this post was submitted on 16 Jun 2026
2 points (100.0% liked)

Cryptography @ Infosec.pub

651 readers
1 users here now

Questions, answers, discussions, and literature on the theory and practice of cryptography

Rules (longer version here)

##Related resources;

founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] litchralee@sh.itjust.works 3 points 2 months ago* (last edited 2 months ago) (1 children)

The paper PDF by the IBM researchers: https://arxiv.org/pdf/2606.13445v1

From just the abstract, I'm a bit alarmed that the researchers believe that "cryptographic agility" is reducible to a software engineering problem, rather than a complex function of regulatory (eg PCI-DSS), governmental (eg FIPS), and availability (eg hardware acceleration/support and robust implementations) considerations.

But even before all of those stakeholders get involved, is cryptographic agility still an operational objective? Sure, there's the matter of transitioning to PQ crypto, for scenarios where HNDL is a serious concern over the time horizon of whatever's at stake. But is that perceived as a one-time event, or is the idea that all future upgrades should be abstracted?

I find the latter a bit difficult to credibly believe, as the last major attempt at cryptographic agility was so thoroughly bungled that JWT alg:none has a website to highlight the problem.

Agility is only useful if it's actually moving forward: if instead it's an excuse to stand in place, then it's worse than nothing. Best I can tell, this paper seems to deal with abstraction of specific implementations of cryptographic libraries. So this would be akin to not binding directly to OpenSSL vs BearSSL, but having the ability to swap one out for the other.

In that more narrow sense, a lateral move like that is probably fine to abstract. But I can't see how this would fair well if used to shoehorn newer cryptography into applications that either are firmly dependent or are brittle in other, in-abstractable ways.

[–] Natanael@slrpnk.net 1 points 2 months ago (1 children)

The value in cryptographic agility comes entirely from the ability to deprecate insecure algorithms, it does not come from the ability to add new algorithms because we can always do that with a version bump anyway.

Also, on the note of interfaces, KEM constructions can not be swapped in for most generic ECC key exchange functions due to different requirements on message round-trips.

[–] litchralee@sh.itjust.works 0 points 2 months ago

I recognize the term "cryptographic alacrity" to specifically include the deprecation of unsafe cryptography, to distinguish from "agility" that could may or may not deprecate old cryptography, thus allowing for fallback attacks to truly ancient cryptography. So yes, I think we're on the same page as to where the utility lays.