{"id":18647,"date":"2026-10-13T18:45:32","date_gmt":"2026-10-13T16:45:32","guid":{"rendered":"https:\/\/www.thegreenbow.com\/?post_type=resource&p=18647"},"modified":"2026-10-13T18:47:06","modified_gmt":"2026-10-13T16:47:06","slug":"crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it","status":"publish","type":"resource","link":"https:\/\/www.thegreenbow.com\/en\/ressource\/blog-en\/crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it\/","title":{"rendered":"Crypto-agility: the real question is no longer “which algorithm?” but “how do you change it?”"},"content":{"rendered":"\n
\n

Author : Arnaud DUFOURNET<\/strong>, Marketing & CX Director<\/p>\n\n\n\n

Post-quantum cryptography is gradually entering its operational phase. ML-KEM, ML-DSA and SLH-DSA have been standardized by NIST, HQC was selected in 2025 as a backup key-establishment mechanism, and the standardization of FALCON\/FN-DSA is still under way.<\/p>\n\n\n\n

But the competition is far from over. The list of algorithms selected today will probably have to change over the coming years, driven by advances in AI-accelerated cryptanalysis, standardization work and national recommendations.<\/p>\n\n\n\n

In the context of the transition to quantum-resistant cryptography, crypto-agility is proving all the more necessary. The question is therefore no longer simply which algorithm to choose<\/strong>, but above all how to be able to change it without rebuilding your entire information system<\/strong>.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Why crypto-agility is no longer optional<\/h2>\n\n\n\n

Choosing an algorithm today is no longer enough. A vulnerability discovered tomorrow in a widely deployed primitive could force a massive, simultaneous overhaul of every infrastructure that relies on it. This is one of the distinctive features of the post-quantum transition. The algorithms selected by NIST have certainly been tested by an international community of cryptography experts for several years, but their implementations are still young. We still lack the hindsight to fully validate their robustness. Organizations must therefore prepare to change cryptographic mechanisms, not just to select a new one.<\/p>\n\n\n

\n
\n
\n
\n
\n \n\n

HAWK: when a post-quantum algorithm has to be abandoned<\/strong><\/p>\n\n\n\n

At the end of July 2026, Anthropic researchers used the AI model Claude Mythos Preview to uncover a mathematical weakness in HAWK, a post-quantum signature algorithm that had nonetheless reached the third round of NIST’s additional signature standardization process. This cryptanalytic attack, which runs on classical computers, exploits a symmetry in the underlying Euclidean lattice and significantly reduces the scheme’s effective security without breaking it completely: it has only been demonstrated in practice on a small test parameter. Following this discovery, the HAWK team withdrew the algorithm from the digital signature standardization process. HAWK had been designed as a high-performance alternative to FALCON (FN-DSA, currently being standardized). The standards already finalized (ML-KEM, ML-DSA, SLH-DSA) are not affected, but the episode shows that a candidate can be weakened within a few days, after several years of analysis by the community.<\/p>\n\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n<\/section>\n\n\n\n

According to ANSSI (the French National Cybersecurity Agency), crypto-agility is the ability of a system to modify or replace any cryptographic component<\/strong><\/a> (libraries, hardware accelerators, keys, algorithms) over its lifetime, without altering its business functionality and while minimizing service interruption. The Agency recommends taking it into account from the design stage of future security products. NIST now devotes a dedicated document<\/a> to it, published in December 2025 and updated in June 2026, which analyzes approaches for replacing and adapting cryptographic algorithms while preserving security and operational continuity.<\/p>\n\n\n\n

The starting point: knowing what you have actually deployed<\/h2>\n\n\n\n

Before you can change your cryptography, you first need to know where it is used<\/strong>.<\/p>\n\n\n\n

Yet in many organizations, cryptography is embedded in a multitude of components without any centralized inventory: VPNs, TLS certificates, PKIs, smart cards, business applications, network equipment, industrial systems, connected devices, storage, backups, and more. A 2026 global study<\/a> conducted by the Ponemon Institute (for Entrust) among IT, security and risk leaders shows that only 43% of organizations have full visibility over their cryptographic assets.<\/p>\n\n\n\n

Which algorithms are in use? With which key sizes? For what purposes? On which equipment? Which certificates are about to expire? Which applications depend on a given PKI? This mapping is the starting point of any crypto-agility initiative. It can be structured as a CBOM (Cryptography Bill of Materials)<\/strong>, modeled on the SBOM that CISOs are now familiar with. Whereas the SBOM describes a system’s software components, the CBOM aims to provide visibility over its cryptographic assets: algorithms, key sizes, protocols, certificates, libraries and dependencies between systems.<\/p>\n\n\n\n

The goal is not simply to produce yet another document, but to have an actionable, regularly updated view<\/strong> of your cryptographic assets.<\/p>\n\n\n\n

From inventory to policy: the CryptoPolicy<\/h2>\n\n\n\n

Once the inventory is in place, the next step is to turn that knowledge into rules. A CryptoPolicy<\/strong> can, for example, define authorized or prohibited algorithms, minimum key sizes, preferred mechanisms for specific uses, and the deadlines by which certain components must evolve.<\/p>\n\n\n\n

Above all, the challenge is to make this policy an operational and consistent<\/strong> rule. A cryptographic policy that stays in a governance document offers no guarantee that the same requirements are actually applied across the entire information system.<\/p>\n\n\n\n

Three levels of action can be distinguished:<\/p>\n\n\n\n

    <\/ol>\n\n\n\n
      \n
    • Configuration<\/strong>: changing the cryptographic parameters of an existing solution without modifying its code. For example, ML-KEM offers three standardized parameter sets, ML-KEM-512, ML-KEM-768 and ML-KEM-1024, making it possible to tailor the security level to the needs of each use case.<\/li>\n\n\n\n
    • Software implementation<\/strong>: integrating a new cryptographic algorithm or mechanism into an application or solution that does not yet support it. For example, adding FrodoKEM support to a VPN client that until now has used only ML-KEM.<\/li>\n\n\n\n
    • Update and distribution<\/strong>: rolling out these changes at scale without manual intervention on each system. For example, applying a new cryptographic policy or a new version of the VPN client to several thousand endpoints from a centralized management console.<\/li>\n<\/ul>\n\n\n\n

      It is this last level that truly turns crypto-agility into an operational capability.<\/p>\n\n\n\n

      <\/p>\n\n\n\n

      Equipping crypto-agility for day-to-day operations<\/h2>\n\n\n\n

      For a CISO, the challenge is therefore very concrete: how long would it take to roll out a change to the cryptographic policy across several thousand endpoints?<\/p>\n\n\n\n

      If each endpoint has to be handled manually, crypto-agility remains theoretical. Conversely, a centralized architecture makes it possible to distribute a new policy, change cryptographic parameters or trigger an update without intervening individually on each device.<\/p>\n\n\n\n

      This is precisely the approach TheGreenBow aims to offer with Bowrealis Console: by centralizing the administration of VPN clients, it can serve as a control point for managing and evolving cryptographic configurations across the entire fleet.<\/p>\n\n\n\n

      NIST and security agencies are pushing for diversity among quantum-resistant algorithms. By 2030, the deadline by which sensitive information systems must be secured against the quantum threat, the family of algorithms will have grown. Organizations must therefore be ready to juggle them and be able to carry out replacements without operational disruption.<\/p>\n\n\n\n

      The post-quantum transition should therefore not be seen as a one-off project that simply replaces current cryptography with a new algorithm. This project is expected to take 5 to 10 years and represents a very deep transformation: making the information system capable of evolving with cryptography<\/strong>.<\/p>\n\n\n\n

      Crypto-agility is precisely what turns this constraint into a lasting capability. An organization that can inventory its cryptographic assets, define a policy and deploy it at scale will be able to evolve its security mechanisms faster, without having to launch a new migration project every time. Better equipped, it remains resilient in the face of changing threats, standards and recommendations.<\/p>\n<\/div>\n","protected":false},"featured_media":18646,"template":"","meta":{"_acf_changed":true,"resource_type":"internal"},"resource_category":[342],"class_list":["post-18647","resource","type-resource","status-publish","has-post-thumbnail","hentry","resource_category-blog-en"],"acf":[],"yoast_head":"\nCrypto-agility: the real question is no longer "which algorithm?" but "how do you change it?" - TheGreenBow<\/title>\n<meta name=\"description\" content=\"Post-quantum standards will keep evolving. Here\u2019s how to make crypto-agility operational: inventory, CryptoPolicy and centralized management.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.thegreenbow.com\/en\/ressource\/blog-en\/crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Crypto-agility: the real question is no longer "which algorithm?" but "how do you change it?" - TheGreenBow\" \/>\n<meta property=\"og:description\" content=\"Post-quantum standards will keep evolving. Here\u2019s how to make crypto-agility operational: inventory, CryptoPolicy and centralized management.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.thegreenbow.com\/en\/ressource\/blog-en\/crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it\/\" \/>\n<meta property=\"og:site_name\" content=\"TheGreenBow\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-13T16:47:06+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.thegreenbow.com\/wp-content\/uploads\/2026\/10\/Crypto-Agilite_lite-2-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1437\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@thegreenbow\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.thegreenbow.com\\\/en\\\/ressource\\\/blog-en\\\/crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it\\\/\",\"url\":\"https:\\\/\\\/www.thegreenbow.com\\\/en\\\/ressource\\\/blog-en\\\/crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it\\\/\",\"name\":\"Crypto-agility: the real question is no longer \\\"which algorithm?\\\" but \\\"how do you change it?\\\" - TheGreenBow\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.thegreenbow.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.thegreenbow.com\\\/en\\\/ressource\\\/blog-en\\\/crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.thegreenbow.com\\\/en\\\/ressource\\\/blog-en\\\/crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.thegreenbow.com\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/Crypto-Agilite_lite-2-scaled.jpg\",\"datePublished\":\"2026-10-13T16:45:32+00:00\",\"dateModified\":\"2026-10-13T16:47:06+00:00\",\"description\":\"Post-quantum standards will keep evolving. Here\u2019s how to make crypto-agility operational: inventory, CryptoPolicy and centralized management.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.thegreenbow.com\\\/en\\\/ressource\\\/blog-en\\\/crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.thegreenbow.com\\\/en\\\/ressource\\\/blog-en\\\/crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.thegreenbow.com\\\/en\\\/ressource\\\/blog-en\\\/crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.thegreenbow.com\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/Crypto-Agilite_lite-2-scaled.jpg\",\"contentUrl\":\"https:\\\/\\\/www.thegreenbow.com\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/Crypto-Agilite_lite-2-scaled.jpg\",\"width\":2560,\"height\":1437},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.thegreenbow.com\\\/en\\\/ressource\\\/blog-en\\\/crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.thegreenbow.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Blog\",\"item\":\"https:\\\/\\\/www.thegreenbow.com\\\/en\\\/resources\\\/blog-en\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Crypto-agility: the real question is no longer \u00ab\u00a0which algorithm?\u00a0\u00bb but \u00ab\u00a0how do you change it?\u00a0\u00bb\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.thegreenbow.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.thegreenbow.com\\\/en\\\/\",\"name\":\"TheGreenBow\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.thegreenbow.com\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.thegreenbow.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.thegreenbow.com\\\/en\\\/#organization\",\"name\":\"TheGreenBow\",\"url\":\"https:\\\/\\\/www.thegreenbow.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.thegreenbow.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.thegreenbow.com\\\/wp-content\\\/uploads\\\/2021\\\/04\\\/Logotype@2x-min.png\",\"contentUrl\":\"https:\\\/\\\/www.thegreenbow.com\\\/wp-content\\\/uploads\\\/2021\\\/04\\\/Logotype@2x-min.png\",\"width\":422,\"height\":84,\"caption\":\"TheGreenBow\"},\"image\":{\"@id\":\"https:\\\/\\\/www.thegreenbow.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/thegreenbow\",\"https:\\\/\\\/fr.linkedin.com\\\/company\\\/thegreenbow\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCZKtI7_fmgFcmovgGSy8AnQ\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Crypto-agility: the real question is no longer \"which algorithm?\" but \"how do you change it?\" - TheGreenBow","description":"Post-quantum standards will keep evolving. Here\u2019s how to make crypto-agility operational: inventory, CryptoPolicy and centralized management.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.thegreenbow.com\/en\/ressource\/blog-en\/crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it\/","og_locale":"en_US","og_type":"article","og_title":"Crypto-agility: the real question is no longer \"which algorithm?\" but \"how do you change it?\" - TheGreenBow","og_description":"Post-quantum standards will keep evolving. Here\u2019s how to make crypto-agility operational: inventory, CryptoPolicy and centralized management.","og_url":"https:\/\/www.thegreenbow.com\/en\/ressource\/blog-en\/crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it\/","og_site_name":"TheGreenBow","article_modified_time":"2026-10-13T16:47:06+00:00","og_image":[{"width":2560,"height":1437,"url":"https:\/\/www.thegreenbow.com\/wp-content\/uploads\/2026\/10\/Crypto-Agilite_lite-2-scaled.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_site":"@thegreenbow","twitter_misc":{"Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.thegreenbow.com\/en\/ressource\/blog-en\/crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it\/","url":"https:\/\/www.thegreenbow.com\/en\/ressource\/blog-en\/crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it\/","name":"Crypto-agility: the real question is no longer \"which algorithm?\" but \"how do you change it?\" - TheGreenBow","isPartOf":{"@id":"https:\/\/www.thegreenbow.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.thegreenbow.com\/en\/ressource\/blog-en\/crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it\/#primaryimage"},"image":{"@id":"https:\/\/www.thegreenbow.com\/en\/ressource\/blog-en\/crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it\/#primaryimage"},"thumbnailUrl":"https:\/\/www.thegreenbow.com\/wp-content\/uploads\/2026\/10\/Crypto-Agilite_lite-2-scaled.jpg","datePublished":"2026-10-13T16:45:32+00:00","dateModified":"2026-10-13T16:47:06+00:00","description":"Post-quantum standards will keep evolving. Here\u2019s how to make crypto-agility operational: inventory, CryptoPolicy and centralized management.","breadcrumb":{"@id":"https:\/\/www.thegreenbow.com\/en\/ressource\/blog-en\/crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.thegreenbow.com\/en\/ressource\/blog-en\/crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.thegreenbow.com\/en\/ressource\/blog-en\/crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it\/#primaryimage","url":"https:\/\/www.thegreenbow.com\/wp-content\/uploads\/2026\/10\/Crypto-Agilite_lite-2-scaled.jpg","contentUrl":"https:\/\/www.thegreenbow.com\/wp-content\/uploads\/2026\/10\/Crypto-Agilite_lite-2-scaled.jpg","width":2560,"height":1437},{"@type":"BreadcrumbList","@id":"https:\/\/www.thegreenbow.com\/en\/ressource\/blog-en\/crypto-agility-the-real-question-is-no-longer-which-algorithm-but-how-do-you-change-it\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.thegreenbow.com\/en\/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https:\/\/www.thegreenbow.com\/en\/resources\/blog-en\/"},{"@type":"ListItem","position":3,"name":"Crypto-agility: the real question is no longer \u00ab\u00a0which algorithm?\u00a0\u00bb but \u00ab\u00a0how do you change it?\u00a0\u00bb"}]},{"@type":"WebSite","@id":"https:\/\/www.thegreenbow.com\/en\/#website","url":"https:\/\/www.thegreenbow.com\/en\/","name":"TheGreenBow","description":"","publisher":{"@id":"https:\/\/www.thegreenbow.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.thegreenbow.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.thegreenbow.com\/en\/#organization","name":"TheGreenBow","url":"https:\/\/www.thegreenbow.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.thegreenbow.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.thegreenbow.com\/wp-content\/uploads\/2021\/04\/Logotype@2x-min.png","contentUrl":"https:\/\/www.thegreenbow.com\/wp-content\/uploads\/2021\/04\/Logotype@2x-min.png","width":422,"height":84,"caption":"TheGreenBow"},"image":{"@id":"https:\/\/www.thegreenbow.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/thegreenbow","https:\/\/fr.linkedin.com\/company\/thegreenbow","https:\/\/www.youtube.com\/channel\/UCZKtI7_fmgFcmovgGSy8AnQ"]}]}},"_links":{"self":[{"href":"https:\/\/www.thegreenbow.com\/en\/wp-json\/wp\/v2\/resource\/18647","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thegreenbow.com\/en\/wp-json\/wp\/v2\/resource"}],"about":[{"href":"https:\/\/www.thegreenbow.com\/en\/wp-json\/wp\/v2\/types\/resource"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thegreenbow.com\/en\/wp-json\/wp\/v2\/media\/18646"}],"wp:attachment":[{"href":"https:\/\/www.thegreenbow.com\/en\/wp-json\/wp\/v2\/media?parent=18647"}],"wp:term":[{"taxonomy":"resource_category","embeddable":true,"href":"https:\/\/www.thegreenbow.com\/en\/wp-json\/wp\/v2\/resource_category?post=18647"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}