Algorithm Choices and Migration Strategy
A practical decision framework for moving from current cryptography to staged post-quantum policy.
Build applicability: the released v0.5.5 native catalog identifies the executable options for each build. Read the exact primitive/TLS catalog and runtime prerequisites before applying this planning guidance. Hybrid TLS key establishment does not make certificate authentication post-quantum; native Messenger and each other protocol require separate verification.
Citation-ready summary
- Choose algorithms per workload risk profile, interoperability constraints, and performance envelope.
- Use Axis control-plane policies to separate pilot, canary, and broad deployment stages.
- Use Aegis enforcement telemetry plus rollout receipts to decide whether to promote or rollback.
TL;DR for security leaders
Record algorithm eligibility, target scope, exception handling, and the explicit review before apply. Automated canary stages then require fresh attributed observations and the configured thresholds; a successful API call alone does not prove adoption.
TL;DR for engineers
Model each protocol path in policy, validate client/server compatibility in canary scope, and automate rollback when error or latency thresholds are exceeded.
Decision checklist by use case
- Service-to-service traffic: Identify protocol constraints, validate compatibility in pilot cohort, and require canary telemetry before promotion.
- External API traffic: Confirm client interoperability strategy, document fallback behavior, and gate rollout with explicit rollback thresholds.
- Long-lived credentials and keys: Verify lifecycle ownership, define re-key sequencing, and require receipt-backed approvals for each transition stage.
- High-throughput internal workloads: Baseline latency and error budgets, then compare post-change metrics from Aegis before widening scope.
- Define data classification and transport boundaries for the target use case.
- Select candidate algorithm sets and document acceptance criteria.
- Apply pilot policy in Axis with explicit success and failure thresholds.
- Review enforcement telemetry and rollout receipts before canary expansion.
- Promote only after thresholds stay stable through the review window.
Terminology alignment
Use glossary definitions for Aegis, Axis, control plane, enforcement plane, rollout receipts, and PQ migration.
Next related reading
Next: hybrid transition patterns • Rollout runbook • Evidence: benchmark methodology • Glossary