The second draft of NIST cybersecurity white paper 39 Considerations for Achieving Crypto Agility

[Chen, Lily (Fed)]

The comments are due August 15, 2025.

 

Regards,

Lily Chen, NIST

 

View As Web Page NIST Cybersecurity and Privacy Program Considerations for Achieving Crypto Agility | Second Public Draft Available for Comment Advances in computing capabilities, cryptographic research, and cryptanalytic techniques necessitate the replacement of cryptographic algorithms that no longer provide adequate security. A typical algorithm transition is costly, takes time, raises interoperability issues, and disrupts operations. Cryptographic (crypto) agility refers to the capabilities needed to replace and adapt cryptographic algorithms in protocols, applications, software, hardware, firmware, and infrastructures while preserving security and ongoing operations. The initial public draft (ipd) of NIST Cybersecurity White Paper (CSWP) 39, Considerations for Achieving Crypto Agility: Strategies and Practices, was released on March 5, 2025. It offered a common understanding of challenges and identified existing approaches related to crypto agility.  The first draft was based on discussions that NIST conducted with various organizations and stakeholders and provided read-ahead material for a virtual Crypto Agility workshop hosted by NIST on April 17-18, 2025. This second public draft (2pd) reflects the workshop findings and the feedback received during the first draft’s public comment period. It includes sections on crypto agility for security protocols and applications, crypto agility strategic plans, and considerations for future work. To advance crypto agility, NIST encourages ongoing dialogue among stakeholders to establish strategies, frameworks, requirements, and metrics tailored to specific sectors and environments. This will help inform a maturity model with key performance indicators (KPIs) and facilitate the development of common crypto Application Programming Interfaces (APIs) and tools. The public comment period for this second draft is open through August 15, 2025. See the publication details for a copy of the draft and instructions for submitting comments. Read More NIST Cybersecurity and Privacy Program Questions/Comments about this notice: crypto-...@nist.gov CSRC Website questions: csrc-i...@nist.gov

 

Connect with us Received this email from a friend? Subscribe here. Subscriber services: Manage Preferences  |  Unsubscribe  |  Help

---

If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com. Technical questions? Contact inqu...@nist.gov. (301) 975-NIST (6478). This service is provided to you at no charge by National Institute of Standards and Technology (NIST). 100 Bureau Drive, Stop 1070 · Gaithersburg, MD 20899 · 301-975-6478

[Q R]

A document that I have been looking forward is the results of tools (OSS, COTS) that can be used to help determine a cryptographic inventory.

Once a crypto inventory is established, then all sorts of questions can be asked about priority, sensitivity, cost, phasing and the like.

Is there an understanding of such tools that can be shared?

Thanks ~Q

--
You received this message because you are subscribed to the Google Groups "pqc-forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pqc-forum+...@list.nist.gov.
To view this discussion visit https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/MN2PR09MB5004A672B558D22DA76A4DCB945EA%40MN2PR09MB5004.namprd09.prod.outlook.com.

[Arne Padmos]

I don't think NIST's CSRC is going to add a list of tools to one of their documents (whether CSWP, SP, or FIPS). Instead, maybe NNCoE might have a project with an exploration concrete implementation (and hey, they do: https://www.nccoe.nist.gov/crypto-agility-considerations-migrating-post-quantum-cryptographic-algorithms).

Even so, CSWP 39 should probably include an explicit mention of the CycloneDX CBOM standard (I'm not aware of any alternatives besides homebrew variants). With such a reference, readers can easily find the relevant guides and software, e.g.:

- https://cyclonedx.org/guides/OWASP_CycloneDX-Authoritative-Guide-to-CBOM-en.pdf

- https://github.com/IBM/CBOM

- https://github.com/PQCA/cbomkit and the other repos of PQCA