Crypto-agility and hybrids: changing algorithms without a rewrite
The most durable outcome of a post-quantum migration is not any single algorithm but the ability to swap algorithms easily — and hybrids are how you deploy new ones safely in the meantime.
It is tempting to treat the post-quantum migration as a one-time swap: replace RSA with ML-KEM and be done. That framing misses the more valuable lesson. Algorithms will keep changing — today's post-quantum choices may themselves be deprecated, and the SIKE break showed a new scheme can fall unexpectedly. The lasting goal is to make change cheap. That property is crypto-agility.
What crypto-agility actually means
A system is crypto-agile when its cryptographic algorithms sit behind clean interfaces, so which algorithm is in use can change through configuration or a contained update rather than a rewrite. In practice that means no hard-coded algorithm identifiers scattered through the code, key and certificate formats that can carry new algorithm types, negotiated rather than fixed protocol suites, and an inventory that always knows what is deployed where. The first migration is the expensive one; a crypto-agile estate makes every migration after it routine.
Build agility before you swap
The highest-leverage early work is often not deploying a post-quantum algorithm at all — it is refactoring so that deploying one, and the next one, and the one after, is a configuration change. Agility pays back on this migration and every future cryptographic transition.
Hybrids: don't bet on one assumption
Hybrid cryptography combines a classical algorithm with a post-quantum one so that a connection stays secure as long as either half remains unbroken. A hybrid key exchange, for example, derives the session key from both an elliptic-curve exchange and an ML-KEM encapsulation; an attacker must break both to succeed. This directly hedges the newness risk: if a flaw is later found in the post-quantum scheme, the classical half still protects you, and vice versa against a quantum attacker.
Hybrids are also pragmatic for transition. They let you protect recorded traffic against harvest-now-decrypt-later today while remaining interoperable with systems that only understand classical algorithms. That is why the common first production step is moving external TLS to a hybrid post-quantum handshake rather than to a pure post-quantum one.
The relationship between the two
Crypto-agility and hybrids reinforce each other. Agility is what makes running — and later retiring — a hybrid scheme a configuration matter instead of a project. Hybrids are how an agile system safely adopts an algorithm whose long-term strength is not yet proven. Together they turn the post-quantum migration from a risky one-shot into a managed, repeatable capability.
Signs you have real agility
You can name every algorithm in use from a current inventory, change a deployed algorithm without editing application source, and your protocols negotiate suites rather than hard-coding them. If a cryptographic change would require a code release across many services, you are not yet agile.