Where Is the Research on Cryptographic Transition and Agility?

Abstract

If prior cryptography transitions have taught the industry anything, it is that transitions can come on suddenly, take a decade to accomplish, and are far more difficult than the drop-in replacement challenge they look to be. Part of this is the scale at which changes need to occur; a global community of cryptography users must come together to do their part in updating software libraries and applications, various hardware features, industry best practices, and more. Part is also attributable to the complex trickledown effect in standardization whereby toplevel algorithmic standards coming from organizations like NIST need to be incorporated into domain-specific standards (TLS, PKI) that then need to be implemented and adopted across a complex web of software and hardware domains before full adoption can occur. In our view, however, there is a glaring gap in the mix: our cryptography does not come with frameworks that prepare us for and facilitate transition. Without them, the manual effort to make a transition becomes an overwhelming challenge, and one that tens of thousands of organizations worldwide, even with security savvy operations teams, struggle to put into practice.