Misleading crypto‑agility risk scores #4
Description
Summary:
The current X + Y > Z decision rule used in CARAF and the CARAF Calculator can produce misleading crypto‑agility risk scores, especially when users enter low or zero values for X (asset lifespan) or Y (migration time). This causes assets to be incorrectly categorized as “PHASE-OUT” or “ACCEPT,” even when they handle long-lived data or require significant migration effort. This contradicts NIST PQC migration guidance, which emphasizes data retention, minimum migration lead times, and harvest-now, decrypt-later risks.
Problem Details:
- X (Asset Lifespan) underestimates long-lived data
Many assets store or process data needing confidentiality for 10–25+ years. Current logic treats short asset lifecycle as equal to short data-retention, producing artificially low exposure scores.
2. Y (Migration Time) often set to zero
Users frequently enter Y=0, especially in early discovery phases. This ignores real-world migration complexity: library updates, PKI transition, vendor dependencies, firmware upgrades, and performance testing.
3. Z (Threat Horizon) lacks standardized defaults
Without guidance, users enter optimistic threat horizons, which skews risk evaluation.
4. Overall Impact
The rule incorrectly classifies high-risk assets as LOW RISK, ACCEPT, or PHASE-OUT, causing misleading prioritization for PQC migration efforts.
Proposed Changes
-
Add “Data Retention Lifetime” as mandatory input
Automatically compute X = max(asset lifespan, data retention lifetime), aligning with NIST PQC guidance. -
Enforce minimum migration time (Y)
Require Y ≥ configurable lower bounds:
- Software systems: ≥ 0.5 years
- PKI, hardware, HSM, embedded: ≥ 1–3 years
- Provide standardized Z presets
Suggested defaults:
- Conservative: Z = 5
- Moderate: Z = 7
- Standard: Z = 10
- Update decision logic to Exposure Index
Exposure = (DataRetention + MigrationLeadTime) – ThreatHorizon
Classification:
- Exposure ≥ 0 → EXPOSED
- -3 < Exposure < 0 → AT RISK
- Exposure ≤ -3 → PHASE-OUT
- Workbook Safeguards
- Warn when Y=0 is entered
- Flag when DataRetention > Z
- Provide NIST-aligned guidance tooltips
**_
Benefits
_**
- Aligns CARAF with NIST PQC recommendations
- Produces accurate exposure assessments
- Avoids underestimating long-term confidentiality risks
- Addresses real migration effort
- Improves cross-industry PQC readiness