Brokenclassical
Caesar Cipher
A simple shift substitution cipher where each letter in the plaintext is shifted by a fixed number of positions.
Loading CryptoViz...
Loading page content...Loading CryptoViz...
Loading page content...Standardized security classification badges for every algorithm in CryptoViz based on NIST SP 800-57 guidelines and modern cryptanalysis standards.
Understanding security status criteria and operational recommendations.
Actively recommended by NIST or equivalent standards bodies for new systems.
No known practical attacks. Suitable for production use in current systems.
Standardised but not yet widely deployed; may see parameter or API changes.
No longer recommended for new systems but still in use for interoperability.
Officially deprecated. Migrate away; support may be withdrawn in future tooling.
Practical attacks exist. Do NOT use for security-sensitive purposes.
Filter algorithms by lifecycle stage or search by name.
A simple shift substitution cipher where each letter in the plaintext is shifted by a fixed number of positions.
A special case of Caesar cipher with a fixed shift value of 13.
A polyalphabetic substitution cipher that uses a keyword to shift characters in repeating cycles.
A monoalphabetic substitution cipher formed by reversing the alphabet (A becomes Z, B becomes Y, etc.).
A polygraphic substitution cipher that encrypts pairs of letters using a dynamic 5x5 key matrix.
A transposition cipher where plaintext is written diagonally down and up on successive "rails" of a fence.
A simple stream cipher performing byte-wise XOR operations between plaintext and key.
An unbreakable cipher when used with a truly random, single-use key of equal length to the plaintext.
Data Encryption Standard. A legacy 64-bit block cipher utilizing a 56-bit key size.
Applies the DES algorithm three times to each data block with two or three keys to increase security.
A tweakable mode (IEEE P1619) for disk-sector encryption, composed from the existing AES module β the sector number IS the tweak, so no IV needs to be stored per sector. Confidentiality-only, no authentication tag (unlike AES-GCM).
Advanced Encryption Standard. A highly secure, standard block cipher supporting key sizes of 128, 192, or 256 bits.
A symmetric key block cipher jointly developed by Mitsubishi Electric and NTT, widely used and standardized (RFC 3713).
An AES finalist (1998, runner-up to Rijndael) with the largest security margin of the finalists β 32 rounds using 8 different S-boxes cycled per round, versus AES's single S-box.
RFC 8439 AEAD combining the existing ChaCha20 and Poly1305 modules β the software-oriented alternative to AES-GCM, used by TLS 1.3 and WireGuard when hardware AES acceleration isn't available.
An NSA lightweight ARX cipher (2013) using only addition, rotation, and XOR β no S-boxes or lookup tables at all, unlike every other symmetric cipher in this registry.
Counter with CBC-MAC (NIST SP 800-38C) β an authenticated mode composed from AES, contrasted with AES-GCM: authentication here is literal CBC-MAC re-running the block cipher, not GHASH polynomial evaluation.
A tweakable, large-block ARX cipher (2008) underlying the Skein hash function (a SHA-3 finalist). 256-bit block, 72 rounds, and a 128-bit tweak that varies ciphertext without changing the key β no other cipher here exposes a tweak input.
The 192-bit-nonce extension of ChaCha20 (used by libsodium) β an HChaCha20 subkey-derivation step, the ChaCha20 sibling of this batch's XSalsa20, lets you pick nonces randomly instead of managing a counter.
AES finalist by Bruce Schneier et al. (1998). 128-bit block, 128/192/256-bit keys, 16-round Feistel. Uses key-dependent S-boxes (derived via RS matrix over GF(2^8)), MDS matrix diffusion, PHT, and 40 subkeys. Used in GnuPG and VeraCrypt. Never broken.
The Soviet/Russian government standard block cipher (declassified 1994) β 256-bit key, 32-round Feistel. Uniquely, the S-boxes are a negotiated parameter, not fixed by the standard; this demo uses a published reference set.
Ron Rivest's 1987 variable-key block cipher (RFC 2268). First cipher exportable from the US under 1990s export controls via "effective key bits" parameter. Used in SSL 2/3, TLS, and S/MIME. Mix-and-mash round structure. Historical/educational only β broken at β€40-bit effective keys.
The historical WWII 3-rotor Wehrmacht cipher machine, with plugboard and reflector. Self-reciprocal (same settings encrypt and decrypt), and β a real historical weakness β no letter ever maps to itself.
NIST-selected lightweight cryptography standard (SP 800-232, 2023). Authenticated encryption with associated data (AEAD) β encrypts and authenticates simultaneously using a 320-bit sponge permutation. Designed for IoT and constrained devices. Output = nonce + ciphertext + 128-bit tag.
The 192-bit-nonce extension of Salsa20 (used by NaCl/libsodium) β an HSalsa20 subkey-derivation step lets you pick nonces randomly instead of managing a counter.
eSTREAM Phase 3 stream cipher (ISO/IEC 29192-3). Three coupled 93/84/111-bit NLFSRs with 288-bit total state. 80-bit key, 80-bit IV, 1152 warm-up clocks before keystream. Most analysed stream cipher β one AND gate per output bit in hardware. Output = IV(20 hex) + ciphertext.
Chinese national standard block cipher (GB/T 32907-2016, ISO/IEC 18033-3, RFC 8998). Mandatory in Chinese internet and financial infrastructure; now part of TLS 1.3 cipher suites. 128-bit block, 128-bit key, 32-round SPN with a single S-box and linear transform.
Ultra-lightweight block cipher (ISO/IEC 29192-2:2012). Smallest standardised cipher: PRESENT-80 fits in 1,075 gate equivalents β vs AES's ~3,400 GE. 64-bit block, 80 or 128-bit key, 31-round SPN with a 4-bit S-box and a 64-bit bit-permutation P-layer.
NSA lightweight block cipher targeting 8/16-bit microcontrollers. Uses 16-bit words, a 32-bit block, and a 64-bit key across 32 Feistel rounds. The smallest variant of the SIMON family.
The original 1994 predecessor to XTEA (also in this registry). Simple ARX Feistel cipher, no S-boxes β but has a documented equivalent-key weakness (4 related keys produce identical ciphertext), which XTEA's extra key mixing was designed specifically to fix.
NESSIE-submitted 128-bit block cipher. Unique for having ZERO lookup tables; its non-linear Gamma layer uses exactly 5 bitwise AND/OR/XOR operations. Ideal for VLSI/FPGA environments.
Korean lightweight ARX block cipher (IETF RFC 9998, 2024). Pure Add/Rotate/XOR β no S-boxes, making it 3β4Γ faster than AES on 32-bit processors. 128-bit block, 128/192/256-bit keys, 24/28/32 rounds. Used in Korean IoT and mobile applications.
Ultra-lightweight 64-bit block cipher (CHES 2017). Uses a 4-bit S-box and 28-round SPN. 5x more hardware-efficient than PRESENT and underlies the NIST Lightweight Finalist GIFT-COFB.
Corrected Block TEA (Wheeler & Needham, 1998). The final and strongest member of the TEA family. Unlike TEA/XTEA, it operates on the entire message as a single variable-length block (min 2 words) for full diffusion. Widely used historically but unauthenticated.
Bruce Schneier's 1993 Feistel block cipher β pre-AES era workhorse used in SSH, OpenSSH, and the bcrypt key schedule. Unique for its key-dependent S-box structure: the 4Γ256 S-boxes are entirely re-derived from each key, making it immune to weak-key attacks that plagued DES.
Russian national hash function (GOST R 34.11-2012, RFC 6986). 512-bit internal state processed through 12 rounds of a Kuznyechik-family SPN in a Miyaguchi-Preneel-like compression function, with a unique checksum-based finalization step.
Korean national block cipher (RFC 4269, 2005; ISO/IEC 18033-3). Mandatory in Korean financial and government systems for over a decade. 128-bit block, 128-bit key, 16-round Feistel with G-function using two GF(2^8)-derived S-boxes. Superseded by LEA for new Korean deployments.
Russian national block cipher (GOST R 34.12-2015, RFC 7801). 128-bit block, 256-bit key, 9-round SPN. Replaces the legacy 1989 GOST cipher. Uses a fixed 256-byte S-box and a linear transform built from 16 GF(2^8) feedback steps.
NSA hardware-optimised lightweight block cipher (IACR 2013/404). Sibling of SPECK β SIMON targets gate-minimal hardware via bitwise AND while SPECK targets software via ARX. 128-bit block, 128-bit key, 68-round Feistel. Round function: f(x)=(x<<<1 & x<<<8)βx<<<2.
eSTREAM Portfolio Phase 3 stream cipher (RFC 4503). 128-bit key, 64-bit IV. Distinctive non-linear counter system (no LFSR) using 64-bit squaring and XOR to generate 128 bits of keystream per iteration. Extremely fast in software.
eSTREAM Phase 3 software-profile stream cipher by Hongjun Wu. Uses two 512-word (2 KB each) key/IV-derived lookup tables P and Q that update themselves during keystream generation. The fastest stream cipher in the eSTREAM portfolio on 32-bit software. Output = IV(32 hex) + ciphertext.
NESSIE-submitted block cipher (2000). 128-bit block, 128/192/256-bit key. Unique involutional design: the S-box, diffusion layer, and round structure are all self-inverse. Decryption is literally the same code as encryption, just with reversed round keys.
IBM AES finalist (1998). 128-bit block, 32-round heterogeneous SPN. Unique for combining 4 different round types (forward mixing, forward E-rounds, backward E-rounds, backward mixing) for defense-in-depth. Lost to Rijndael (AES) on performance/simplicity, but unbroken.
ISO/IEC 29192-2 lightweight block cipher (Sony, 2007). 4-branch generalized Feistel network (GFN) with parallel F0/F1 functions using distinct S-boxes and diffusion matrices. Pairs with PRESENT to complete the ISO lightweight standard duo.
CRYPTREC-recommended, RFC 2994. 64-bit block, 128-bit key. Unique recursive Feistel network: main rounds call FO, which calls FI, which uses 7-bit/9-bit S-boxes. Ancestor of KASUMI (3G/GSM).
Direct historical predecessor to Rijndael (AES) by Daemen & Rijmen (1997). Structurally defined the AES template but uses a distinct S-box and matrix. Status: BROKEN by the "Square attack" (integral cryptanalysis).
Japanese Feistel cipher (1987). Pure arithmetic design (no S-boxes). Status: BROKEN. Canonical target for differential cryptanalysis development. Included to demonstrate why differential characteristics are traceable in weak designs.
AES candidate (1998) and original Bluetooth pairing cipher. Byte-oriented SPN using modular exponentiation (45^x mod 257) for non-linearity and an Armenian Pseudo-Hadamard Transform network for diffusion.
Korean national standard block cipher (KS X 1213, RFC 5794). AES-like SPN but alternates between two involutional S-box pairs (SB1/SB2) and uses a pure GF(2) involutional diffusion matrix. Completes the SEED/LEA/ARIA Korean trio.
3GPP TS 35.202 (GSM A5/3, UMTS f8/f9). MISTY1-derived hardware-optimized cipher. Status: BROKEN (2010 related-key attack). Included for educational value as a once-deployed mobile standard.
eSTREAM hardware-profile finalist (2006). Uses a coupled 128-bit LFSR and NLFSR. Distinctive initialization feeds output back into both registers for 256 rounds. Completes the eSTREAM hardware pairing alongside Trivium.
Joan Daemen's first cipher (1994). 96-bit block/key, 11 rounds. Defines three-fold cyclic symmetry where every sub-transform commutes with word rotation. Direct predecessor to Square and AES. Status: BROKEN.
Original GSM voice encryption (1987). Uses 3 LFSRs with irregular majority-vote clocking. Status: BROKEN. Comprehensively broken in real-world scenarios via rainbow tables. Predecessor to KASUMI/A5-3.
Horst Feistel's original cipher (~1971) and the namesake of the Feistel network. Direct predecessor to DES. Uniquely uses a key-controlled bit to select which of two S-boxes applies per byte. Status: BROKEN.
AES candidate (1998). 128-bit block Feistel network that uses full DES as its round function. Demonstrates building a larger cipher from an existing trusted primitive. Status: legacy.
Rivest's key-whitening extension of DES (1984). C = k2 XOR DES(k1, k0 XOR P). Demonstrates pure input/output whitening without modifying DES internals. Status: legacy (Kilian-Rogaway bound is weaker than naive 184-bit addition).
Ralph Merkle's 1990 block cipher. 64-bit block, 512-bit key. Defining feature: the 1KB S-box is entirely derived from the key, meaning every key uses a different substitution table. Status: legacy (64-bit block too small for modern use).
eSTREAM hardware-profile finalist (2005). Uses mutual clock control: two registers (R, S) where EACH register's clocking decision depends on the OTHER's state simultaneously. Completes the eSTREAM hardware trio alongside Trivium and Grain-128.
Ukrainian national block cipher (DSTU 7624:2014). AES-family SPN supporting 128/256/512-bit blocks. Uses 4 distinct S-boxes applied in a round-dependent pattern. Begins Ukrainian national-suite representation.
Chinese national stream cipher (GB/T 33133). Used in 4G LTE (128-EEA3). Uniquely uses a 16-stage LFSR over GF(2^31-1) with modular arithmetic, NOT simple XOR feedback. Completes the SM2/SM3/SM4/ZUC national suite.
eSTREAM software-profile finalist (2005). Combines a 10-stage GF(2^32) LFSR with a Serpent-derived nonlinear FSM. Completes the eSTREAM software quartet alongside HC-128, Rabbit, and Salsa20.
Australian AES candidate (1998). Uniquely uses exponentiation in GF(2^64) to generate its S-box non-linearity, a fundamentally different algebraic source than the GF(2^8) tables used by AES/SM4/ARIA. Status: legacy.
Software-optimized stream cipher (Rogaway & Coppersmith, 1993). Implements SEAL 3.0 (corrected). All cryptographic work front-loaded into one-time SHA-1-derived table setup; keystream generation is pure table lookup with ZERO further mixing. Contrasts with HC-128's self-updating tables. Status: legacy (age, fixed 160-bit key).
Earliest predecessor in the SHARK->Square->AES lineage (1996). 64-bit block, full 8x8 MDS diffusion every round. Status: broken (vulnerable to same integral attacks as Square).
NESSIE-submitted software-speed stream cipher (Rose & Hawkes, 2003). COMPLETELY FIXED 17-stage GF(2^32) LFSR + COMPLETELY FIXED S-box nonlinear filter β neither self-updates (unlike HC-128) nor is externally hash-derived (unlike SEAL). Status: legacy.
Korean AES competition submission (1998) β NOT a Korean national standard (distinct from SEED/LEA/ARIA which are official standards). Uses 2 S-box types Γ 4 position variants and a bit-permutation diffusion layer distinct from AES's ShiftRows+MixColumns. Status: legacy (first-round elimination, limited scrutiny).
Word Auto Key Encryption (David Wheeler, 1993). Stream cipher with a 256-entry 32-bit table that is CONTINUOUSLY UPDATED during keystream generation β each output word feeds back to overwrite a table entry, making the table data-dependent. Distinct from HC-128/SEAL/Turing. Status: legacy.
Toshiba CRYPTREC candidate (2000). Distinctive NESTED SPN: each outer round contains TWO XS-box sub-layers (byte substitution + small internal MDS diffusion) with outer MDS-L diffusion between them β two distinct diffusion scales within one round. Status: legacy (lower CRYPTREC tier than Camellia).
Ultra-low-latency 64-bit block cipher (ASIACRYPT 2012). FKS construction with an Ξ±-reflection property: decryption is structurally equivalent to encryption with a modified key (kβ', kβ β Ξ±). 12-round SPN targeting hardware-constrained IoT.
NTT AES Round 1 candidate (1998). Direct historical predecessor to Camellia. 128-bit Feistel with byte-oriented S-box + BRL binary matrix diffusion, plus outer whitening layers. Status: legacy (superseded by Camellia).
Ultra-compact Type-2 Generalised Feistel cipher (NTT Japan, 2013). 64-bit block, 36 rounds, 4-bit S-box, nibble permutation diffusion. Targets hardware < 2000 GE.
RFC 2144 block cipher with 64-bit blocks and a 40β128-bit variable-length key. 16-round Feistel (12 rounds for keys β€80 bits) with four bent-function-derived S-boxes and three heterogeneous round function types. Historically mandatory in PGP/OpenPGP and early SSH.
Energy-minimised lightweight block cipher (ASIACRYPT 2015). Bundle key schedule (k0, k1 alternated). Binary MixColumn (no GF multiplication). Lowest known energy-per-encryption.
Tweakable block cipher (EUROCRYPT 2016). TWEAKEY framework: key and tweak treated uniformly through parallel sub-tweakey arrays with LFSR feedback. Core primitive of ROMULUS (NIST LWC Standard).
Lightweight 64-bit Feistel block cipher (ICISC 2011). 80-bit key, 32 rounds. Uses 8 distinct 4-bit S-boxes (S0-S7) in round function, plus S8, S9 in key schedule. Strong provable security against differential/linear cryptanalysis.
Tweakable low-latency block cipher (EUROCRYPT 2016). FKS reflection structure. Decryption is equivalent to encryption with swapped key halves. MANTIS-5 and MANTIS-7 variants.
Ultra-lightweight block cipher (CHES 2011). NO key schedule; raw user key XOR'd into state every 4 rounds. AES-inspired SPN with 4-bit S-box. LED-64 and LED-128 variants.
IETF RFC 9106 AEAD. 8 parallel 128-bit AES states. Highest-throughput AEAD in the AEGIS family. 128-bit key + 128-bit nonce. 128/256-bit tag.
Ultra-lightweight 64-bit SPN block cipher (IEEE TIFS 2015). 4Γ16 bit-matrix state with bit-level W-layer row rotations [0, 1, 12, 13]. RECT80 (80-bit key) and RECT128 (128-bit key) variants, 25 rounds.
Ultra-lightweight 64-bit block cipher (CHES 2011). Type-2 GFN with 4 distinct 4-bit S-boxes and GF(2^4) diffusion. PICCOLO-80 and PICCOLO-128 variants.
Secure Hash Algorithm 2. Produces a unique 256-bit hash output representing the input message.
SHA-3 finalist. HAIFA construction with AES-based compression and counter injection. Prevents length-extension attacks. SHAvite-3-256 and SHAvite-3-512 variants.
SHA-3 finalist (2008). BIG-AES compression paradigm: AES round components applied to 4Γ4 matrix of 128-bit (ECHO-256) or 256-bit (ECHO-512) words. Wide-pipe design with 2048/4096-bit internal state.
SHA-3 finalist. Bitslice-parallel Serpent S7 sponge. Hamsi-256 and Hamsi-512 variants. Surpassed by BLAKE2 in practice.
SHA-3 finalist. ARX double-pipe compression. No S-boxes, no MDS matrices, no field arithmetic. Supports 224/256/384/512-bit output.
SHA-3 finalist (Daniel Bernstein). Configurable r/b/h hypercube sponge. 128-byte state, 10 mixing steps per round (only additions, rotations, XOR, swaps β no S-boxes).
Short-input hash function (v2). AES-based, optimized for 32 or 64 byte inputs. Used in SPHINCS+ Haraka parameter sets. Fixed-length inputs only.
SHA-3 finalist. Asymmetric permutation over a large rolling state (A, B, C registers). Stream-cipher-like update. Supports 192/224/256/384/512-bit output.
Secure Hash Algorithm 2 with 64-bit words, producing a secure 512-bit digest.
Chinese National Standard cryptographic hash function (GB/T 32905-2016). Produces a 256-bit message digest using 64 ARX compression rounds.
A widely used legacy hash producing a 128-bit output. Cryptographically broken due to collision vulnerabilities.
SHA-3 finalist (NEC Europe). Multi-channel message queue sponge: 3β5 parallel 256-bit chains, Q permutation (SubCrumb + MixWord). Staggered message injection.
Keyed-hash Message Authentication Code. Combines SHA-256 with a cryptographic secret key.
A MAC built entirely from AES block-cipher calls plus a GF(2^128) subkey-derivation step (NIST SP 800-38B) β no separate hash function, unlike HMAC. Composed from the existing AES module, no new dependencies.
A password hashing function incorporating a salt and cost factor, designed to be slow to prevent brute force.
A very fast non-cryptographic 32-bit hash used for checksums, hash tables, and data integrity demos.
A space-efficient probabilistic data structure testing set membership with zero false negatives and a tunable false-positive probability.
HMAC-based Extract-and-Expand Key Derivation Function (RFC 5869) that converts weak or shared input keying material into cryptographically strong output keys.
The 32-bit-word sibling of BLAKE2b (2012), optimized for 8- to 32-bit platforms β smaller blocks, fewer rounds, 256-bit max output. Used internally by Argon2.
A truncated SHA-2 family member (FIPS 180-4) with its OWN initial hash value β not simply SHA-256's output cut short, which is a deliberate design choice to prevent leaking one digest from the other.
The 384-bit truncated member of the SHA-512 family (FIPS 180-4), with its own distinct initial hash value, same design principle as SHA-224 relative to SHA-256.
An extendable-output function (XOF, NIST FIPS 202) β unlike every other hash here, output length is a parameter you choose, not fixed. Same Keccak permutation family as SHA-3.
The wider-capacity sibling of SHAKE128 (NIST FIPS 202) β same extendable-output design, larger security margin.
RFC 8018 (PKCS #5). The most widely deployed KDF in the world (WPA2, iOS keychain). Iteratively applies HMAC to a password+salt. Slower iteration counts increase brute-force resistance.
The direct predecessor to MD5 (1990) β fully broken today. Simpler than MD5: only 3 rounds (vs MD5's 4) and no additive per-step constants, illustrating exactly what MD5 was designed to fix.
PHC Winner (2015), RFC 9106. Memory-hard password hashing with hybrid addressing (Argon2i for side-channel resistance, Argon2d for GPU resistance). Modern successor to bcrypt.
SHA-3 finalist (Skein v1.3, 2010) by Schneier et al. Built on Threefish-256 via UBI (Unique Block Iteration) chaining β a Davies-Meyer construction. Pipeline: Config β Message β Output. Each block encrypted with Threefish-256 then XORed with plaintext. 256-bit output.
Korean national hash standard (KS X 3262, 2014). Wide-pipe ARX+Boolean design with 1024-bit internal state. Completes the SEED/LEA/ARIA/LSH Korean cryptographic suite.
Fast 192-bit hash designed for 64-bit processors (Anderson & Biham, 1995). Uses three 64-bit chaining variables and 3 passes of 8 rounds over four 256-entry 64-bit S-boxes. Fills the 192-bit output gap in this repo.
SHA-3 finalist (2008). AES-based wide-pipe hash using dual permutations P and Q in a Davies-Meyer-like compression function. Operates on an 8x8 byte state with AES-style SubBytes/ShiftBytes/MixBytes rounds.
SHA-3 finalist (2008). Fixed 1024-bit permutation with generalized AES-like rounds using 4-bit S-boxes and bit-level grouping permutation. Double message XOR injection. Completes the five-of-five SHA-3 finalist set.
128-bit output sibling of RIPEMD-160. Dual-parallel-line MD4-family design with distinct tables from its 160-bit counterpart. Status: legacy (128-bit output too short for modern collision resistance).
Configurable hash (1992). Unique in offering independent control over round count (3/4/5 passes) and output length (128-256 bits). Status: legacy (weaker at 3-pass/128-bit, stronger at 5-pass/256-bit).
Earliest MD-family hash (RFC 1319, 1989). Byte-oriented with a distinctive 16-byte checksum block appended before compression. Status: BROKEN (severe weaknesses). Completes the MD2->MD4->MD5 lineage.
Original Russian national hash standard (1994-2013). Uses GOST 28147-89 block cipher internally with a distinctive P-transformation key-mixing step. Superseded by Streebog. Status: legacy.
NTT Japan hash (1990). Uses FEAL-style addition-and-rotation nonlinearity in a Davies-Meyer construction. NO S-BOXES. Status: BROKEN (differential cryptanalysis, shared lineage with FEAL).
Merkle's 1990 hash design. Uses 4 large 256x32-bit S-boxes. Configurable passes (2/4) and output (128/256). Status: legacy (2-pass is weak, 4-pass is stronger). Complements Merkle-Hellman in the repo.
Korean national hash standard (TTAS.KO-12.0011). Structurally similar to SHA-1 but with distinct message scheduling and constants. Originally specified to pair with KCDSA. Status: legacy (160-bit output).
Daemen & Clapp (1998). Dual-mode primitive (Hash/Stream). This visualizer covers Hash mode only. Uses a massive 32-stage buffer + 17-word state. Daemen-lineage connection to 3-Way/Square. Status: legacy.
The ORIGINAL 2008 SHA-3 finalist. Uses HAIFA construction (explicit counter/salt per block) and ChaCha-lineage ARX compression. Distinct from the later, independently-designed BLAKE2/BLAKE3 descendants.
Ukrainian national hash standard (DSTU 7564:2014). Uses Kalyna's SPN round structure in a Davies-Meyer construction. Completes the Ukrainian national suite alongside Kalyna.
Sponge-construction hash (Bertoni, Daemen, Peeters, Van Assche, 2006). DIRECT PREDECESSOR TO KECCAK (SHA-3 winner). Introduced the sponge construction in essentially final form: mill (small nonlinear state) + belt (larger diffusion array). Distinct from Panama (different state shape, dual hash/stream mode). No successful attack documented. Status: secure.
NIST Lightweight Cryptography Standard (SP 800-232, 2025). SPONGE MODE using the SAME Ascon permutation already implemented in ascon.ts for AEAD mode. Genuinely reuses the 5x64-bit-word permutation β only the surrounding construction differs (sponge absorb-then-squeeze vs. AEAD duplex). Status: secure.
ISO/IEC 10118-3. Two-lane parallel RIPEMD-128 with swaps. β NOT a security upgrade over 128-bit.
ISO/IEC 10118-3. Two-lane parallel RIPEMD-160 with swaps. β NOT a security upgrade over 160-bit.
Fast tree-hashing XOF (Bertoni, Daemen et al., 2016). GENUINE REUSE of sha3.ts Keccak-p permutation, parameterized for 12 rounds instead of 24. TREE-HASHING STRUCTURE: input split into 8192-byte chunks processed independently (in principle, in parallel), then combined via root computation. Fundamentally different from sequential hashes. IRTF-documented. Status: secure.
IBM SHA-3 finalist. Accumulative sponge with TIX/CMIX/SMIX (AES SuperSBox). Supports 224/256/384/512-bit outputs.
β οΈ BROKEN β SHA-3 first-round candidate. Quasigroup string transformations. Collision attacks (Mendel et al., 2009) reduce Edon-R256 to ~2^17. Educational and historical use only.
An asymmetric cipher based on the difficulty of factoring large semiprimes. Supports key generation, encryption, and decryption.
The finite-field discrete-log ancestor of ECDSA (NIST FIPS 186, 1994) β same r/s signature equation, computed in a prime-order subgroup instead of on a curve. Demo uses toy parameters; real DSA needs p>=2048 bits, q>=224 bits.
A key exchange protocol enabling two parties to establish a shared secret over an insecure channel.
Diffie-Hellman key exchange over Curve448 (RFC 7748) β the higher-security sibling of X25519, targeting ~224-bit security with 56-byte keys instead of X25519's 32-byte keys.
Elliptic Curve Cryptography. Implements ECDSA signing and verification over the NIST P-256 curve.
Schnorr signatures per BIP340 over secp256k1, using x-only public keys. Provably secure under a simpler assumption than ECDSA and supports clean signature aggregation (MuSig) β compare against ecdsa.ts on the same curve.
The ElGamal signature scheme (1985) β distinct from ElGamal encryption already in this registry. Historically the direct ancestor of DSA: DSA is this scheme computed in a smaller prime-order subgroup for shorter signatures.
Post-quantum digital signatures (NIST FIPS 204, formerly Dilithium), pairing with ML-KEM the same way Ed25519 pairs with X25519 classically β except the hard problem here is lattice-based (Module-LWE/SIS), not elliptic-curve discrete log.
Hybrid encryption: ephemeral X25519 key agreement + HKDF + AEAD, letting a sender encrypt an arbitrary-length message directly to a recipient's public key β no other asymmetric module here does this end-to-end.
Post-quantum key encapsulation (NIST FIPS 203, formerly Kyber), based on the Module Learning With Errors lattice problem β secure against both classical and quantum attackers, unlike every other asymmetric module here.
Post-quantum key encapsulation mechanism (KEM) based on unstructured Learning With Errors (LWE) on standard matrices, offering conservative security without algebraic ring assumptions.
EdDSA signatures over Curve448 (RFC 8032) β the higher-security-margin sibling of Ed25519, using SHAKE256 internally instead of SHA-512. Completes the Curve25519/Curve448 x agreement/signing grid alongside x25519, x448, and ed25519.
A threshold scheme (1979): splits a secret into N shares such that any K reconstruct it, but K-1 reveal nothing. Uses GF(256) polynomial arithmetic β a different mathematical toolkit from every other module here.
Isogeny-based key exchange (SIKE). Status: FULLY BROKEN (2022). Included as an educational case study demonstrating how a promising NIST PQC candidate was completely broken via classical mathematics exploiting auxiliary torsion-point data.
Lattice-based public-key cryptosystem (IEEE P1363.1, 1996). Operates in polynomial ring Z[x]/(x^N-1). Predates NIST PQC by 20+ years. WARNING: Visualizer uses small pedagogical parameters (N=11) for teaching; NOT secure at this size.
Russian national elliptic-curve signature standard (RFC 7091). Uses Streebog-256 and an addition-based signing equation with a unique e=0 -> e=1 edge case. Completes the GOST/Kuznyechik/Streebog Russian suite.
Code-based Post-Quantum KEM (NIST PQC Finalist, 1978). Security rests on decoding random linear codes. WARNING: Visualizer uses small pedagogical parameters (n=15) for teaching; NOT secure at this size. Real McEliece has an exceptionally long unbroken track record.
First practical IND-CCA2-secure public-key scheme in the standard model (1998). Extends ElGamal with 5 secret exponents and a hash-based integrity check that rejects tampered ciphertexts.
Chinese national elliptic-curve signature standard (GB/T 32918). Uses a distinct ZA hash prefix incorporating the signer ID and curve parameters before hashing the message. Completes the SM2+SM3+SM4 Chinese suite.
Korean national digital signature standard. DSA-family but hashes Message || w (commitment) instead of just Message. Note: Uses LSH-256 as a modernized substitute for the original HAS-160 pairing. Completes the Korean national suite.
First semantically-secure (IND-CPA) public-key scheme (1982). Based on Quadratic Residuosity. Deliberately probabilistic: encrypts bit-by-bit with massive ciphertext expansion to achieve semantic security.
Early lattice cryptosystem (1997). Uses good/bad basis pairs. Status: BROKEN unconditionally. Nguyen (1999) showed the specific error-vector distribution leaked structural information, making CVP trivial. Educational complement to secure NTRU/ML-KEM.
Pairing-based digital signatures (2001). Defining feature: Signature Aggregation. Multiple signatures can be combined into one compact signature verifiable against all original public keys. Used in multi-party consensus protocols and aggregate signatures. (Toy pairing model for visualizer).
Identity-Based Encryption (2001). The public key IS an arbitrary string (e.g., email). No PKI needed. A trusted Private Key Generator (PKG) derives private keys. Novel category: encrypt before recipient even exists.
Foundational LWE encryption (2005). The NOT-broken textbook predecessor to ML-KEM. Encodes bits by adding a large offset (floor(q/2)) hidden by small LWE noise. Explicitly distinguished from broken predecessors like GGH/SIDH.
Probabilistic additively-homomorphic encryption (EUROCRYPT 1998). Modulus n=pΒ²q (distinct from RSA/Paillier/GM). DEFINING ASYMMETRY: decryption uses only p, never q. Positioned between Goldwasser-Micali (probabilistic predecessor) and Paillier (homomorphic descendant).
Isogeny-based signature scheme (2020). NIST PQC candidate. Proves knowledge of an isogeny WITHOUT publishing torsion-point images, specifically avoiding the Castryck-Decru attack that broke SIDH. Shows isogeny cryptography survived where SIDH did not.
Knapsack cryptosystem disguised via discrete logarithms in the field extension GF(p^h) β genuinely more elaborate than Merkle-Hellman's modular-multiplication disguise. FIXED HAMMING WEIGHT constraint on messages. Status: BROKEN (Vaudenay 1998, targeting the GF(p^h) construction β distinct break from Merkle-Hellman's Shamir attack).
Multivariate-quadratic signature scheme (Ding & Schmidt, 2005). NIST PQC ROUND 3 FINALIST, broken by Beullens (2022) in hours on a laptop β layered central map leaked exploitable algebraic structure. 4th major PQC family in this repo (alongside lattice/code-based/isogeny). Status: BROKEN unconditionally.
Authenticated key agreement (Menezes-Qu-Vanstone, 1995). Bakes mutual authentication DIRECTLY INTO the key-agreement math by mixing long-term static keys with fresh ephemeral keys β no separate signature/certificate exchange needed. Distinct from unauthenticated DH/X25519/X448. Status: secure (with documented KCI nuance).
NIST PQC standardized signature (FIPS 206). NTRU-lattice + Fast Fourier sampling over a four-polynomial trapdoor (f,g,F,G satisfying fG-gF=q). Produces notably COMPACT signatures vs. ML-DSA, at the cost of numerically delicate floating-point signing. Status: secure.
DUAL of Classic McEliece (1986). Syndrome-based code encryption: message encoded as exact-weight-t error vector, ciphertext is ONLY the (n-k)-bit syndrome β substantially SHORTER than McEliece's n-bit codeword. Proven equivalent in security. Toy parameters for visualizer.
RFC 8391 stateful hash-based signature. WOTS+ chains + Merkle tree. Quantum-safe. β Stateful: leaf index must never be reused.
RFC 8554 stateful hash-based signature. LM-OTS chains + Merkle tree. Quantum-safe. β Stateful.
Lamport One-Time Signature (1979). Hash-based: sign each bit of the message hash by revealing one of two pre-hashed secrets. β One-time use only. Foundational building block of XMSS.
NIST PQC Round 4 Candidate KEM. Ring: Z[x]/(x^761 - x - 1), Modulus q = 4591. Resistant to subfield attacks.
Winternitz One-Time Signature. Extends Lamport OTS using SHA-256 hash chains of length 2^w β 1. Predecessor of WOTS+ (XMSS) and LM-OTS (LMS). β One-time use only.
Commutative Supersingular Isogeny Diffie-Hellman (ASIACRYPT 2018). Post-quantum non-interactive key exchange. Ideal class group action over GF(p).
NIST PQC Round 4 candidate KEM based on QC-MDPC codes with BGF decoder. Code-based security (no lattice or number-theoretic assumptions). Compact key sizes compared to Classic McEliece.
NIST PQC Round 4 Alternate. Code-based KEM (QC-MDPC). Ring arithmetic over GF(2)[X]/(X^n - 1). Decryption failure probability is a core security parameter. SHAKE256-backed.
Stateless hash-based post-quantum signature scheme (NIST FIPS 205, 2024). Composed of WOTS+, FORS, and Hypertree layers. Security derives solely from SHA-256; no lattice or number-theoretic assumptions. Complements stateful XMSS/LMS.