithm is no longer a project, it is a routine.
Frequently asked questions
What is crypto-agility?
The ability to change cryptographic algorithms, parameters, keys and certificates without rewriting applications or stopping operations. It is also called cryptographic agility.
Is it the same as migrating to post-quantum cryptography?
No. Post-quantum migration is a specific change of algorithms; crypto-agility is the ability to make that change and the ones that follow. Migrating without crypto-agility solves the problem once; with it, you solve it for good.
Can crypto-agility be bought?
It is installed. It requires products whose algorithm is configurable, a living cryptographic inventory and automated rotation and renewal processes. Cyte's encryption products ship with it by default; the rest is built by the Center of Excellence together with your team.
What does it mean that Web-Armor has crypto-agility by default?
That the encryption algorithm, today hybrid ML-KEM over TLS, is defined by policy and changed through configuration, without touching the web or mobile application it protects. In proxy mode the code does not even need to be modified: the infrastructure provides the agility.
What is hybrid mode?
A key exchange or signature that combines a classical algorithm with a post-quantum one. If either falls, the other keeps the security, and the channel remains interoperable with those who have not migrated yet. It is the recommended way to transition.
How do I know whether my organization is crypto-agile?
Ask how long it would take to replace an algorithm across all your systems, how many of them would change it through configuration, and when your CBOM was last updated. If the answer to the first question is "I don't know", the starting point is the inventory.
Related articles
Our articles are published in Spanish.
Firma digital post-cuántica: por qué la seguridad de la información debe cambiar
¿Seguirá siendo válida tu firma digital en la era cuántica? Descubre cómo la criptografía post-cuántica protege la seguridad de la información y el no-repudio.
¿Por qué CI/CD pipeline dificulta la migración hacia la criptografía post-cuántica?
La deuda técnica en CI/CD pipeline puede impedir la migración hacia la criptografía post-cuántica. Descubra cómo preparar su software para la era Quantum Safe.
El reloj oculto de la ciberseguridad: Por qué la soberanía de tus datos hoy depende de la agilidad de mañana
Existe una divergencia matemática profunda: los aceleradores de hardware clásicos fueron diseñados para operaciones de potenciación modular (RSA) o multiplicación de puntos en curvas elípticas (ECC).
Parte 2: El camino hacia la resiliencia poscuántica y la criptoagilidad
Tras nuestra primera entrega sobre la "Radiografía del riesgo cuántico", es momento de continuar con las acciones que deben tomar las organizaciones colombianas para prepararse. No estamos ante un cambio de versión de software, estamos ante
HQC: Un nuevo estándar de criptografía post-cuántica basado en códigos
Este artículo presenta una revisión técnico divulgativa del algoritmo HQC (Hamming Quasi- Cyclic), recientemente estandarizado por el NIST como esquema de cifrado post-cuántico. Se describen los fundamentos matemáticos de la criptografía ba
The three pillars of post-quantum security
The cryptography that withstands the quantum computer
post-quantum cryptography replaces the mathematical problems a quantum computer solves quickly, such as factoring large numbers or computing discrete logarithms, with problems that neither classical nor quantum computers can solve, such as lattices and error-correcting codes.
Read the guide → CBOM · Cryptography Bill of MaterialsNobody migrates what they do not know they have
the CBOM is to cryptography what the SBOM is to software. It answers in minutes the question no bank wants to ask itself during an incident: if this algorithm falls, where am I using it?
Read the guide →See Web-Armor encrypting by policy
A demonstration of hybrid ML-KEM encryption over TLS with the algorithm as a parameter: crypto-agility by default, without touching your application.
