As D.W. rightly notes, graph isomorphism is not known to be in P, and believed not to be NP-hard. Moreover, many believe it to be in BQP, but this has not been proven. That puts it in the same category as other problems on which cryptosystems typically rely for their security, such as prime factoring and the discrete log problem, both of which are known to be in BQP. (I don't know where the elliptic curve inverse multiplication problem or whatever it's called sits with respect to BQP, but it wouldn't surprise me in the least if all of these cryptographically useful problems turned out to be equivalent in some sense.)
It's true that we don't know of graph isomorphism problems for which the solution is "hard". However, let's assume for a moment that we did. Then yes, you can use it for cryptography.
As an example, let's look at a zero-knowledge proof key system based on graph isomorphism.
Alice's private key is a labelled graph (the labels can just be integers) which has been constructed such that it is "hard" to check a graph isomorphism for, and it contains a Hamiltonian cycle that it is "hard" to find. Her public key is just the labelled graph, with no information about the Hamiltonian cycle. Note that deriving the private key from the public key requires solving the Hamiltonian cycle problem, which is NP-hard and, we assume, is hard for this graph in particular.
Alice wants to convince Bob that she knows a Hamiltonian cycle in the graph, without actually giving him the Hamiltonian cycle. Here's how she does it.
Alice sends Bob an unlabelled graph. She offers him a choice: Either she will reveal the labels, or she will reveal a Hamiltonian cycle in the graph. Bob flips a coin (or makes a decision by some other means) as to which one he wants, and Alice does whichever of the two that Bob asks.
If Bob asked for the labels to be revealed, he can easily verify (in linear time) that the resuling labelled graph is the same as Alice's public key, but can't find a Hamiltonian cycle because that would be NP-hard. If, on the other hand, Bob asked for the Hamiltonian cycle, he can easily verify (again, in linear time) that the resulting unlabelled graph does indeed contain a Hamiltonian cycle, but he can't verify that it's Alice's public key graph, because graph isomorphism is (presumably) hard.
From Bob's point of view, Alice could have tried to trick Bob by either giving a graph which does have a known Hamiltonian cycle but is not isomorphic to her public key, or by giving him her public key graph with the labels removed but not knowing the Hamiltonian cycle. She would be betting on Bob making the wrong choice. Assuming that Bob really did make his choice randomly, then this trick would have a 50% chance of success.
So the above exchange is repeated with a different unlabelled graph. After $n$ rounds of the protocol, the probability of Alice successfully tricking Bob on all rounds is $2^{-n}$, which converges very quickly to "as certain as you need to be".
This is, of course, nowhere near a practical system as it stands. Moreover, there are some obvious things you can do to make it more secure. For example, instead of Alice sending Bob an unlabelled graph, she could just send a hash of it. When Bob replies, she could then send the graph, and Bob can check that the graph matches.
Nonetheless, you could create a cryptosystem out of it in principle, even if it's not terribly useful.
