Loading CryptoViz...
Loading page content...Loading CryptoViz...
Loading page content...Interactive Recommendation Guide
Select a real-world use case scenario or answer a step-by-step decision tree to discover recommended algorithms, security trade-offs, and implementation code snippets.
Encrypting REST APIs, web traffic, and HTTPS/TLS session communications.
Safely storing user passwords in databases using memory-hard KDF functions & HMAC.
Low-memory microcontrollers or mobile chips lacking AES hardware acceleration.
Encrypting databases, cloud backups, and disk partitions (BitLocker/FileVault).
Authenticating software releases, API JWT tokens, and TLS certificates.
Future-proofing data against quantum computer decryption attacks (NIST PQC).
AES (GCM/XTS) is the gold standard for symmetric encryption worldwide. It features dedicated CPU hardware acceleration (AES-NI) on modern x86 and ARM processors.
Requires hardware acceleration for top performance; without AES-NI, software-only performance can be slower than ChaCha20.
ChaCha20-Poly1305 is a high-speed AEAD stream cipher designed to run extremely fast in software without requiring specialized hardware instructions.
Requires strict 96-bit nonce uniqueness per key to prevent security compromises.
IETF RFC 9106 AEAD. 8 parallel 128-bit AES states. Highest-throughput AEAD in the AEGIS family. 128-bit key + 128-bit nonce. 128/256-bit tag.
Standard cryptographic trade-offs apply.
Secure Hash Algorithm 2. Produces a unique 256-bit hash output representing the input message.
Standard cryptographic trade-offs apply.
A password hashing function incorporating a salt and cost factor, designed to be slow to prevent brute force.
Standard cryptographic trade-offs apply.
RFC 8391 stateful hash-based signature. WOTS+ chains + Merkle tree. Quantum-safe. β Stateful: leaf index must never be reused.
Standard cryptographic trade-offs apply.
RFC 8554 stateful hash-based signature. LM-OTS chains + Merkle tree. Quantum-safe. β Stateful.
Standard cryptographic trade-offs apply.
NIST PQC Round 4 Alternate. Code-based KEM (QC-MDPC). Ring arithmetic over GF(2)[X]/(X^n - 1). Decryption failure probability is a core security parameter. SHAKE256-backed.
Standard cryptographic trade-offs apply.
Stateless hash-based post-quantum signature scheme (NIST FIPS 205, 2024). Composed of WOTS+, FORS, and Hypertree layers. Security derives solely from SHA-256; no lattice or number-theoretic assumptions. Complements stateful XMSS/LMS.
Standard cryptographic trade-offs apply.
An unbreakable cipher when used with a truly random, single-use key of equal length to the plaintext.
Standard cryptographic trade-offs apply.
A tweakable mode (IEEE P1619) for disk-sector encryption, composed from the existing AES module β the sector number IS the tweak, so no IV needs to be stored per sector. Confidentiality-only, no authentication tag (unlike AES-GCM).
Standard cryptographic trade-offs apply.
A symmetric key block cipher jointly developed by Mitsubishi Electric and NTT, widely used and standardized (RFC 3713).
Standard cryptographic trade-offs apply.
An AES finalist (1998, runner-up to Rijndael) with the largest security margin of the finalists β 32 rounds using 8 different S-boxes cycled per round, versus AES's single S-box.
Standard cryptographic trade-offs apply.
An NSA lightweight ARX cipher (2013) using only addition, rotation, and XOR β no S-boxes or lookup tables at all, unlike every other symmetric cipher in this registry.
Standard cryptographic trade-offs apply.
Counter with CBC-MAC (NIST SP 800-38C) β an authenticated mode composed from AES, contrasted with AES-GCM: authentication here is literal CBC-MAC re-running the block cipher, not GHASH polynomial evaluation.
Standard cryptographic trade-offs apply.
A tweakable, large-block ARX cipher (2008) underlying the Skein hash function (a SHA-3 finalist). 256-bit block, 72 rounds, and a 128-bit tweak that varies ciphertext without changing the key β no other cipher here exposes a tweak input.
Standard cryptographic trade-offs apply.
The 192-bit-nonce extension of ChaCha20 (used by libsodium) β an HChaCha20 subkey-derivation step, the ChaCha20 sibling of this batch's XSalsa20, lets you pick nonces randomly instead of managing a counter.
Standard cryptographic trade-offs apply.
AES finalist by Bruce Schneier et al. (1998). 128-bit block, 128/192/256-bit keys, 16-round Feistel. Uses key-dependent S-boxes (derived via RS matrix over GF(2^8)), MDS matrix diffusion, PHT, and 40 subkeys. Used in GnuPG and VeraCrypt. Never broken.
Standard cryptographic trade-offs apply.
The Soviet/Russian government standard block cipher (declassified 1994) β 256-bit key, 32-round Feistel. Uniquely, the S-boxes are a negotiated parameter, not fixed by the standard; this demo uses a published reference set.
Standard cryptographic trade-offs apply.
NIST-selected lightweight cryptography standard (SP 800-232, 2023). Authenticated encryption with associated data (AEAD) β encrypts and authenticates simultaneously using a 320-bit sponge permutation. Designed for IoT and constrained devices. Output = nonce + ciphertext + 128-bit tag.
Standard cryptographic trade-offs apply.
The 192-bit-nonce extension of Salsa20 (used by NaCl/libsodium) β an HSalsa20 subkey-derivation step lets you pick nonces randomly instead of managing a counter.
Standard cryptographic trade-offs apply.
Chinese national standard block cipher (GB/T 32907-2016, ISO/IEC 18033-3, RFC 8998). Mandatory in Chinese internet and financial infrastructure; now part of TLS 1.3 cipher suites. 128-bit block, 128-bit key, 32-round SPN with a single S-box and linear transform.
Standard cryptographic trade-offs apply.
NSA lightweight block cipher targeting 8/16-bit microcontrollers. Uses 16-bit words, a 32-bit block, and a 64-bit key across 32 Feistel rounds. The smallest variant of the SIMON family.
Standard cryptographic trade-offs apply.
NESSIE-submitted 128-bit block cipher. Unique for having ZERO lookup tables; its non-linear Gamma layer uses exactly 5 bitwise AND/OR/XOR operations. Ideal for VLSI/FPGA environments.
Standard cryptographic trade-offs apply.
Korean lightweight ARX block cipher (IETF RFC 9998, 2024). Pure Add/Rotate/XOR β no S-boxes, making it 3β4Γ faster than AES on 32-bit processors. 128-bit block, 128/192/256-bit keys, 24/28/32 rounds. Used in Korean IoT and mobile applications.
Standard cryptographic trade-offs apply.
Ultra-lightweight 64-bit block cipher (CHES 2017). Uses a 4-bit S-box and 28-round SPN. 5x more hardware-efficient than PRESENT and underlies the NIST Lightweight Finalist GIFT-COFB.
Standard cryptographic trade-offs apply.
Russian national hash function (GOST R 34.11-2012, RFC 6986). 512-bit internal state processed through 12 rounds of a Kuznyechik-family SPN in a Miyaguchi-Preneel-like compression function, with a unique checksum-based finalization step.
Standard cryptographic trade-offs apply.
Russian national block cipher (GOST R 34.12-2015, RFC 7801). 128-bit block, 256-bit key, 9-round SPN. Replaces the legacy 1989 GOST cipher. Uses a fixed 256-byte S-box and a linear transform built from 16 GF(2^8) feedback steps.
Standard cryptographic trade-offs apply.
NSA hardware-optimised lightweight block cipher (IACR 2013/404). Sibling of SPECK β SIMON targets gate-minimal hardware via bitwise AND while SPECK targets software via ARX. 128-bit block, 128-bit key, 68-round Feistel. Round function: f(x)=(x<<<1 & x<<<8)βx<<<2.
Standard cryptographic trade-offs apply.
eSTREAM Portfolio Phase 3 stream cipher (RFC 4503). 128-bit key, 64-bit IV. Distinctive non-linear counter system (no LFSR) using 64-bit squaring and XOR to generate 128 bits of keystream per iteration. Extremely fast in software.
Standard cryptographic trade-offs apply.
eSTREAM Phase 3 software-profile stream cipher by Hongjun Wu. Uses two 512-word (2 KB each) key/IV-derived lookup tables P and Q that update themselves during keystream generation. The fastest stream cipher in the eSTREAM portfolio on 32-bit software. Output = IV(32 hex) + ciphertext.
Standard cryptographic trade-offs apply.
NESSIE-submitted block cipher (2000). 128-bit block, 128/192/256-bit key. Unique involutional design: the S-box, diffusion layer, and round structure are all self-inverse. Decryption is literally the same code as encryption, just with reversed round keys.
Standard cryptographic trade-offs apply.
IBM AES finalist (1998). 128-bit block, 32-round heterogeneous SPN. Unique for combining 4 different round types (forward mixing, forward E-rounds, backward E-rounds, backward mixing) for defense-in-depth. Lost to Rijndael (AES) on performance/simplicity, but unbroken.
Standard cryptographic trade-offs apply.
ISO/IEC 29192-2 lightweight block cipher (Sony, 2007). 4-branch generalized Feistel network (GFN) with parallel F0/F1 functions using distinct S-boxes and diffusion matrices. Pairs with PRESENT to complete the ISO lightweight standard duo.
Standard cryptographic trade-offs apply.
CRYPTREC-recommended, RFC 2994. 64-bit block, 128-bit key. Unique recursive Feistel network: main rounds call FO, which calls FI, which uses 7-bit/9-bit S-boxes. Ancestor of KASUMI (3G/GSM).
Standard cryptographic trade-offs apply.
Korean national standard block cipher (KS X 1213, RFC 5794). AES-like SPN but alternates between two involutional S-box pairs (SB1/SB2) and uses a pure GF(2) involutional diffusion matrix. Completes the SEED/LEA/ARIA Korean trio.
Standard cryptographic trade-offs apply.
eSTREAM hardware-profile finalist (2006). Uses a coupled 128-bit LFSR and NLFSR. Distinctive initialization feeds output back into both registers for 256 rounds. Completes the eSTREAM hardware pairing alongside Trivium.
Standard cryptographic trade-offs apply.
eSTREAM hardware-profile finalist (2005). Uses mutual clock control: two registers (R, S) where EACH register's clocking decision depends on the OTHER's state simultaneously. Completes the eSTREAM hardware trio alongside Trivium and Grain-128.
Standard cryptographic trade-offs apply.
Ukrainian national block cipher (DSTU 7624:2014). AES-family SPN supporting 128/256/512-bit blocks. Uses 4 distinct S-boxes applied in a round-dependent pattern. Begins Ukrainian national-suite representation.
Standard cryptographic trade-offs apply.
Chinese national stream cipher (GB/T 33133). Used in 4G LTE (128-EEA3). Uniquely uses a 16-stage LFSR over GF(2^31-1) with modular arithmetic, NOT simple XOR feedback. Completes the SM2/SM3/SM4/ZUC national suite.
Standard cryptographic trade-offs apply.
eSTREAM software-profile finalist (2005). Combines a 10-stage GF(2^32) LFSR with a Serpent-derived nonlinear FSM. Completes the eSTREAM software quartet alongside HC-128, Rabbit, and Salsa20.
Standard cryptographic trade-offs apply.
Energy-minimised lightweight block cipher (ASIACRYPT 2015). Bundle key schedule (k0, k1 alternated). Binary MixColumn (no GF multiplication). Lowest known energy-per-encryption.
Standard cryptographic trade-offs apply.
Tweakable block cipher (EUROCRYPT 2016). TWEAKEY framework: key and tweak treated uniformly through parallel sub-tweakey arrays with LFSR feedback. Core primitive of ROMULUS (NIST LWC Standard).
Standard cryptographic trade-offs apply.
Lightweight 64-bit Feistel block cipher (ICISC 2011). 80-bit key, 32 rounds. Uses 8 distinct 4-bit S-boxes (S0-S7) in round function, plus S8, S9 in key schedule. Strong provable security against differential/linear cryptanalysis.
Standard cryptographic trade-offs apply.
Tweakable low-latency block cipher (EUROCRYPT 2016). FKS reflection structure. Decryption is equivalent to encryption with swapped key halves. MANTIS-5 and MANTIS-7 variants.
Standard cryptographic trade-offs apply.
Ultra-lightweight 64-bit SPN block cipher (IEEE TIFS 2015). 4Γ16 bit-matrix state with bit-level W-layer row rotations [0, 1, 12, 13]. RECT80 (80-bit key) and RECT128 (128-bit key) variants, 25 rounds.
Standard cryptographic trade-offs apply.
Ultra-lightweight 64-bit block cipher (CHES 2011). Type-2 GFN with 4 distinct 4-bit S-boxes and GF(2^4) diffusion. PICCOLO-80 and PICCOLO-128 variants.
Standard cryptographic trade-offs apply.
Secure Hash Algorithm 2 with 64-bit words, producing a secure 512-bit digest.
Standard cryptographic trade-offs apply.
Chinese National Standard cryptographic hash function (GB/T 32905-2016). Produces a 256-bit message digest using 64 ARX compression rounds.
Standard cryptographic trade-offs apply.
HMAC-SHA256 provides keyed message authentication and integrity verification, ensuring data cannot be altered by an unauthorized party.
Requires both parties to hold the pre-shared secret key securely.
A MAC built entirely from AES block-cipher calls plus a GF(2^128) subkey-derivation step (NIST SP 800-38B) β no separate hash function, unlike HMAC. Composed from the existing AES module, no new dependencies.
Standard cryptographic trade-offs apply.
A space-efficient probabilistic data structure testing set membership with zero false negatives and a tunable false-positive probability.
Standard cryptographic trade-offs apply.
HMAC-based Extract-and-Expand Key Derivation Function (RFC 5869) that converts weak or shared input keying material into cryptographically strong output keys.
Standard cryptographic trade-offs apply.
The 32-bit-word sibling of BLAKE2b (2012), optimized for 8- to 32-bit platforms β smaller blocks, fewer rounds, 256-bit max output. Used internally by Argon2.
Standard cryptographic trade-offs apply.
A truncated SHA-2 family member (FIPS 180-4) with its OWN initial hash value β not simply SHA-256's output cut short, which is a deliberate design choice to prevent leaking one digest from the other.
Standard cryptographic trade-offs apply.
The 384-bit truncated member of the SHA-512 family (FIPS 180-4), with its own distinct initial hash value, same design principle as SHA-224 relative to SHA-256.
Standard cryptographic trade-offs apply.
RFC 8018 (PKCS #5). The most widely deployed KDF in the world (WPA2, iOS keychain). Iteratively applies HMAC to a password+salt. Slower iteration counts increase brute-force resistance.
Standard cryptographic trade-offs apply.
PHC Winner (2015), RFC 9106. Memory-hard password hashing with hybrid addressing (Argon2i for side-channel resistance, Argon2d for GPU resistance). Modern successor to bcrypt.
Standard cryptographic trade-offs apply.
SHA-3 finalist (Skein v1.3, 2010) by Schneier et al. Built on Threefish-256 via UBI (Unique Block Iteration) chaining β a Davies-Meyer construction. Pipeline: Config β Message β Output. Each block encrypted with Threefish-256 then XORed with plaintext. 256-bit output.
Standard cryptographic trade-offs apply.
Korean national hash standard (KS X 3262, 2014). Wide-pipe ARX+Boolean design with 1024-bit internal state. Completes the SEED/LEA/ARIA/LSH Korean cryptographic suite.
Standard cryptographic trade-offs apply.
Fast 192-bit hash designed for 64-bit processors (Anderson & Biham, 1995). Uses three 64-bit chaining variables and 3 passes of 8 rounds over four 256-entry 64-bit S-boxes. Fills the 192-bit output gap in this repo.
Standard cryptographic trade-offs apply.
SHA-3 finalist (2008). AES-based wide-pipe hash using dual permutations P and Q in a Davies-Meyer-like compression function. Operates on an 8x8 byte state with AES-style SubBytes/ShiftBytes/MixBytes rounds.
Standard cryptographic trade-offs apply.
SHA-3 finalist (2008). Fixed 1024-bit permutation with generalized AES-like rounds using 4-bit S-boxes and bit-level grouping permutation. Double message XOR injection. Completes the five-of-five SHA-3 finalist set.
Standard cryptographic trade-offs apply.
The ORIGINAL 2008 SHA-3 finalist. Uses HAIFA construction (explicit counter/salt per block) and ChaCha-lineage ARX compression. Distinct from the later, independently-designed BLAKE2/BLAKE3 descendants.
Standard cryptographic trade-offs apply.
Ukrainian national hash standard (DSTU 7564:2014). Uses Kalyna's SPN round structure in a Davies-Meyer construction. Completes the Ukrainian national suite alongside Kalyna.
Standard cryptographic trade-offs apply.
Sponge-construction hash (Bertoni, Daemen, Peeters, Van Assche, 2006). DIRECT PREDECESSOR TO KECCAK (SHA-3 winner). Introduced the sponge construction in essentially final form: mill (small nonlinear state) + belt (larger diffusion array). Distinct from Panama (different state shape, dual hash/stream mode). No successful attack documented. Status: secure.
Standard cryptographic trade-offs apply.
NIST Lightweight Cryptography Standard (SP 800-232, 2025). SPONGE MODE using the SAME Ascon permutation already implemented in ascon.ts for AEAD mode. Genuinely reuses the 5x64-bit-word permutation β only the surrounding construction differs (sponge absorb-then-squeeze vs. AEAD duplex). Status: secure.
Standard cryptographic trade-offs apply.
Fast tree-hashing XOF (Bertoni, Daemen et al., 2016). GENUINE REUSE of sha3.ts Keccak-p permutation, parameterized for 12 rounds instead of 24. TREE-HASHING STRUCTURE: input split into 8192-byte chunks processed independently (in principle, in parallel), then combined via root computation. Fundamentally different from sequential hashes. IRTF-documented. Status: secure.
Standard cryptographic trade-offs apply.
Widely adopted public-key cryptosystem used for key transport and digital signatures.
Requires large key sizes (minimum 2048/3072 bits) compared to ECC.
The finite-field discrete-log ancestor of ECDSA (NIST FIPS 186, 1994) β same r/s signature equation, computed in a prime-order subgroup instead of on a curve. Demo uses toy parameters; real DSA needs p>=2048 bits, q>=224 bits.
Standard cryptographic trade-offs apply.
A key exchange protocol enabling two parties to establish a shared secret over an insecure channel.
Standard cryptographic trade-offs apply.
Diffie-Hellman key exchange over Curve448 (RFC 7748) β the higher-security sibling of X25519, targeting ~224-bit security with 56-byte keys instead of X25519's 32-byte keys.
Standard cryptographic trade-offs apply.
Elliptic Curve Cryptography. Implements ECDSA signing and verification over the NIST P-256 curve.
Standard cryptographic trade-offs apply.
Schnorr signatures per BIP340 over secp256k1, using x-only public keys. Provably secure under a simpler assumption than ECDSA and supports clean signature aggregation (MuSig) β compare against ecdsa.ts on the same curve.
Standard cryptographic trade-offs apply.
The ElGamal signature scheme (1985) β distinct from ElGamal encryption already in this registry. Historically the direct ancestor of DSA: DSA is this scheme computed in a smaller prime-order subgroup for shorter signatures.
Standard cryptographic trade-offs apply.
Post-quantum digital signatures (NIST FIPS 204, formerly Dilithium), pairing with ML-KEM the same way Ed25519 pairs with X25519 classically β except the hard problem here is lattice-based (Module-LWE/SIS), not elliptic-curve discrete log.
Standard cryptographic trade-offs apply.
Hybrid encryption: ephemeral X25519 key agreement + HKDF + AEAD, letting a sender encrypt an arbitrary-length message directly to a recipient's public key β no other asymmetric module here does this end-to-end.
Standard cryptographic trade-offs apply.
Post-quantum key encapsulation (NIST FIPS 203, formerly Kyber), based on the Module Learning With Errors lattice problem β secure against both classical and quantum attackers, unlike every other asymmetric module here.
Standard cryptographic trade-offs apply.
Post-quantum key encapsulation mechanism (KEM) based on unstructured Learning With Errors (LWE) on standard matrices, offering conservative security without algebraic ring assumptions.
Standard cryptographic trade-offs apply.
EdDSA signatures over Curve448 (RFC 8032) β the higher-security-margin sibling of Ed25519, using SHAKE256 internally instead of SHA-512. Completes the Curve25519/Curve448 x agreement/signing grid alongside x25519, x448, and ed25519.
Standard cryptographic trade-offs apply.
A threshold scheme (1979): splits a secret into N shares such that any K reconstruct it, but K-1 reveal nothing. Uses GF(256) polynomial arithmetic β a different mathematical toolkit from every other module here.
Standard cryptographic trade-offs apply.
Lattice-based public-key cryptosystem (IEEE P1363.1, 1996). Operates in polynomial ring Z[x]/(x^N-1). Predates NIST PQC by 20+ years. WARNING: Visualizer uses small pedagogical parameters (N=11) for teaching; NOT secure at this size.
Standard cryptographic trade-offs apply.
Russian national elliptic-curve signature standard (RFC 7091). Uses Streebog-256 and an addition-based signing equation with a unique e=0 -> e=1 edge case. Completes the GOST/Kuznyechik/Streebog Russian suite.
Standard cryptographic trade-offs apply.
Code-based Post-Quantum KEM (NIST PQC Finalist, 1978). Security rests on decoding random linear codes. WARNING: Visualizer uses small pedagogical parameters (n=15) for teaching; NOT secure at this size. Real McEliece has an exceptionally long unbroken track record.
Standard cryptographic trade-offs apply.
First practical IND-CCA2-secure public-key scheme in the standard model (1998). Extends ElGamal with 5 secret exponents and a hash-based integrity check that rejects tampered ciphertexts.
Standard cryptographic trade-offs apply.
Chinese national elliptic-curve signature standard (GB/T 32918). Uses a distinct ZA hash prefix incorporating the signer ID and curve parameters before hashing the message. Completes the SM2+SM3+SM4 Chinese suite.
Standard cryptographic trade-offs apply.
Korean national digital signature standard. DSA-family but hashes Message || w (commitment) instead of just Message. Note: Uses LSH-256 as a modernized substitute for the original HAS-160 pairing. Completes the Korean national suite.
Standard cryptographic trade-offs apply.
First semantically-secure (IND-CPA) public-key scheme (1982). Based on Quadratic Residuosity. Deliberately probabilistic: encrypts bit-by-bit with massive ciphertext expansion to achieve semantic security.
Standard cryptographic trade-offs apply.
Pairing-based digital signatures (2001). Defining feature: Signature Aggregation. Multiple signatures can be combined into one compact signature verifiable against all original public keys. Used in multi-party consensus protocols and aggregate signatures. (Toy pairing model for visualizer).
Standard cryptographic trade-offs apply.
Identity-Based Encryption (2001). The public key IS an arbitrary string (e.g., email). No PKI needed. A trusted Private Key Generator (PKG) derives private keys. Novel category: encrypt before recipient even exists.
Standard cryptographic trade-offs apply.
Foundational LWE encryption (2005). The NOT-broken textbook predecessor to ML-KEM. Encodes bits by adding a large offset (floor(q/2)) hidden by small LWE noise. Explicitly distinguished from broken predecessors like GGH/SIDH.
Standard cryptographic trade-offs apply.
Probabilistic additively-homomorphic encryption (EUROCRYPT 1998). Modulus n=pΒ²q (distinct from RSA/Paillier/GM). DEFINING ASYMMETRY: decryption uses only p, never q. Positioned between Goldwasser-Micali (probabilistic predecessor) and Paillier (homomorphic descendant).
Standard cryptographic trade-offs apply.
Isogeny-based signature scheme (2020). NIST PQC candidate. Proves knowledge of an isogeny WITHOUT publishing torsion-point images, specifically avoiding the Castryck-Decru attack that broke SIDH. Shows isogeny cryptography survived where SIDH did not.
Standard cryptographic trade-offs apply.
Authenticated key agreement (Menezes-Qu-Vanstone, 1995). Bakes mutual authentication DIRECTLY INTO the key-agreement math by mixing long-term static keys with fresh ephemeral keys β no separate signature/certificate exchange needed. Distinct from unauthenticated DH/X25519/X448. Status: secure (with documented KCI nuance).
Standard cryptographic trade-offs apply.
NIST PQC standardized signature (FIPS 206). NTRU-lattice + Fast Fourier sampling over a four-polynomial trapdoor (f,g,F,G satisfying fG-gF=q). Produces notably COMPACT signatures vs. ML-DSA, at the cost of numerically delicate floating-point signing. Status: secure.
Standard cryptographic trade-offs apply.
DUAL of Classic McEliece (1986). Syndrome-based code encryption: message encoded as exact-weight-t error vector, ciphertext is ONLY the (n-k)-bit syndrome β substantially SHORTER than McEliece's n-bit codeword. Proven equivalent in security. Toy parameters for visualizer.
Standard cryptographic trade-offs apply.
Lamport One-Time Signature (1979). Hash-based: sign each bit of the message hash by revealing one of two pre-hashed secrets. β One-time use only. Foundational building block of XMSS.
Standard cryptographic trade-offs apply.
Winternitz One-Time Signature. Extends Lamport OTS using SHA-256 hash chains of length 2^w β 1. Predecessor of WOTS+ (XMSS) and LM-OTS (LMS). β One-time use only.
Standard cryptographic trade-offs apply.
SHA-3 finalist. ARX double-pipe compression. No S-boxes, no MDS matrices, no field arithmetic. Supports 224/256/384/512-bit output.
Standard cryptographic trade-offs apply.
SHA-3 finalist (Daniel Bernstein). Configurable r/b/h hypercube sponge. 128-byte state, 10 mixing steps per round (only additions, rotations, XOR, swaps β no S-boxes).
Standard cryptographic trade-offs apply.
Short-input hash function (v2). AES-based, optimized for 32 or 64 byte inputs. Used in SPHINCS+ Haraka parameter sets. Fixed-length inputs only.
Standard cryptographic trade-offs apply.
SHA-3 finalist. Asymmetric permutation over a large rolling state (A, B, C registers). Stream-cipher-like update. Supports 192/224/256/384/512-bit output.
Standard cryptographic trade-offs apply.
SHA-3 finalist (NEC Europe). Multi-channel message queue sponge: 3β5 parallel 256-bit chains, Q permutation (SubCrumb + MixWord). Staggered message injection.
Standard cryptographic trade-offs apply.
An extendable-output function (XOF, NIST FIPS 202) β unlike every other hash here, output length is a parameter you choose, not fixed. Same Keccak permutation family as SHA-3.
Standard cryptographic trade-offs apply.
The wider-capacity sibling of SHAKE128 (NIST FIPS 202) β same extendable-output design, larger security margin.
Standard cryptographic trade-offs apply.
IBM SHA-3 finalist. Accumulative sponge with TIX/CMIX/SMIX (AES SuperSBox). Supports 224/256/384/512-bit outputs.
Standard cryptographic trade-offs apply.
NIST PQC Round 4 Candidate KEM. Ring: Z[x]/(x^761 - x - 1), Modulus q = 4591. Resistant to subfield attacks.
Standard cryptographic trade-offs apply.
Commutative Supersingular Isogeny Diffie-Hellman (ASIACRYPT 2018). Post-quantum non-interactive key exchange. Ideal class group action over GF(p).
Standard cryptographic trade-offs apply.
NIST PQC Round 4 candidate KEM based on QC-MDPC codes with BGF decoder. Code-based security (no lattice or number-theoretic assumptions). Compact key sizes compared to Classic McEliece.
Standard cryptographic trade-offs apply.
eSTREAM Phase 3 stream cipher (ISO/IEC 29192-3). Three coupled 93/84/111-bit NLFSRs with 288-bit total state. 80-bit key, 80-bit IV, 1152 warm-up clocks before keystream. Most analysed stream cipher β one AND gate per output bit in hardware. Output = IV(20 hex) + ciphertext.
Standard cryptographic trade-offs apply.
Ultra-lightweight block cipher (ISO/IEC 29192-2:2012). Smallest standardised cipher: PRESENT-80 fits in 1,075 gate equivalents β vs AES's ~3,400 GE. 64-bit block, 80 or 128-bit key, 31-round SPN with a 4-bit S-box and a 64-bit bit-permutation P-layer.
Standard cryptographic trade-offs apply.
The original 1994 predecessor to XTEA (also in this registry). Simple ARX Feistel cipher, no S-boxes β but has a documented equivalent-key weakness (4 related keys produce identical ciphertext), which XTEA's extra key mixing was designed specifically to fix.
Standard cryptographic trade-offs apply.
Corrected Block TEA (Wheeler & Needham, 1998). The final and strongest member of the TEA family. Unlike TEA/XTEA, it operates on the entire message as a single variable-length block (min 2 words) for full diffusion. Widely used historically but unauthenticated.
Standard cryptographic trade-offs apply.
Bruce Schneier's 1993 Feistel block cipher β pre-AES era workhorse used in SSH, OpenSSH, and the bcrypt key schedule. Unique for its key-dependent S-box structure: the 4Γ256 S-boxes are entirely re-derived from each key, making it immune to weak-key attacks that plagued DES.
Standard cryptographic trade-offs apply.
Korean national block cipher (RFC 4269, 2005; ISO/IEC 18033-3). Mandatory in Korean financial and government systems for over a decade. 128-bit block, 128-bit key, 16-round Feistel with G-function using two GF(2^8)-derived S-boxes. Superseded by LEA for new Korean deployments.
Standard cryptographic trade-offs apply.
AES candidate (1998) and original Bluetooth pairing cipher. Byte-oriented SPN using modular exponentiation (45^x mod 257) for non-linearity and an Armenian Pseudo-Hadamard Transform network for diffusion.
Standard cryptographic trade-offs apply.
AES candidate (1998). 128-bit block Feistel network that uses full DES as its round function. Demonstrates building a larger cipher from an existing trusted primitive. Status: legacy.
Standard cryptographic trade-offs apply.
Rivest's key-whitening extension of DES (1984). C = k2 XOR DES(k1, k0 XOR P). Demonstrates pure input/output whitening without modifying DES internals. Status: legacy (Kilian-Rogaway bound is weaker than naive 184-bit addition).
Standard cryptographic trade-offs apply.
Ralph Merkle's 1990 block cipher. 64-bit block, 512-bit key. Defining feature: the 1KB S-box is entirely derived from the key, meaning every key uses a different substitution table. Status: legacy (64-bit block too small for modern use).
Standard cryptographic trade-offs apply.
Australian AES candidate (1998). Uniquely uses exponentiation in GF(2^64) to generate its S-box non-linearity, a fundamentally different algebraic source than the GF(2^8) tables used by AES/SM4/ARIA. Status: legacy.
Standard cryptographic trade-offs apply.
Software-optimized stream cipher (Rogaway & Coppersmith, 1993). Implements SEAL 3.0 (corrected). All cryptographic work front-loaded into one-time SHA-1-derived table setup; keystream generation is pure table lookup with ZERO further mixing. Contrasts with HC-128's self-updating tables. Status: legacy (age, fixed 160-bit key).
Standard cryptographic trade-offs apply.
NESSIE-submitted software-speed stream cipher (Rose & Hawkes, 2003). COMPLETELY FIXED 17-stage GF(2^32) LFSR + COMPLETELY FIXED S-box nonlinear filter β neither self-updates (unlike HC-128) nor is externally hash-derived (unlike SEAL). Status: legacy.
Standard cryptographic trade-offs apply.
Korean AES competition submission (1998) β NOT a Korean national standard (distinct from SEED/LEA/ARIA which are official standards). Uses 2 S-box types Γ 4 position variants and a bit-permutation diffusion layer distinct from AES's ShiftRows+MixColumns. Status: legacy (first-round elimination, limited scrutiny).
Standard cryptographic trade-offs apply.
Word Auto Key Encryption (David Wheeler, 1993). Stream cipher with a 256-entry 32-bit table that is CONTINUOUSLY UPDATED during keystream generation β each output word feeds back to overwrite a table entry, making the table data-dependent. Distinct from HC-128/SEAL/Turing. Status: legacy.
Standard cryptographic trade-offs apply.
Toshiba CRYPTREC candidate (2000). Distinctive NESTED SPN: each outer round contains TWO XS-box sub-layers (byte substitution + small internal MDS diffusion) with outer MDS-L diffusion between them β two distinct diffusion scales within one round. Status: legacy (lower CRYPTREC tier than Camellia).
Standard cryptographic trade-offs apply.
Ultra-low-latency 64-bit block cipher (ASIACRYPT 2012). FKS construction with an Ξ±-reflection property: decryption is structurally equivalent to encryption with a modified key (kβ', kβ β Ξ±). 12-round SPN targeting hardware-constrained IoT.
Standard cryptographic trade-offs apply.
NTT AES Round 1 candidate (1998). Direct historical predecessor to Camellia. 128-bit Feistel with byte-oriented S-box + BRL binary matrix diffusion, plus outer whitening layers. Status: legacy (superseded by Camellia).
Standard cryptographic trade-offs apply.
Ultra-compact Type-2 Generalised Feistel cipher (NTT Japan, 2013). 64-bit block, 36 rounds, 4-bit S-box, nibble permutation diffusion. Targets hardware < 2000 GE.
Standard cryptographic trade-offs apply.
RFC 2144 block cipher with 64-bit blocks and a 40β128-bit variable-length key. 16-round Feistel (12 rounds for keys β€80 bits) with four bent-function-derived S-boxes and three heterogeneous round function types. Historically mandatory in PGP/OpenPGP and early SSH.
Standard cryptographic trade-offs apply.
Ultra-lightweight block cipher (CHES 2011). NO key schedule; raw user key XOR'd into state every 4 rounds. AES-inspired SPN with 4-bit S-box. LED-64 and LED-128 variants.
Standard cryptographic trade-offs apply.
SHA-3 finalist. HAIFA construction with AES-based compression and counter injection. Prevents length-extension attacks. SHAvite-3-256 and SHAvite-3-512 variants.
Standard cryptographic trade-offs apply.
SHA-3 finalist (2008). BIG-AES compression paradigm: AES round components applied to 4Γ4 matrix of 128-bit (ECHO-256) or 256-bit (ECHO-512) words. Wide-pipe design with 2048/4096-bit internal state.
Standard cryptographic trade-offs apply.
SHA-3 finalist. Bitslice-parallel Serpent S7 sponge. Hamsi-256 and Hamsi-512 variants. Surpassed by BLAKE2 in practice.
Standard cryptographic trade-offs apply.
128-bit output sibling of RIPEMD-160. Dual-parallel-line MD4-family design with distinct tables from its 160-bit counterpart. Status: legacy (128-bit output too short for modern collision resistance).
Standard cryptographic trade-offs apply.
Configurable hash (1992). Unique in offering independent control over round count (3/4/5 passes) and output length (128-256 bits). Status: legacy (weaker at 3-pass/128-bit, stronger at 5-pass/256-bit).
Standard cryptographic trade-offs apply.
Original Russian national hash standard (1994-2013). Uses GOST 28147-89 block cipher internally with a distinctive P-transformation key-mixing step. Superseded by Streebog. Status: legacy.
Standard cryptographic trade-offs apply.
Merkle's 1990 hash design. Uses 4 large 256x32-bit S-boxes. Configurable passes (2/4) and output (128/256). Status: legacy (2-pass is weak, 4-pass is stronger). Complements Merkle-Hellman in the repo.
Standard cryptographic trade-offs apply.
Korean national hash standard (TTAS.KO-12.0011). Structurally similar to SHA-1 but with distinct message scheduling and constants. Originally specified to pair with KCDSA. Status: legacy (160-bit output).
Standard cryptographic trade-offs apply.
Daemen & Clapp (1998). Dual-mode primitive (Hash/Stream). This visualizer covers Hash mode only. Uses a massive 32-stage buffer + 17-word state. Daemen-lineage connection to 3-Way/Square. Status: legacy.
Standard cryptographic trade-offs apply.
ISO/IEC 10118-3. Two-lane parallel RIPEMD-128 with swaps. β NOT a security upgrade over 128-bit.
Standard cryptographic trade-offs apply.
ISO/IEC 10118-3. Two-lane parallel RIPEMD-160 with swaps. β NOT a security upgrade over 160-bit.
Standard cryptographic trade-offs apply.
A simple shift substitution cipher where each letter in the plaintext is shifted by a fixed number of positions.
Standard cryptographic trade-offs apply.
A special case of Caesar cipher with a fixed shift value of 13.
Standard cryptographic trade-offs apply.
A polyalphabetic substitution cipher that uses a keyword to shift characters in repeating cycles.
Standard cryptographic trade-offs apply.
A monoalphabetic substitution cipher formed by reversing the alphabet (A becomes Z, B becomes Y, etc.).
Standard cryptographic trade-offs apply.
A polygraphic substitution cipher that encrypts pairs of letters using a dynamic 5x5 key matrix.
Standard cryptographic trade-offs apply.
A transposition cipher where plaintext is written diagonally down and up on successive "rails" of a fence.
Standard cryptographic trade-offs apply.
A simple stream cipher performing byte-wise XOR operations between plaintext and key.
Standard cryptographic trade-offs apply.
Data Encryption Standard. A legacy 64-bit block cipher utilizing a 56-bit key size.
Standard cryptographic trade-offs apply.
Applies the DES algorithm three times to each data block with two or three keys to increase security.
Standard cryptographic trade-offs apply.
Ron Rivest's 1987 variable-key block cipher (RFC 2268). First cipher exportable from the US under 1990s export controls via "effective key bits" parameter. Used in SSL 2/3, TLS, and S/MIME. Mix-and-mash round structure. Historical/educational only β broken at β€40-bit effective keys.
Standard cryptographic trade-offs apply.
The historical WWII 3-rotor Wehrmacht cipher machine, with plugboard and reflector. Self-reciprocal (same settings encrypt and decrypt), and β a real historical weakness β no letter ever maps to itself.
Standard cryptographic trade-offs apply.
Direct historical predecessor to Rijndael (AES) by Daemen & Rijmen (1997). Structurally defined the AES template but uses a distinct S-box and matrix. Status: BROKEN by the "Square attack" (integral cryptanalysis).
Standard cryptographic trade-offs apply.
Japanese Feistel cipher (1987). Pure arithmetic design (no S-boxes). Status: BROKEN. Canonical target for differential cryptanalysis development. Included to demonstrate why differential characteristics are traceable in weak designs.
Standard cryptographic trade-offs apply.
3GPP TS 35.202 (GSM A5/3, UMTS f8/f9). MISTY1-derived hardware-optimized cipher. Status: BROKEN (2010 related-key attack). Included for educational value as a once-deployed mobile standard.
Standard cryptographic trade-offs apply.
Joan Daemen's first cipher (1994). 96-bit block/key, 11 rounds. Defines three-fold cyclic symmetry where every sub-transform commutes with word rotation. Direct predecessor to Square and AES. Status: BROKEN.
Standard cryptographic trade-offs apply.
Original GSM voice encryption (1987). Uses 3 LFSRs with irregular majority-vote clocking. Status: BROKEN. Comprehensively broken in real-world scenarios via rainbow tables. Predecessor to KASUMI/A5-3.
Standard cryptographic trade-offs apply.
Horst Feistel's original cipher (~1971) and the namesake of the Feistel network. Direct predecessor to DES. Uniquely uses a key-controlled bit to select which of two S-boxes applies per byte. Status: BROKEN.
Standard cryptographic trade-offs apply.
Earliest predecessor in the SHARK->Square->AES lineage (1996). 64-bit block, full 8x8 MDS diffusion every round. Status: broken (vulnerable to same integral attacks as Square).
Standard cryptographic trade-offs apply.
A widely used legacy hash producing a 128-bit output. Cryptographically broken due to collision vulnerabilities.
Standard cryptographic trade-offs apply.
A very fast non-cryptographic 32-bit hash used for checksums, hash tables, and data integrity demos.
Standard cryptographic trade-offs apply.
The direct predecessor to MD5 (1990) β fully broken today. Simpler than MD5: only 3 rounds (vs MD5's 4) and no additive per-step constants, illustrating exactly what MD5 was designed to fix.
Standard cryptographic trade-offs apply.
Earliest MD-family hash (RFC 1319, 1989). Byte-oriented with a distinctive 16-byte checksum block appended before compression. Status: BROKEN (severe weaknesses). Completes the MD2->MD4->MD5 lineage.
Standard cryptographic trade-offs apply.
NTT Japan hash (1990). Uses FEAL-style addition-and-rotation nonlinearity in a Davies-Meyer construction. NO S-BOXES. Status: BROKEN (differential cryptanalysis, shared lineage with FEAL).
Standard cryptographic trade-offs apply.
β οΈ BROKEN β SHA-3 first-round candidate. Quasigroup string transformations. Collision attacks (Mendel et al., 2009) reduce Edon-R256 to ~2^17. Educational and historical use only.
Standard cryptographic trade-offs apply.
Isogeny-based key exchange (SIKE). Status: FULLY BROKEN (2022). Included as an educational case study demonstrating how a promising NIST PQC candidate was completely broken via classical mathematics exploiting auxiliary torsion-point data.
Standard cryptographic trade-offs apply.
Early lattice cryptosystem (1997). Uses good/bad basis pairs. Status: BROKEN unconditionally. Nguyen (1999) showed the specific error-vector distribution leaked structural information, making CVP trivial. Educational complement to secure NTRU/ML-KEM.
Standard cryptographic trade-offs apply.
Knapsack cryptosystem disguised via discrete logarithms in the field extension GF(p^h) β genuinely more elaborate than Merkle-Hellman's modular-multiplication disguise. FIXED HAMMING WEIGHT constraint on messages. Status: BROKEN (Vaudenay 1998, targeting the GF(p^h) construction β distinct break from Merkle-Hellman's Shamir attack).
Standard cryptographic trade-offs apply.
Multivariate-quadratic signature scheme (Ding & Schmidt, 2005). NIST PQC ROUND 3 FINALIST, broken by Beullens (2022) in hours on a laptop β layered central map leaked exploitable algebraic structure. 4th major PQC family in this repo (alongside lattice/code-based/isogeny). Status: BROKEN unconditionally.
Standard cryptographic trade-offs apply.