Crypto-Agility

There is a lock protecting almost everything you do online. When you log into your bank, share a health record, or send a work email, a mathematical lock scrambles that information before it travels across the internet. Only the intended recipient holds the key.

This system has worked reliably for decades. It works because the mathematics behind the lock is practically impossible to break with today's computers.

That is about to change — not immediately, but within a timeframe that engineers, policymakers, and researchers across Europe are treating with real urgency. And the time to act is not when quantum computers arrive. It is now.

This is the first post in the FOCAL Knowledge Series: a plain-language guide to the ideas behind one of Europe's most pressing digital security challenges.

What is crypto-agility?

According to the US National Institute of Standards and Technology (NIST), crypto-agility is "the capabilities needed to replace and adapt cryptographic algorithms for protocols, applications, software, hardware, and infrastructures without interrupting the flow of a running system to achieve resiliency."

In plain terms: a crypto-agile system can swap out its security methods without the organisation having to rebuild everything around it. A system that is not crypto-agile has the opposite property — the algorithm is hard-coded into the application, embedded in hardware, or woven into firmware in ways that make it effectively permanent until someone replaces the entire system.

NIST formalised this concept in December 2025 with the publication of CSWP 39 — "Considerations for Achieving Crypto Agility: Strategies and Practices" — a white paper specifically addressing how organisations and infrastructure providers can build the flexibility needed to adapt as cryptographic standards evolve.

Why "just update the software" is not the answer

The first instinct when cryptographic standards change is to treat it like any other software update. Download a patch, deploy it, move on.

This works in some environments. It does not work in most of the physical world.

Post-quantum cryptographic algorithms carry larger key sizes and require more computational work than their classical counterparts. An ML-KEM-768 public key is approximately 1,184 bytes — considerably larger than the RSA keys it may replace. Signatures under ML-DSA can reach several kilobytes. On a modern laptop or cloud server those differences are manageable. On a microcontroller in an industrial sensor, a satellite, or a medical device, they can make the difference between a system that works and one that does not.

Beyond raw size, there is the question of time. As Cisco noted in a 2026 analysis: "A network purchased today may still be operating in 2035." The average operational lifespan of industrial hardware, vehicles, and embedded systems routinely exceeds a decade. Any device being designed or procured now will almost certainly still be in use when the PQC transition is no longer optional.

The hardware dimension

Software-level crypto-agility — modular cryptographic libraries, algorithm-independent APIs — addresses much of the problem for systems with sufficient compute resources. The harder challenge is hardware.

Some chips are designed with a fixed cryptographic engine: purpose-built silicon that runs one algorithm efficiently but cannot be meaningfully reprogrammed. When the algorithm it was built for is deprecated, the chip becomes a security liability.

Field-Programmable Gate Arrays — FPGAs — offer a different approach. Unlike fixed chips, FPGAs can be reconfigured after manufacture. Their logic can be rewritten to run a different algorithm, support a new standard, or run multiple cryptographic schemes simultaneously. This makes them a practical foundation for crypto-agility in hardware: a device built on a reconfigurable chip can, in principle, adopt new cryptographic standards through a configuration update rather than a physical replacement.

Achieving genuine hardware crypto-agility at scale — across billions of constrained devices — remains an open engineering challenge. It is the kind of challenge that sits at the centre of FOCAL's research.

The standards guiding the transition

Crypto-agility is not just a design principle — it is increasingly a formal requirement embedded in published international standards. Understanding this landscape matters both for organisations planning their PQC migration and for engineers building the systems that will need to support it.

NIST (United States)

NIST published the three foundational PQC standards in August 2024: ML-KEM (FIPS 203) for key encapsulation, ML-DSA (FIPS 204) for digital signatures, and SLH-DSA (FIPS 205) for hash-based signatures. These are followed by NIST CSWP 39 (December 2025) on achieving crypto-agility, and NIST IR 8547 (November 2024) on managing the transition across protocols, software, and infrastructure. Together, these documents form the most comprehensive published framework for the PQC transition currently available.

IETF (Internet protocols)

The Internet Engineering Task Force has been rapidly integrating PQC into the protocols that underpin internet communications. Three significant RFCs have been published:

RFC 9794 (June 2025) establishes the common terminology for hybrid post-quantum schemes — the approach that combines a classical algorithm with a post-quantum one in the same handshake, so that the connection remains secure even if one of the algorithms is found to be compromised.

RFC 9954 (July 2026) defines a construction for hybrid key exchange in TLS 1.3 — the protocol responsible for securing the vast majority of web traffic.

RFC 10024 (August 2026) specifies three concrete hybrid mechanisms for TLS 1.3: X25519MLKEM768, SecP256r1MLKEM768, and SecP384r1MLKEM1024, each combining ML-KEM with a classical elliptic-curve algorithm. These are the mechanisms already being deployed by major internet infrastructure providers.

ETSI (European standards)

ETSI's Technical Committee on Cybersecurity has published a suite of deliverables directly relevant to crypto-agility. ETSI TR 104 016 (October 2024) provides "A Repeatable Framework for Quantum-Safe Migrations" — guidance designed explicitly so that organisations can structure the transition in a way they can repeat when the next round of cryptographic changes arrives. ETSI TR 103 966 (October 2024) covers "Deployment Considerations for Hybrid Schemes," addressing the practical questions that arise when running classical and post-quantum algorithms in parallel. ETSI TS 103 744 (updated March 2025) specifies "Quantum-Safe Hybrid Key Establishment" — the European technical standard for how hybrid key exchange should be implemented.

European Commission and UK NCSC

At the policy level, the European Commission's Recommendation C(2024) 2393 sets two binding milestones: EU Member States should begin their PQC transition by the end of 2026, and critical infrastructure should complete it by the end of 2030.

In the UK, the National Cyber Security Centre published its PQC migration roadmap in March 2025, calling for organisations to complete migration of their systems, services, and products to post-quantum cryptography by 2035.

The overall picture is one of coordinated, multi-layered momentum. Standards bodies on both sides of the Atlantic are publishing the technical frameworks. Policymakers are setting the deadlines. The question for most organisations is whether their infrastructure is designed to keep pace.

Why this matters specifically for the PQC transition

The current moment makes crypto-agility especially important for two related reasons.

First, the standards are still maturing. The three NIST PQC standards published in August 2024 are a stable foundation, but the process of integrating them into real-world protocols is ongoing, as the IETF work above illustrates. An organisation that hard-codes a specific post-quantum algorithm today — the way organisations once hard-coded RSA — will face the same migration problem again when the next round of changes arrives. As one analysis put it: "Crypto-agility is the real objective, not PQC adoption itself. The goal is an estate where changing an algorithm is a configuration change."

Second, the hybrid approach recommended by IETF and ETSI is itself temporary. Running classical and post-quantum algorithms in parallel is the right bridge strategy, but it adds computational overhead. As confidence in the post-quantum algorithms grows, the hybrid mode will eventually give way to pure PQC. Systems need to be capable of making that transition without a hardware overhaul.

Where FOCAL comes in

FOCAL's Work Package 2 focuses on hardware adaptability and crypto-agility — covering hardware acceleration and reconfigurability schemes and hybrid key management and crypto-agility methods. Within the consortium, CSEM leads directions related to hardware adaptation and crypto-agility, while NVIDIA contributes crypto-agility mechanisms focusing on network instrumentation.

The research explores how reconfigurable hardware can be designed to support multiple cryptographic schemes simultaneously — including the hybrid combinations now being standardised by IETF — and how these capabilities can be managed intelligently through software. FOCAL's Work Package 5, led by KPMG, specifically tracks the evolving standards and policy landscape, ensuring the technical research aligns with the frameworks being published by NIST, ETSI, and the European Commission.

These are research goals currently in development, not finished products. But they represent a concrete, engineering-level effort to close the gap between what the standards require and what today's physical infrastructure can actually deliver.

The bottom line

The post-quantum transition is not a one-time event. Cryptographic standards will continue to evolve — the IETF is already publishing the RFCs, ETSI is already publishing the deployment frameworks, and NIST has already published the white paper on how to make the transition repeatable.

The systems built today need to be able to move with those changes — without requiring the world's factories, vehicles, hospitals, and satellites to be rebuilt from scratch every time a standard is updated.

Crypto-agility is what makes that possible. Building it into hardware, not just software, is the part that takes the most work — and the most time.

This is Part 2 of the FOCAL Knowledge Series. Part 3 covers Trusted Execution Environments: the secure safe rooms inside your devices that are quietly protecting your most sensitive data — and why they are not yet quantum-safe.

Subscribe to the FOCAL newsletter at focal-pqc.eu to receive each post as it is published.