Crypto Agility¶
Crypto agility concerns the ability to change cryptography as security requirements and standards evolve. PostQ provides source indicators that help your team investigate what could make a change difficult. It does not calculate a complete agility assessment or a per-asset score.
What PostQ identifies¶
Supported coding patterns can draw attention to fixed algorithm choices, key sizes, providers, modes, and padding. Other reported patterns can indicate limited configuration options or close dependencies between application code and a cryptographic implementation.
The inventory adds useful context: where an algorithm is used, which libraries are involved, which settings are visible, and which calls belong to the same operation. Together, these details help an application owner investigate the likely scope of a change.
Result meanings¶
| Result | Report code | Meaning |
|---|---|---|
| Replaceability review indicated | INDICATORS_REPORTED |
One or more supported anti-patterns warrant review of how cryptography could be changed. The compact label is Agility review. |
| Not assessed | NOT_ASSESSED |
No complete agility conclusion is available. The absence of reported indicators does not establish that cryptography is easy to replace. |
Anti-patterns are part of Risk Signals. That page defines the individual pattern codes. A fixed choice can be deliberate and appropriate; its presence alone does not establish a security weakness.
Questions for a replacement review¶
- Can the cryptographic choice be changed through controlled configuration or a shared application interface?
- Which services, protocols, stored data, or partners depend on the current choice?
- Will a change affect key formats, message formats, performance, or compatibility?
- What application tests and deployment evidence are needed before rollout?
Use the source indicators to start this discussion. Answers involving business priorities, external dependencies, and deployment behavior come from your team.
What this assessment does not establish¶
PostQ does not perform a complete application-architecture review, estimate migration cost or duration, prove interoperability, or confirm that a migration is complete. Repository readiness summaries are also not crypto-agility scores.
For an end-to-end planning workflow, see Review crypto agility. The standalone viewer's experimental Migration Review provides additional review guidance without changing this scope.