It’s time for cryptography to get its own abstraction layer

July 17, 2026 | Source: IBM Research

Tags: post-quantum cryptography, cryptographic agility, IBM Research, PQC migration, security infrastructure, intent-based API

IBM Research is proposing a cryptographic agility abstraction layer — an intent-based API where applications declare cryptographic intent (sign, verify, encrypt) while a centrally governed policy layer handles algorithm selection — designed to make post-quantum cryptography migrations possible without touching application code.

Details

IBM Research presented a principled approach to cryptographic agility at the Eurocrypt 2026 MAgiCS (Migration and Agility in Cryptographic Systems) workshop, and has since begun a work-in-progress reference implementation. The core argument: developers have been solving the wrong problem. Current crypto libraries bake algorithm names directly into call sites, meaning any cryptographic transition — including the post-quantum migration now underway across the industry — requires touching every piece of application code that calls those libraries. The proposed solution borrows from systems programming history. Just as TCP/IP abstracted network reliability away from application developers and filesystems abstracted physical storage, IBM's approach introduces a new abstraction layer for cryptography. Applications express intent via 'scopes' — predefined classes of cryptographic operation such as 'standard digital signatures' or 'authenticated encryption.' A scope defines input/output structure but not the underlying algorithm. Policy, managed outside application code, decides which algorithm satisfies each scope. The practical implication is significant for PQC migration: if an organization needs to swap RSA for a NIST-standardized post-quantum algorithm, the change happens in the policy layer, not across hundreds of call sites in application code. IBM presented this work at PKI Consortium in November 2025 and Eurocrypt in 2026, and reports that feedback consistently identified algorithm-to-call-site coupling as the primary reason cryptographic transitions stall. The reference implementation is partial and explicitly work-in-progress. IBM is inviting community participation to test and shape the design before it matures. No production deployments have been announced.