Federal agencies preparing for post-quantum cryptography must first identify where encryption is used across their systems, then modernize architectures to accommodate future algorithm changes, federal and industry technology leaders said Oct. 28 at the Red Hat Government Symposium in Washington, D.C.
Bill Newhouse, cybersecurity engineer and project lead for the National Cybersecurity Center of Excellence at the National Institute of Standards and Technology, warned that agencies could struggle to manage the flood of data produced by cryptographic discovery tools.
“I’m seeing a marketplace of tools that you may not have ever experienced the use of,” Newhouse said, noting that many security teams have limited experience conducting cryptographic inventories.
These tools can generate a cryptographic bill of materials (CBOM), a machine-readable inventory of cryptographic assets and their dependencies. But in complex IT environments, agencies may end up with multiple inventories covering different systems and network segments, which could make it difficult to piece together a complete picture.
“The tools all will generate CBOMs. Question is, how many are you going to get, and what are they connected to?” Newhouse said.
Beyond building those inventories, agencies also need to understand how cryptography is actually being used across their systems, according to Emily Fox, portfolio security architect at Red Hat.
“When we’re talking about cryptography and knowing what you have and what it’s using, it’s not just enough to do static discovery,” Fox said. “We also need runtime telemetry to know what is actually being negotiated over the wire and use.”
That visibility, she said, can help agencies identify which systems and data paths should be prioritized for remediation, particularly in legacy environments where cryptographic functions may be embedded directly into application code.
Jay Gazlay, acting associate director for vulnerability management at the Cybersecurity and Infrastructure Security Agency, urged agencies to deploy observability capabilities in production environments and conduct frequent pilots for observability capabilities rather than relying solely on isolated test beds that may not reflect the complexity of federal infrastructure.
“Pilot early, pilot often, pilot early, pilot often, integrate, integrate, integrate,” Gazlay said.
He acknowledged the difficulty of introducing new capabilities while keeping legacy applications running but said monitoring production traffic can help agencies evaluate changes under real-world conditions without building separate testing environments.
Gazlay said this approach could shave three to four months off a multiyear modernization effort and allow agencies to take calculated risks without disrupting mission-critical systems.
Building toward cryptographic agility
Beyond testing new observability capabilities, Newhouse emphasized the need for cryptographic agility – the ability to update or replace encryption algorithms as security standards and threats evolve without overhauling entire systems.
Newhouse urged agencies to account for future algorithm transitions when making modernization decisions, rather than treating each update as a separate technical project.
“Ask yourself, ‘What can I build so that if I needed to swap out an algorithm in five years or six years from now?’, [so] that it becomes a policy change to an existing architecture that doesn’t need to be rebuilt,” he said.