MedTech Terms
    The authoritative reference
    All terms

    Cryptographic Agility

    The designed-in ability to replace cryptographic primitives over a device's supported lifetime.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 5, 2026

    Definition

    Cryptographic agility is the architectural property that lets a system replace its cryptographic primitives - algorithms, key sizes, protocol versions - without redesign. For medical devices fielded for 10–20 years, crypto agility is essential because algorithms (e.g., SHA-1, RSA-1024, TLS 1.0) become deprecated long before the device is retired. NIST's Post-Quantum Cryptography (PQC) program (FIPS 203/204/205, 2024) makes crypto agility newly urgent for any device whose data must remain confidential into the post-quantum era.
    What the regulation says
    FDA's 2023 cybersecurity guidance expects manufacturers to plan for cryptographic upgrades over the device's supported lifetime. NIST IR 8547 (2024) provides PQC migration guidance. CISA and the NSA have issued joint advisories pushing federal systems toward PQC by 2035; commercial healthcare follows behind.

    What this means in practice

    Achieving crypto agility means abstracting algorithms behind interfaces, supporting algorithm negotiation at every protocol layer, planning OTA updates that can deliver new crypto, and budgeting compute headroom for PQC algorithms (which have larger keys/signatures than ECC).
    Common pitfalls
    • •Hardcoding cipher suites in firmware that cannot be updated.
    • •Choosing a hardware crypto accelerator that cannot be augmented with PQC algorithms.
    • •Treating crypto as 'set and forget' for a 15-year device lifetime.

    Frequently asked questions

    For most current MedTech devices, not yet - but 'harvest now, decrypt later' attacks make data with long confidentiality requirements vulnerable. Crypto agility is the prerequisite to PQC migration when the time comes.

    Primary references

    3 sources
    Link health: 2 verified 1 bot-blocked· last checked 2026-05-09
    NIST·2FDA·1
    1. 1
      NIST Post-Quantum Cryptography
      Verified
      NISTcsrc.nist.gov
    2. 2
      NIST IR 8547 PQC Migration Guidance
      Verified
      NISTcsrc.nist.gov
    3. 3
      FDA Cybersecurity Guidance (Sept 2023)
      Bot-blocked
      FDAfda.gov

    Inline markers like [1] jump to the matching reference above.