Abstract: A method of cryptographic agility for post-quantum cryptography by swapping a ciphersuite is provided. The method can include performing, by a configuration agent or proxy, cryptography based on a current ciphersuite. The method can further include receiving, by the configuration agent and from a configuration orchestrator, instructions to invoke a protocol to swap the current ciphersuite. The method can further include invoking, by the configuration agent, the protocol to swap the current ciphersuite. The method can further include communicating, by a quantum secure layer (QSL) agent, a next ciphersuite from a set of ciphersuites to a key distribution center (KDC). The next ciphersuite can comprise a post-quantum ciphersuite, such as a next asymmetric or symmetric algorithm, cryptographic random number generator, or cryptographic hash function. The method can further include replacing the current ciphersuite with the next ciphersuite and performing cryptography based on the next ciphersuite.

Abstract: A method to allow a client to communicate with a server, specifically to conduct a key management service, in order to obtain encryption/decryption keys for data-at-rest, wherein the method comprises: causing the client to use Authenticated Encryption with Associated Data (AEAD) to encrypt data according to a moving target design and causing the client, at a later time, to use AEAD to check the integrity of the data and decrypt the data according to the moving target design.

Abstract: A method to allow a client to communicate with a server, specifically to conduct a key management service, in order to obtain encryption/decryption keys for data-at-rest, wherein the method comprises: causing the client to use Authenticated Encryption with Associated Data (AEAD) to encrypt data according to a moving target design and causing the client, at a later time, to use AEAD to check the integrity of the data and decrypt the data according to the moving target design.