Algorithm Choices and Migration Strategy
A practical decision framework for moving from current cryptography to staged post-quantum policy.
Citation-ready summary
- Choose algorithms per workload risk profile, interoperability constraints, and performance envelope.
- Use Axis control-plane policies to separate pilot, canary, and broad deployment stages.
- Use Aegis enforcement telemetry plus rollout receipts to decide whether to promote or rollback.
TL;DR for security leaders
Require a written migration policy that defines algorithm eligibility, exception handling, and signed approvals for every stage transition.
TL;DR for engineers
Model each protocol path in policy, validate client/server compatibility in canary scope, and automate rollback when error or latency thresholds are exceeded.
Decision checklist by use case
- Service-to-service traffic: Identify protocol constraints, validate compatibility in pilot cohort, and require canary telemetry before promotion.
- External API traffic: Confirm client interoperability strategy, document fallback behavior, and gate rollout with explicit rollback thresholds.
- Long-lived credentials and keys: Verify lifecycle ownership, define re-key sequencing, and require receipt-backed approvals for each transition stage.
- High-throughput internal workloads: Baseline latency and error budgets, then compare post-change metrics from Aegis before widening scope.
- Define data classification and transport boundaries for the target use case.
- Select candidate algorithm sets and document acceptance criteria.
- Apply pilot policy in Axis with explicit success and failure thresholds.
- Review enforcement telemetry and rollout receipts before canary expansion.
- Promote only after thresholds stay stable through the review window.
Terminology alignment
Use glossary definitions for Aegis, Axis, control plane, enforcement plane, rollout receipts, and PQ migration.
Next related reading
Next: hybrid transition patterns • Rollout runbook • Evidence: benchmark methodology • Glossary