Crypto-Agility in Practice: What Breaks When Introducing Post-Quantum Algorithms

Post-quantum cryptography is often discussed in terms of algorithm design and standardization, but integrating new cryptographic primitives into existing software systems exposes a different class of engineering challenges. Many production systems assume fixed algorithm identities, compact key and signature sizes, and stable serialization formats. These assumptions are often implicit and only become visible when new algorithms are introduced.

This talk examines practical issues encountered when introducing post-quantum algorithms into identity and access management systems. The discussion is based on implementation experience in both a newly designed platform and an existing legacy system, where crypto-agility had to be introduced incrementally without breaking existing functionality. The session identifies common failure points, including limitations in cryptographic libraries, constraints imposed by protocol message sizes, incompatibilities in token validation logic, and operational issues that arise when multiple algorithms must be supported simultaneously.

Beyond identifying problems, the talk focuses on the engineering responses used to address them. These include abstraction approaches for algorithm handling, strategies for managing backward compatibility, and techniques for validating mixed-algorithm environments during transition periods. The goal is to highlight the often-overlooked system-level implications of cryptographic change.

Attendees will gain a grounded understanding of how post-quantum migration affects real systems and what design considerations are necessary to reduce disruption during cryptographic evolution.