ANSSI views on crypto agility

Présentation

Since the early 2000s, a large number of cryptographic algorithms have become deprecated, either due to security issues or because more efficient algorithms have emerged. Nevertheless, many of these algorithms are still in use today for reasons of backward compatibility or due to a lack of flexibility in secure systems.

Crypto-agility is the ability of a system to modify its cryptographic components dynamically without significantly affecting the system’s capabilities.

With the growth of post-quantum cryptography, the need for crypto-agility is even more pronounced, as there is regular progresses in both performance and cryptanalysis. The emergence of quantum computers forces industry players to implement algorithms whose maturity is not yet sufficient, and crypto-agility is the most reliable means of ensuring the long-term viability of a system.

This note, intended for developers and system architects, provides a definition of crypto-agility as well as general recommendations for incorporating crypto-agility into the design of an information system from the start.