Intent-Based Cryptographic API Design for Cryptographic Agility

• URL: http://arxiv.org/abs/2606.13445v1
• Date: Thu, 11 Jun 2026 15:05:37 GMT
• Title: Intent-Based Cryptographic API Design for Cryptographic Agility
• Abstract summary: Most cryptographic APIs in use today were designed around specific algorithms.<n>These APIs expect explicit use of specific algorithms, provide little or no support for policy-based algorithm selection, and offer no straightforward way to migrate existing keys to newer algorithms.<n>This paper identifies the barriers to cryptographic agility and explains why algorithm transition is largely a software engineering problem.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: As organizations move toward post-quantum cryptography, they face the major challenge of updating cryptographic algorithms across large, complex software portfolios. However, most cryptographic APIs in use today were designed around specific algorithms. These APIs expect explicit use of specific algorithms, provide little or no support for policy-based algorithm selection, and offer no straightforward way to migrate existing keys to newer algorithms. This makes the transition to post-quantum cryptography challenging. The companion assessment framework identifies the barriers to cryptographic agility and explains why algorithm transition is largely a software engineering problem. To address the limitations of current cryptographic APIs, we identify the principles necessary to design a cryptographically agile API. The design principles are derived from five fundamental architectural characteristics (Abstraction, Stability, Temporal Flexibility, Separation, and Extensibility). We also show how the design principles can be implemented using several examples of Protocol Buffers API design patterns. In particular, we present an intent vocabulary that is based on scopes which allows for decoupling key creation from algorithm identities. It also supports transparent substitutions of algorithms in the applicable scope. Cryptographic governance is enabled by an abstract policy API that does not prescribe the policy format. Keys are represented by stable identifiers and support key evolution operations (rotation, transformation, migration), facilitating migration between algorithms and providers while tracking both the original key identity and its evolution history. With this approach, updating cryptography becomes an operational process without the need to rewrite application code.

Related papers

• An Assessment Framework for Application-Level Cryptographic Agility [0.0]
  The impending post-quantum transition to new cryptography will require complete replacement of algorithms within all software.<n> cryptographic APIs used today make this transition challenging because they were not designed with agility as a concern.<n>We introduce a component-based assessment framework that characterizes application-level cryptographic agility along seven dimensions.
  arXiv  Detail & Related papers  (2026-06-11T14:54:10Z)
• Post-Quantum Cryptography: An Analysis of Code-Based and Lattice-Based Cryptosystems [55.49917140500002]
  Quantum computers will be able to break modern cryptographic systems using Shor's Algorithm.<n>We first examine the McEliece cryptosystem, a code-based scheme believed to be secure against quantum attacks.<n>We then explore NTRU, a lattice-based system grounded in the difficulty of solving the Shortest Vector Problem.
  arXiv  Detail & Related papers  (2025-05-06T03:42:38Z)
• Post-Quantum Homomorphic Encryption: A Case for Code-Based Alternatives [0.6749750044497732]
  Homomorphic Encryption (HE) allows secure and privacy-protected computation on encrypted data without the need to decrypt it.<n>Most of the current PQHE algorithms are secured by lattice-based problems.<n>Code-based encryption is a novel way to diversify post-quantum algorithms.
  arXiv  Detail & Related papers  (2025-03-28T06:49:22Z)
• Cryptoscope: Analyzing cryptographic usages in modern software [0.5139430317578633]
  The advent of quantum computing poses a significant challenge as it has the potential to break certain cryptographic algorithms.<n>It is crucial not only to identify quantum vulnerable algorithms but also to detect vulnerabilities and incorrect crypto usages.<n>A U.S. government memorandum require agencies to begin their transition to PQC (Post Quantum Cryptograpy) by conducting a prioritized inventory of cryptographic systems.
  arXiv  Detail & Related papers  (2025-03-25T10:39:50Z)
• Cryptanalysis via Machine Learning Based Information Theoretic Metrics [58.96805474751668]
  We propose two novel applications of machine learning (ML) algorithms to perform cryptanalysis on any cryptosystem.<n>These algorithms can be readily applied in an audit setting to evaluate the robustness of a cryptosystem.<n>We show that our classification model correctly identifies the encryption schemes that are not IND-CPA secure, such as DES, RSA, and AES ECB, with high accuracy.
  arXiv  Detail & Related papers  (2025-01-25T04:53:36Z)
• Secure Semantic Communication With Homomorphic Encryption [52.5344514499035]
  This paper explores the feasibility of applying homomorphic encryption to SemCom.<n>We propose a task-oriented SemCom scheme secured through homomorphic encryption.
  arXiv  Detail & Related papers  (2025-01-17T13:26:14Z)
• Encrypted system identification as-a-service via reliable encrypted matrix inversion [0.0]
  Encrypted computation opens up promising avenues across a plethora of application domains. In particular, Arithmetic homomorphic encryption is a natural fit for cloud-based computational services. This paper presents an encrypted system identification service enabled by a reliable encrypted solution to at least squares problems.
  arXiv  Detail & Related papers  (2024-10-27T20:00:04Z)
• From Decoding to Meta-Generation: Inference-time Algorithms for Large Language Models [63.188607839223046]
  This survey focuses on the benefits of scaling compute during inference. We explore three areas under a unified mathematical formalism: token-level generation algorithms, meta-generation algorithms, and efficient generation.
  arXiv  Detail & Related papers  (2024-06-24T17:45:59Z)
• Software-Defined Cryptography: A Design Feature of Cryptographic Agility [6.223203288731036]
  Cryptographic agility, or crypto-agility, is a design feature that enables seamless updates to new cryptographic algorithms and standards. This paper introduces a notion of software-defined cryptography as the desired design feature for crypto-agility.
  arXiv  Detail & Related papers  (2024-04-02T10:11:58Z)
• Revocable Cryptography from Learning with Errors [61.470151825577034]
  We build on the no-cloning principle of quantum mechanics and design cryptographic schemes with key-revocation capabilities. We consider schemes where secret keys are represented as quantum states with the guarantee that, once the secret key is successfully revoked from a user, they no longer have the ability to perform the same functionality as before.
  arXiv  Detail & Related papers  (2023-02-28T18:58:11Z)
• MixNet for Generalized Face Presentation Attack Detection [63.35297510471997]
  We have proposed a deep learning-based network termed as textitMixNet to detect presentation attacks. The proposed algorithm utilizes state-of-the-art convolutional neural network architectures and learns the feature mapping for each attack category.
  arXiv  Detail & Related papers  (2020-10-25T23:01:13Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.