What is crypto-agility and why does it matter more than choosing the algorithm?

As of November 5, 2026: crypto-agility is the capacity to replace a cryptographic algorithm without breaking the systems that use it — and the dated record says that capacity matters more than which algorithm you pick. In 2022, two schemes in the late rounds of NIST's own post-quantum selection fell to classical attacks on ordinary hardware: Rainbow, a Round 3 finalist, in an average of 53 hours on a laptop (IACR ePrint 2022/214, 2022-02-25), and SIKE, 25 days after advancing to Round 4, in about 10 minutes on a single core (IACR ePrint 2022/975, 2022-07-30). Quantum computers, meanwhile, have broken 0 RSA-2048 keys in the public record (re-verified 2026-11-05). And the one measured precedent for removing a broken primitive from deployed systems — SHA-1 — will have taken 13 years from its first practical collision (2017-02-23) to NIST's removal deadline (2030-12-31). Rosetta Quantum reads that record one way: the algorithm you choose today may change; the measured bottleneck is your capacity to change it.

What exactly is crypto-agility?

Crypto-agility is, in NIST's own definition, the set of capabilities needed to replace and adapt cryptographic algorithms in protocols, applications, software, hardware and infrastructures — while preserving security and ongoing operations. That definition comes from NIST CSWP 39, Considerations for Achieving Crypto Agility: Strategies and Practices, finalized on 2025-12-19 and updated on 2026-06-29. It is the first time NIST has published a dedicated practices document for agility, and its existence is itself a signal: the US standards body does not treat the post-quantum transition as a one-time swap, but as the first of several.

The idea is older than the post-quantum migration. The IETF published its algorithm-agility guidelines — RFC 7696, elevated to Best Current Practice 201 — in November 2015, after the MD5 and SHA-1 experiences showed that protocols which hard-code one algorithm age badly. The guidance is one sentence long at its core: protocols and systems will be designed so that algorithms can be identified, negotiated and replaced without redesigning the system around them.

What changed in 2026 is that agility stopped being advice and started appearing inside transition clocks. NIST IR 8547, final since 2026-10-27, will deprecate RSA and ECC after 2030 and disallow them after 2035. The UK NCSC timeline (2025-03-20) asks organizations to complete discovery by 2028 and the full migration by 2035. Those dates are declared deadlines, not measurements — in this house's semantics, they are ocher, not teal — but they all assume the same thing: that the systems being migrated can, in fact, swap algorithms. The record below says that assumption is the hard part.

Why is picking the right algorithm not enough?

Because the selection record shows that even the shortlist of the most scrutinized cryptographic competition in history contained breakable entries — and they were broken by classical computers, not quantum ones. Rosetta Quantum treats these two dates as the core exhibit of the whole agility argument:

Read the first two rows carefully, because the details are the lesson. Rainbow had been a finalist for 19 months when Ward Beullens published a key-recovery attack that runs over a weekend on a laptop. SIKE is the sharper case: NIST announced its first four selected algorithms and the four Round 4 candidates on 2022-07-05; Wouter Castryck and Thomas Decru posted their attack on 2022-07-30 — 25 days later — and the final version breaks SIKEp434, the parameter set aimed at security level 1, in about 10 minutes on one core. Neither attack used a quantum computer. Both schemes exited the process; NIST's August 2024 standards — ML-KEM, ML-DSA and SLH-DSA, covered in their own piece in this series — were built from the candidates that survived.

The honest conclusion is not that post-quantum cryptography is fragile. It is that cryptanalysis does not announce itself in advance, and that the correct unit of planning is not the algorithm but the capacity to replace the algorithm. A future piece in this series will take the SIKE and Rainbow stories apart in full — what exactly broke, and why that argues for hybrids rather than panic.

How long does replacing deployed cryptography actually take?

The paper layer reacts in months; the deployed layer takes a decade or more, and SHA-1 is the measured proof. The first collision attacks against SHA-1 were published in 2005 — NIST's own retirement announcement dates the vulnerability there. The first practical collision, SHAttered, was demonstrated on 2017-02-23. NIST announced the retirement plan on 2022-12-15, with the hash to be phased out of all US federal use by 2030-12-31. From practical break to removal deadline: 13 years. From first attack to removal deadline: 25 years. Nothing in that interval was mysterious — the algorithm was known-broken the whole time; what took 13 years is everything around it: inventories, dependencies, vendors, firmware, protocols, procurement.

That asymmetry is the entire case for agility, and it is why the migration clocks are as long as they are. When NIST IR 8547 gives RSA and ECC until 2030 to be deprecated and 2035 to be disallowed, it will not be because anyone expects those algorithms to fall tomorrow — the public record still shows 0 RSA-2048 keys broken by any quantum computer, and the classical factoring record stands at RSA-896 (S. Weis, 2026-09-19). It is because removing a primitive from the installed base is the slow operation, and the clock has to start before the threat is measured. That is the same arithmetic Michele Mosca formalized — migration time plus data lifetime against time-to-threat — which the harvest-now-decrypt-later piece in this series works through with numbers. On when a cryptographically relevant quantum computer will exist, Rosetta's position remains the sealed, refutable judgment RQ-PRED-QDAY-001 — floor 2031, window 2033 to 2039 — published with its scoring rule; it is a judgment, not a measurement, and it changes nothing about the removal math above.

What is hybrid key exchange, and what does it insure?

Hybrid key exchange is agility already deployed: it combines a classical algorithm and a post-quantum one in the same handshake, so that the connection stays secure if either of the two falls. The dominant combination, X25519MLKEM768, pairs the classical X25519 curve with ML-KEM-768. Chrome has shipped the ML-KEM hybrid by default since version 131 in November 2024 (announced 2024-09-17 on Google's security blog, replacing the earlier Kyber draft hybrid). OpenSSL 3.5.0, released 2025-04-08, ships ML-KEM, ML-DSA and SLH-DSA and makes X25519MLKEM768 a default key share. Signal moved its initial handshake to the hybrid PQXDH on 2023-09-19; Apple shipped PQ3 in iMessage on 2024-02-21. Measured at the network: about 70% of browser-generated human HTTPS traffic on Cloudflare's network already negotiates post-quantum key agreement (Cloudflare, 2026-09-29) — the full series, from 29% in January 2025, is in the adoption piece of this series — while only about 15% of scanned origin servers support it (same source and date).

The agility reading of hybrid is the important one: hybrid is what engineering looks like when you assume your newest algorithm might fail. If ML-KEM were ever broken, hybrid connections would fall back to X25519's classical security rather than to nothing; if RSA-era cryptanalysis of X25519 arrives first, ML-KEM holds. SIKE is the argument made flesh — a scheme that looked strong enough for Round 4 and died in 25 days. The mechanics of the hybrid handshake, its byte costs and who ships it where will get their own piece in this series.

What did NIST itself do about agility?

NIST bought insurance with its own selection — which is the strongest institutional endorsement agility has received. On 2025-03-11 it selected HQC as a fifth algorithm and a backup to ML-KEM, stating the reason plainly: a backup standard based on a different mathematical approach — error-correcting codes rather than structured lattices — so that a single cryptanalytic advance cannot take out the only standardized KEM. The draft is expected for public comment in 2026 and the final standard in 2027; those dates are declared, and this series will check them when they land, not before. Add CSWP 39 itself — a practices catalog for building systems where algorithms are configuration, not architecture — and the pattern is consistent: the body that picked the algorithms is engineering for the possibility that it picked wrong.

What should a security team do with this?

The board translates into four moves, none of which requires believing any particular Q-Day date. First, inventory before anything: you cannot swap what you have not found, and the CBOM piece in this series shows every major framework since 2022 puts discovery first — with the measured caveat that CISA's own strategy (2024-08-15) found only 3 of 9 required inventory fields are auto-collectable with current tools. Second, make agility a procurement question: NIST CSWP 39 is, among other things, a question list for vendors — can the product negotiate algorithms, can it be updated in the field, is the cryptography configurable or compiled in. A vendor answer of the form "we will be quantum-safe" without a swap mechanism is a claim about the first algorithm, not about the second one. Third, take the hybrid defaults where your stack already offers them — browsers, TLS libraries and CDNs shipped them between 2023 and 2025, so for much of the perimeter this is configuration, not construction. Fourth, put the declared dates on your own calendar as deadlines to verify against — 2030 and 2035 from NIST IR 8547, 2028 from the NCSC, the US federal deadlines from the executive-order piece — because they will arrive whether or not the threat does.

PQC Board — status as of 2026-11-05

The standing indicators this engine re-measures every run. Two rows were re-verified today; the rest show their most recent dated reading.

What we don't know

• Whether the HQC final standard will land in 2027 as NIST expects. The date is declared, not measured; this series will record it when it happens.
• How long a real enterprise algorithm swap takes end to end. We found no published measurement with declared methodology as of 2026-11-05 — and the GAO reported in October 2026 that none of 24 US agencies reviewed had completed the full inventories such a measurement would start from.
• Whether more standardized or late-round PQC schemes will fall to classical cryptanalysis. Rainbow and SIKE establish that the risk is real; nothing establishes its rate.
• The cost of hybrid key exchange at the long tail — embedded devices, firmware, long-lived hardware. The published performance data covers browsers, TLS libraries and CDNs, not the slowest 10% of the installed base.
• Whether CSWP 39's practices will become binding anywhere. As of 2026-11-05 our scan finds them cited as guidance, not mandated by any regulation.
• When a cryptographically relevant quantum computer will exist. The house position, RQ-PRED-QDAY-001, is a sealed and refutable judgment — floor 2031, window 2033 to 2039 — not a measurement, and today's board still shows 0 keys broken.

Rosetta Quantum publishes verdicts with raw, reproducible data. This is educational content, not a product claim and not investment advice.