CRYPTOGRAPHY
Your encryption holds today. And can be replaced tomorrow
Nobody knows today which algorithm will still hold in five years. What you can plan for is something else: whether you can swap it out without touching the application.
What you get
- Your keys and certificates – one place that issues, renews and revokes them – run as a service, not as your second data centre (PKI as a service). No certificate whose expiry date nobody knows
- Your key exchange – built hybrid: classical and quantum-resistant at the same time. A switch then needs no cut-over date
- Your signatures – handled separately from transport. A signature under a contract must still be verifiable in ten years, a session key does not
How a replacement works
- Find the algorithms
- Separate from the application
- Run both at once
- New one first
- Retire the old one
Algorithms and key lengths follow BSI TR-02102 and the NIST standards for ML-KEM and ML-DSA. Where a certified cryptographic module is required, we build against one – the certificate itself is issued by the certification body, not by us.
Do you know which algorithm sits where in your systems?