Ready for post quantum.
Crypto agility as an architectural principle, not an emergency migration.
The transition to post quantum cryptography is a frequent topic of conversation, and it is often framed as an urgent future migration: one day, every algorithm will have to be replaced. For a signing platform, that way of looking at it is dangerous. Preparation does not begin when the change arrives, but in how the system is designed today so that switching algorithms becomes a routine operation.
What is already known
In 2024, NIST published its first post quantum cryptography standards, including two for digital signatures, and the transition in real world systems will take years. The technical series on this blog explains the fundamentals; here we are interested in the architectural consequence. There are three fronts a signing platform must address.
- New signatures. Being able to produce signatures with new algorithms once providers, formats and validators support them.
- Existing signatures. Keeping what is signed today valid, by renewing archive timestamps with current algorithms before the earlier ones weaken.
- Coexistence. Accepting, for years, classical, post quantum and hybrid signatures, and validating all of them.
Principles of crypto agility
- Inventory. Know which algorithms are used, where, and for which documents.
- Algorithms as configuration. The choice of algorithm depends on policy and on the provider, not on hard coded logic.
- Signing delegated to connectors. If signatures are produced by providers through connectors, adopting a new algorithm means adding or updating a connector.
- Validation with maintained libraries. Active open source validation libraries will add new algorithms as they are standardized in the formats.
- Active preservation. Periodic renewal of archive timestamps, which is the defense that already works for what is signed today.
Post quantum readiness in a signing platform is an architectural principle: an inventory of algorithms, algorithms as configuration, signing delegated to connectors, validation with maintained libraries, and active preservation. That is how today's signatures are protected and tomorrow's are adopted without rebuilding the system.