Technical Glossary
Cipher transition is the structured process of migrating cryptographic systems, protocols, and infrastructure from deprecated or weakened cipher suites, key agreement algorithms, or hash functions to current, stronger alternatives, executed in a manner that maintains security continuity, operational availability, and interoperability throughout the migration period. The need for cipher transitions arises from the discovery of cryptanalytic weaknesses, advances in computing power that reduce the effective security level of algorithms below acceptable thresholds, and the looming threat of quantum computing attacks on public-key cryptography currently in widespread deployment. Effective cipher transitions require a comprehensive discovery phase to enumerate all systems and protocols using affected algorithms, a prioritized migration roadmap based on risk and exposure, and a testing and validation program ensuring that replacement ciphers are correctly implemented before decommissioning legacy algorithms. Post-quantum cipher transitions represent the most significant and urgent cipher transition challenge currently facing the global cryptographic infrastructure.
Cryptographic agility is the architectural design property enabling a system to replace cryptographic algorithms, key sizes, or protocol parameters with minimal operational disruption, configuration change, and code modification, ensuring that the system can respond rapidly to cryptographic deprecations, vulnerabilities, and evolving standards without requiring architectural redesign. Cryptographically agile systems abstract algorithm selection from application logic through configurable algorithm identifiers, pluggable cryptographic libraries, and protocol negotiation mechanisms that allow algorithm updates to propagate across the system through policy changes rather than code deployments. The property is considered essential in systems with long operational lifetimes—critical infrastructure, healthcare records, financial infrastructure—where cryptographic algorithms in place at deployment may become insecure before the system is retired. Standards bodies and regulators increasingly mandate cryptographic agility as a system design requirement to facilitate orderly cipher transitions without emergency system replacements.
Post-quantum migration is the coordinated transition of cryptographic systems from classical public-key algorithms—RSA, Diffie-Hellman, and elliptic curve cryptography—that are vulnerable to quantum computing attacks, to quantum-resistant algorithms standardized by NIST and other bodies, ensuring long-term security of encrypted data and authenticated communications against the threat of large-scale quantum computers. The migration is uniquely challenging because of the harvest-now-decrypt-later threat model, in which adversaries are already collecting encrypted classical-algorithm ciphertext with the intention of decrypting it once sufficiently powerful quantum computers become available, making the protection of long-lived confidentiality data an urgent priority even before quantum computers reach cryptographic relevance. NIST's post-quantum cryptography standardization process has produced the first suite of post-quantum algorithm standards, providing the technical foundation for migration planning. Organizations must prioritize migration based on the sensitivity and longevity of data at risk, the complexity of their cryptographic dependencies, and the operational feasibility of transition in their specific infrastructure environments.
Algorithm deprecation is the formal process by which a standards body, regulatory authority, or organizational policy designates a cryptographic algorithm as no longer approved for new deployments or specific use cases, typically because of discovered weaknesses, insufficient security margins, or advancement of cryptanalytic techniques that reduce the effective security level below required thresholds. Deprecation decisions are based on rigorous cryptanalytic assessment, are published in transition standards documents with defined timelines, and typically specify a sunset date after which use of the deprecated algorithm in regulated or standards-compliant systems constitutes a compliance violation. Effective deprecation management requires organizations to maintain a cryptographic inventory that maps deprecated algorithm usage to specific systems, enabling prioritized migration planning and tracking of transition progress against deprecation deadlines. Deprecated algorithms may retain limited use for legacy compatibility during transition periods, but must be prohibited for new implementations and protection of long-lived sensitive data.
A hybrid cryptographic mode is a transitional security architecture in which both classical and post-quantum cryptographic algorithms are applied in combination to protect a single communication or data asset, ensuring that the protected data remains secure even if one of the two algorithm families is later found to be vulnerable—providing defense-in-depth against both currently known attacks and future quantum computing threats. In hybrid key exchange protocols, a classical key agreement algorithm such as X25519 and a post-quantum algorithm such as ML-KEM are executed in parallel, with the resulting shared secrets combined to produce a final session key that requires breaking both algorithms to compromise. Hybrid modes are recommended by NIST and multiple national cybersecurity agencies during the transition period as a practical balance between the performance overhead of post-quantum algorithms and the risk of premature full migration before post-quantum algorithm confidence is fully established. Protocol standards including TLS 1.3 and IKEv2 have defined hybrid extension mechanisms enabling deployment of hybrid modes without breaking interoperability with non-hybrid peers.
A cryptographic inventory is a structured catalog of all cryptographic algorithms, key types, certificate configurations, and protocol implementations deployed across an organization's systems and applications, maintained to support risk assessment, compliance management, and migration planning for cipher transitions including post-quantum migration. Without a comprehensive cryptographic inventory, organizations cannot identify all systems using deprecated algorithms, cannot prioritize migration effort based on risk exposure, and cannot demonstrate compliance with regulatory requirements mandating transitions within specified timeframes. Cryptographic inventories must be kept current through automated discovery tools that scan code repositories, network traffic, and system configurations, as manual inventory processes cannot maintain accuracy in large or rapidly evolving technology environments. The inventory data model should capture not only the algorithm identifiers in use but also the data protection purpose, key lifetimes, certificate authorities, and dependency relationships that collectively determine the complexity and urgency of migration for each inventory item.
TLS protocol migration is the process of upgrading network communications infrastructure from older Transport Layer Security protocol versions and insecure cipher suites to current standards-compliant configurations, specifically TLS 1.3 with approved cipher suites and certificate configurations, eliminating vulnerabilities including protocol downgrade attacks, weak cipher negotiation, and known implementation vulnerabilities in deprecated versions. TLS 1.2 and below support cipher suites with known weaknesses that motivated the design of TLS 1.3's reduced and hardened cipher suite set, and organizations operating legacy TLS versions face both security risk and regulatory non-compliance. Migration challenges include legacy client compatibility requirements that may necessitate continued support for older TLS versions during transition periods, certificate authority transitions required to eliminate SHA-1 and weak RSA key sizes, and the eventual addition of post-quantum hybrid key exchange extensions to TLS 1.3 as post-quantum cipher suites achieve production readiness. Automated TLS configuration scanning and certificate lifecycle management tools are essential infrastructure for maintaining TLS compliance at scale.
Harvest now decrypt later (HNDL) is a strategic threat model in which adversaries systematically collect and archive encrypted ciphertext protected by classical public-key cryptography today, with the intention of decrypting the collected data once sufficiently powerful quantum computers are available to break the underlying key exchange algorithms. The threat is particularly acute for data whose sensitivity will persist beyond the expected timeline for quantum computer development—state secrets, medical records, financial data, and intellectual property with long-term value. HNDL attacks are already underway against high-value targets, making post-quantum migration a present-tense operational imperative rather than a future-tense planning exercise for organizations handling long-lived sensitive data. Defense requires migration to quantum-resistant key exchange algorithms before the data's protection window expires, with priority determined by both the sensitivity of the data and the expected time before quantum computers capable of breaking current public-key cryptography become available.
Cipher suite negotiation is the cryptographic handshake process by which communicating parties select a mutually supported combination of key exchange algorithm, authentication mechanism, symmetric encryption algorithm, and message authentication code from their respective configured preference lists, with the negotiated cipher suite determining the security properties of the ensuing communication session. The security of cipher suite negotiation depends on the ability to prevent downgrade attacks—where an active adversary manipulates the negotiation to force selection of a weaker cipher suite than either party would prefer—addressed in modern protocols through authenticated negotiation mechanisms that make tampering detectable. TLS 1.3 significantly simplified and strengthened cipher suite negotiation by eliminating support for cipher suites with known weaknesses, removing RSA key exchange, and mandating forward secrecy through ephemeral key exchange. During post-quantum migration, cipher suite negotiation mechanisms must be extended to support hybrid classical and post-quantum key exchange without breaking compatibility with peers that have not yet migrated.
A key encapsulation mechanism (KEM) is a cryptographic primitive that enables secure transmission of a symmetric session key from an initiator to a responder by encapsulating the key under the responder's public key, such that only the holder of the corresponding private key can decapsulate and recover the session key. Post-quantum KEMs based on lattice problems—such as NIST-standardized ML-KEM (formerly Kyber)—replace classical RSA-OAEP and ECDH key exchange with algorithms whose security is not threatened by quantum computing attacks. The clean separation between the KEM operation and the downstream symmetric encryption provides cryptographic agility, enabling algorithm substitution at the KEM layer without changing the authenticated encryption scheme used for bulk data protection. KEM performance characteristics—specifically encapsulation and decapsulation latency and public key and ciphertext sizes—are critical factors in cipher transition planning for systems with strict latency requirements or bandwidth constraints.
Digital signature migration is the transition of signature algorithms used for code signing, certificate issuance, document authentication, and protocol message integrity from classical algorithms such as RSA-PKCS1 and ECDSA to post-quantum digital signature standards including ML-DSA and SLH-DSA standardized by NIST, ensuring that signature-based trust anchors remain secure against quantum computing attacks. Signature migration is more complex than key exchange migration because digital signatures are often embedded in long-lived artifacts—code signing certificates, root certificates with decade-long validity, signed documents with legal effect—that cannot be simply re-signed after migration without breaking compatibility with verifiers that have not yet migrated their verification toolchains. Root certificate migration is particularly sensitive, requiring coordinated updates to trust stores in operating systems, browsers, and embedded systems worldwide before old root certificates can be retired. Organizations operating their own certificate authorities must plan signature migration as a phased operation that maintains cross-certification bridges between old and new signature algorithm hierarchies during the transition period.
A cryptographic transition roadmap is a structured organizational planning document specifying the prioritized sequence of cipher migration activities, target completion timelines, resource requirements, dependency constraints, and risk acceptance decisions governing an organization's transition from deprecated or at-risk cryptographic algorithms to current standards-compliant alternatives. The roadmap is grounded in the organization's cryptographic inventory and risk assessment, applying prioritization frameworks that weight the sensitivity of protected data, the expected quantum computing threat timeline, the technical complexity of each migration, and the dependency relationships between cryptographic components. CISA, NIST, and NSA have published guidance frameworks that provide roadmap templates and prioritization criteria for federal agencies and critical infrastructure operators, which are widely adopted by private sector organizations as best practice frameworks. Roadmap progress tracking requires ongoing cryptographic inventory refresh, dependency analysis updates, and milestone reporting to governance stakeholders to ensure that migration remains on schedule against regulatory and threat-driven deadlines.
Lattice-based cryptography is a family of post-quantum cryptographic algorithms whose security is grounded in the computational hardness of lattice problems—specifically the Learning With Errors (LWE), Ring-LWE, and Module-LWE problems—which are believed to resist attacks by both classical and quantum computers and form the mathematical foundation of NIST's primary post-quantum algorithm standards. NIST has standardized ML-KEM for key encapsulation and ML-DSA for digital signatures, both built on Module-LWE hardness assumptions, as the core of its initial post-quantum cryptography standards suite. Lattice-based algorithms offer attractive performance characteristics relative to other post-quantum families, with competitive key and signature sizes and efficient implementations on standard hardware. Security confidence in lattice-based algorithms is supported by decades of rigorous academic cryptanalysis, although the relative recency of their widespread standardization means that operational experience and implementation security track records are still accumulating compared to RSA and ECC.
A side-channel resistant implementation is a cryptographic software or hardware design that prevents adversaries from extracting secret key material or plaintext by observing physical emanations—timing variations, power consumption, electromagnetic emissions, or cache access patterns—that correlate with the internal operations of the cryptographic algorithm and can be exploited through statistical analysis to reconstruct secrets without direct cryptographic attack. Post-quantum algorithms introduce new side-channel considerations because their algebraic structures and sampling operations create distinct leakage profiles that differ from classical algorithm implementations, requiring new analysis and hardening techniques during the cipher transition period. Constant-time programming disciplines, hardware-accelerated masked implementations, and formal verification tools that model side-channel leakage are employed to achieve side-channel resistance in production cryptographic libraries. Transition to post-quantum algorithms must include explicit side-channel evaluation of new implementations rather than assuming that academic algorithm security translates automatically into implementation security.
Certificate authority migration is the complex, multi-phase transition of a public key infrastructure from classical cryptographic algorithms to post-quantum alternatives, requiring coordinated updates to root and intermediate certificate authorities, relying party trust stores, certificate issuance policies, revocation infrastructure, and signed artifact validation toolchains across the entire PKI ecosystem. The migration cannot be executed as a simple replacement because the trust hierarchy is built on cryptographic signatures of certificates by parent authorities, meaning that post-quantum root certificates must be bootstrapped into trust stores through an out-of-band distribution process before the new hierarchy can issue trusted certificates. NIST and the CA/Browser Forum are developing migration timelines and technical standards for the PKI ecosystem, with X.509 extensions defined to support hybrid classical and post-quantum signature fields during the transition period. Organizations operating private CAs for internal PKI must develop their own migration plans that account for dependencies on internal certificate verification in their application and infrastructure stacks.