this post was submitted on 16 Jun 2026
1 points (100.0% liked)

Cryptography @ Infosec.pub

649 readers
1 users here now

Questions, answers, discussions, and literature on the theory and practice of cryptography

Rules (longer version here)

##Related resources;

founded 3 years ago
MODERATORS
top 2 comments
sorted by: hot top controversial new old
[โ€“] litchralee@sh.itjust.works 0 points 2 months ago* (last edited 2 months ago)

The paper PDF by the IBM researchers: https://arxiv.org/pdf/2606.13445v1

From just the abstract, I'm a bit alarmed that the researchers believe that "cryptographic agility" is reducible to a software engineering problem, rather than a complex function of regulatory (eg PCI-DSS), governmental (eg FIPS), and availability (eg hardware acceleration/support and robust implementations) considerations.

But even before all of those stakeholders get involved, is cryptographic agility still an operational objective? Sure, there's the matter of transitioning to PQ crypto, for scenarios where HNDL is a serious concern over the time horizon of whatever's at stake. But is that perceived as a one-time event, or is the idea that all future upgrades should be abstracted?

I find the latter a bit difficult to credibly believe, as the last major attempt at cryptographic agility was so thoroughly bungled that JWT alg:none has a website to highlight the problem.

Agility is only useful if it's actually moving forward: if instead it's an excuse to stand in place, then it's worse than nothing. Best I can tell, this paper seems to deal with abstraction of specific implementations of cryptographic libraries. So this would be akin to not binding directly to OpenSSL vs BearSSL, but having the ability to swap one out for the other.

In that more narrow sense, a lateral move like that is probably fine to abstract. But I can't see how this would fair well if used to shoehorn newer cryptography into applications that either are firmly dependent or are brittle in other, in-abstractable ways.

[โ€“] Natanael@slrpnk.net 0 points 2 months ago

Please find a better source than this, like the original announcement maybe

/signed, one of the moderators