Search papers, labs, and topics across Lattice.
This paper addresses the challenge of transitioning to post-quantum cryptography by proposing a new cryptographic API design that emphasizes agility and adaptability. By establishing design principles rooted in Abstraction, Stability, Temporal Flexibility, Separation, and Extensibility, the authors create a framework that allows for seamless algorithm updates and key migrations without altering existing application code. The proposed intent-based API facilitates cryptographic governance and operationalizes the migration process, significantly easing the integration of new algorithms into complex software systems.
Transitioning to post-quantum cryptography can be streamlined through a novel API design that decouples key management from specific algorithms, allowing for effortless updates.
As organizations move toward post-quantum cryptography, they face the major challenge of updating cryptographic algorithms across large, complex software portfolios. However, most cryptographic APIs in use today were designed around specific algorithms. These APIs expect explicit use of specific algorithms, provide little or no support for policy-based algorithm selection, and offer no straightforward way to migrate existing keys to newer algorithms. This makes the transition to post-quantum cryptography challenging. The companion assessment framework identifies the barriers to cryptographic agility and explains why algorithm transition is largely a software engineering problem. To address the limitations of current cryptographic APIs, we identify the principles necessary to design a cryptographically agile API. The design principles are derived from five fundamental architectural characteristics (Abstraction, Stability, Temporal Flexibility, Separation, and Extensibility). We also show how the design principles can be implemented using several examples of Protocol Buffers API design patterns. In particular, we present an intent vocabulary that is based on scopes which allows for decoupling key creation from algorithm identities. It also supports transparent substitutions of algorithms in the applicable scope. Cryptographic governance is enabled by an abstract policy API that does not prescribe the policy format. Keys are represented by stable identifiers and support key evolution operations (rotation, transformation, migration), facilitating migration between algorithms and providers while tracking both the original key identity and its evolution history. With this approach, updating cryptography becomes an operational process without the need to rewrite application code.
