Cryptography Without the Headache: From Assessment Framework to Agile API

Every organization knows cryptography will need to change. New standards arrive, old algorithms age out, compliance requirements shift, and vulnerabilities force urgent decisions. Most systems still make those changes painfully expensive by embedding cryptographic choices deep inside applications and infrastructure.

This talk argues that cryptographic agility is largely a systems design problem. We begin with a component-based assessment framework for evaluating how today’s cryptographic APIs support or hinder agility, and use it to examine widely deployed systems such as OpenSSL, JCA, Tink, AWS KMS, and Vault Transit. The result is a clear diagnosis of why migrations remain slow, expensive, and deeply tied to application code.

We then show what it takes to fix the problem: an abstract cryptographic API built around intent-based operations, policy-driven algorithm selection, explicit key transformation, identity-based governance, and pluggable crypto backends. The payoff is a shift from cryptographic change as a distributed rewrite to cryptographic change as a managed control-plane decision.

Attendees will leave with a practical way to assess their current cryptographic stack, a clearer picture of the architectural gaps blocking cryptographic upgrades, and a concrete API model for building systems that can evolve without breaking applications.