What is Crypto-Agility?
Crypto-agility, or cryptographic agility, is a data encryption practice used by organizations to ensure a rapid response to a cryptographic threat. The idea behind crypto-agility is to adapt to an alternative cryptographic standard quickly without making any major changes to infrastructure.
Cryptography is the method of protecting information and communications using hard-to-decipher codes so that only the intended recipient can process and read the information. Cryptography uses mathematical and rule-based algorithms to secure information. Crypto-agility is an additional safety measure for organizations; it can also be seen as an incident response mechanism.
Typically, crypto-agility is used when an encryption algorithm of a system is discovered to be vulnerable. Other use cases include when an algorithm breaks suddenly or when there's a security compromise. If one of these cases arises, an organization needs to be able to switch to using a different encryption method quickly to minimize damage. This process includes switching out cryptographic algorithms, security keys, certificates and other crypto technologies.
Organizations will use cryptography broadly in their environments, such as in Transport Layer Security and Secure Socket Shells. Typically, mission-critical communication systems will also make use of crypto-agility. Without crypto-agility, if an organization's cryptographic systems are compromised, they may be open to attack, leading to a loss of business.
Importance of crypto-agility
Cryptographic techniques don't stay secure forever. For example, increasing computing power also leads to the increased ability for hostile programs to successfully break previously secure cryptographic functions. Before this happens, previously based cryptographic systems -- such as public key encryption, key exchange and digital signatures -- must be switched over to new encryption systems to stay secure. Crypto-agility is also a relatively sustainable practice, meaning this process won't become a liability.
One of the main strengths of quantum computing is its power to crack classic crypto systems. As a result, quantum computing is beginning to pose a threat to modern cryptography. Just having one enterprise encryption strategy isn't viable if an organization wants to ensure secure connections. Being able to switch over to a different cryptography system is imperative. Quantum cryptography systems and quantum key distribution (QKD) are able to aid against some of the major issues facing modern cryptography; however, QKD only focuses on secure key distribution.
Although post-quantum security is not an issue for all organizations today, some experts believe that those needing to secure data over time should aim toward crypto-agility above all else.
How to achieve crypto-agility
To set up and achieve crypto-agility, an organization must do the following:
- Define policies. Ensure that everyone in the organization knows what is needed to secure their systems and who is responsible for what.
- Determine group responsibility. Each group is responsible for having and maintaining an inventory of their assets. This allows each team to react quickly to any threats.
- Central organization. This will most likely be a security group that will provide the capability to develop an inventory and provide any necessary tools. Each team will then need to make sure they can use each tool.
On the hardware side, crypto-agility is achieved by adopting new frameworks for incident response and application development. In addition, a layer of software is required for cryptographic application programming interfaces (APIs) and secure update mechanisms.
Crypto-agility best practices
Best practices surrounding crypto-agility include the following:
- Develop a method for tracking ownership.
- Implement automation in as many areas as possible, such as management and replacement tracking.
- Inventory all crypto assets.
- Have good visibility and a good understanding of who owns things.
- Crypto technology should use the latest cryptography techniques and algorithms.
- Use high bit sizes for hash algorithms.
- Identify vulnerabilities.
How to improve crypto-agility
The following steps can help organizations improve crypto-agility practices:
- Ensure visibility, meaning an organization should have a full understanding of where and how cryptography is used throughout their infrastructure. This provides an increased ability to identify and fix any issues.
- Ensure the correct teams or groups retain ownership of their assigned crypto assets.
- Ensure any used hardware vendors are quick to release updates or security patches. If not, this could lead to an organization needing to switch over their cryptography methods more often.
History of crypto-agility
The first cryptographic standards were introduced in the 1970s, when cryptographic algorithms were first used for symmetric-key encryption, digital signatures and hash functions. There have been many cryptographic standards since this time, including the following:
- RSA (Rivest, Shamir and Adleman)
- AES (Advanced Encryption Standard)
- ECC (elliptic curve cryptography)
Since the 2010s, public key infrastructure (PKI) has been integrated into business applications using public key certificates. However, as time goes on, algorithms will become weak and insecure. For example, DES (Data Encryption Standard) used to be a symmetric encryption standard, but is now seen as weak since it has too small of a key length. MD5 (Message Digest 5) and SHA1 (Secure Hash Algorithm 1) were well-known hash functions that were broken. RSA-1024 was a standard for asymmetric encryption, but it became ineffective when key sizes changed.
New standards are being introduced, such as elliptic curve cryptography; however, this standard will also weaken over time. Whenever a cryptographic standard is broken, it needs to be replaced with other cryptographic standards. The method of adapting -- crypto-agility -- came from this pattern.
With the threat of quantum computing in the future, organizations such as NIST are starting to research new cryptographic standardization methods. It predicts quantum computing will defeat modern public key cryptography algorithms, so new approaches, such as QKD, must be introduced.
Gloss