Cryptographic Agility Guide

Operator guide for configuring BrainstormRouter's cryptographic algorithms

Cryptographic Agility Guide

Overview

BrainstormRouter's crypto agility layer allows operators to configure which cryptographic algorithms are used for key exchange, signatures, and hashing — without code changes or redeployment.

Configuration

Add to your gateway config:

{
  "security": {
    "crypto": {
      "keyExchange": "hybrid-pqc",
      "signature": "hmac-sha256",
      "hash": "sha256"
    }
  }
}

Algorithm Reference

Key Exchange

Algorithm	Config Value	Requires	Notes
X25519	x25519	—	Classical default, universally supported
ML-KEM-768	ml-kem-768	OpenSSL 3.5+	FIPS 203 (NIST standard)
Hybrid	hybrid-pqc	OpenSSL 3.5+	Recommended — X25519+ML-KEM-768

Signatures

Algorithm	Config Value	Requires	Notes
HMAC-SHA256	hmac-sha256	—	Default for audit signing
Ed25519	ed25519	—	Compact signatures
RSA-PSS	rsa-pss	—	Legacy compatibility
ML-DSA-65	ml-dsa-65	liboqs-node	FIPS 204 (NIST standard)

Hashes

Algorithm	Config Value	Requires	Notes
SHA-256	sha256	—	Default
SHA-512	sha512	—	Higher security margin
SHA-3-256	sha3-256	—	Keccak-based alternative

Fallback Behavior

If a configured algorithm is unavailable (e.g., ml-dsa-65 without liboqs-node), the system falls back to the classical default and logs a warning:

WARN [security/crypto-agility] Preferred algorithm "ml-dsa-65" not available, falling back to default

Verification

Check available algorithms at runtime:

# Via gateway logs at startup
INFO [security/crypto-agility] Crypto agility: 8/10 algorithms available, 2 PQC (OpenSSL 3.6.1)

Positioning Language

When communicating about BrainstormRouter's PQC capabilities:

• Use: "post-quantum ready", "cryptographically agile"
• Avoid: "quantum-secure", "quantum-proof" (no system is proven quantum-secure yet)