A method for secure communication between constrained devices (209, 210) comprising: issuing, by an authorization server, cryptographic communication rights among a plurality of constrained devices where each of the plurality of constrained devices comprises no more than one cryptographic algorithm code module per cryptographic function wherein issuing, by the authorization server, cryptographic communication rights among the plurality of constrained devices comprises issuing asymmetric key based configuration certificates or symmetric key based tickets to the plurality of constrained devices wherein the configuration certificates assign communication rights to each of the plurality of constrained devices to allow the plurality of constrained devices to cryptographically exchange information between the plurality of constrained devices; receiving, by the authorization server, a cryptographic communication rights request associated with at least a first of the plurality of constrained devices in response to a cryptographic algorithm code module update request; providing, by the authorization server, a response comprising an identification of a subset of the plurality of constrained devices that have cryptographic communication rights with the identified first of the plurality of constrained devices; and wherein providing, by the authorization server, the response comprising the identification of the subset of the plurality of constrained devices that have cryptographic communication rights comprises determining which of the plurality of constrained devices have cryptographic communication rights with the identified first constrained device based on authorized communication rights authorized by the authorization server; and wherein the issued asymmetric key based configuration certificates or symmetric key based tickets further include data identifying an action that the subject constrained device is permitted to perform on another constrained device. issuing, by an authorization server, cryptographic communication rights among a plurality of constrained devices where each of the plurality of constrained devices comprises no more than one cryptographic algorithm code module per cryptographic function wherein issuing, by the authorization server, cryptographic communication rights among the plurality of constrained devices comprises issuing asymmetric key based configuration certificates or symmetric key based tickets to the plurality of constrained devices wherein the configuration certificates assign communication rights to each of the plurality of constrained devices to allow the plurality of constrained devices to cryptographically exchange information between the plurality of constrained devices; receiving, by the authorization server, a cryptographic communication rights request associated with at least a first of the plurality of constrained devices in response to a cryptographic algorithm code module update request; providing, by the authorization server, a response comprising an identification of a subset of the plurality of constrained devices that have cryptographic communication rights with the identified first of the plurality of constrained devices; and wherein providing, by the authorization server, the response comprising the identification of the subset of the plurality of constrained devices that have cryptographic communication rights comprises determining which of the plurality of constrained devices have cryptographic communication rights with the identified first constrained device based on authorized communication rights authorized by the authorization server; and wherein the issued asymmetric key based configuration certificates or symmetric key based tickets further include data identifying an action that the subject constrained device is permitted to perform on another constrained device.