Comprehensive List of Cryptographic Algorithm Identifiers

Standardized Names and Codes Across Multiple Frameworks

Key Takeaways

• Consensus on Standard Identifiers: Numerous cryptographic algorithms share standardized identifiers across NIST, IETF, ISO, and Microsoft frameworks, ensuring interoperability.
• Object Identifiers (OIDs): OIDs are pivotal in uniquely identifying cryptographic algorithms in many standards and protocols, facilitating consistent implementation.
• Algorithm Agility: The capacity to migrate and support multiple algorithms over time is essential for adapting to evolving security requirements and threats.

---

Overview of Cryptographic Algorithm Identifiers

Cryptographic algorithm identifiers are standardized names and codes used to uniquely specify different cryptographic algorithms across various systems, protocols, and standards. These identifiers ensure interoperability, secure communication, and adherence to best practices in cryptography. Understanding these identifiers is crucial for developers, security professionals, and organizations to implement and manage cryptographic solutions effectively.

Symmetric Algorithms

Advanced Encryption Standard (AES)

AES is a widely adopted symmetric encryption algorithm standardized by NIST in FIPS 197. It supports key sizes of 128, 192, and 256 bits, providing robust security for data encryption.

Key Size	OID
AES-128-CBC	2.16.840.1.101.3.4.1.2
AES-192-CBC	2.16.840.1.101.3.4.1.22
AES-256-CBC	2.16.840.1.101.3.4.1.42

Triple Data Encryption Standard (3DES)

3DES, or Triple DES, enhances the security of the original DES by applying the encryption process three times with different keys. It is defined in NIST Special Publications and ANSI X9.52.

OID: 1.2.840.113549.3.7

---

Asymmetric Algorithms

Rivest–Shamir–Adleman (RSA)

RSA is a foundational asymmetric encryption algorithm used for secure data transmission and digital signatures. It is widely supported across various standards and protocols.

Algorithm	OID
RSA Encryption	1.2.840.113549.1.1.1
SHA-1 with RSA Encryption	1.2.840.113549.1.1.5
SHA-256 with RSA Encryption	1.2.840.113549.1.1.11

Elliptic Curve Cryptography (ECC)

ECC provides similar security to RSA but with smaller key sizes, making it efficient for systems with limited resources. It includes algorithms like ECDSA and ECDH.

Curve	OID
P-256	1.2.840.10045.3.1.7
P-384	1.3.132.0.34
P-521	1.3.132.0.35

Digital Signature Algorithm (DSA)

DSA is a federal standard for digital signatures, specified in FIPS 186-4.

OID: 1.2.840.10040.4.1

---

Hashing Algorithms

Secure Hash Algorithm (SHA) Family

The SHA family provides cryptographic hash functions for data integrity and authentication. SHA algorithms are integral to various security protocols and standards.

Algorithm	OID
SHA-1	1.3.14.3.2.26
SHA-224	2.16.840.1.101.3.4.2.4
SHA-256	2.16.840.1.101.3.4.2.1
SHA-384	2.16.840.1.101.3.4.2.2
SHA-512	2.16.840.1.101.3.4.2.3

SHA-3 Family

SHA-3 is the latest member of the Secure Hash Algorithm family, providing enhanced security features.

Algorithm	OID
SHA3-224	2.16.840.1.101.3.4.2.7
SHA3-256	2.16.840.1.101.3.4.2.8
SHA3-384	2.16.840.1.101.3.4.2.9
SHA3-512	2.16.840.1.101.3.4.2.10

---

Message Authentication Codes (MACs)

Hash-Based Message Authentication Code (HMAC)

HMAC combines a cryptographic hash function with a secret key to provide data integrity and authenticity.

Cipher-Based Message Authentication Code (CMAC)

CMAC uses a block cipher algorithm to achieve message authentication, providing stronger security guarantees in some contexts.

---

Key Exchange Protocols

Diffie-Hellman (DH)

DH is a foundational protocol for secure key exchange, allowing two parties to establish a shared secret over an insecure channel.

Elliptic Curve Diffie-Hellman (ECDH)

ECDH leverages elliptic curve cryptography to perform key exchanges more efficiently than traditional DH.

X25519 and X448

These are modern elliptic curve-based key exchange mechanisms designed for high security and performance.

---

Mode of Operation Identifiers

Modes of operation define how block ciphers process data. They determine the algorithm's security properties and performance characteristics.

Mode	Description
CBC (Cipher Block Chaining)	Each block of plaintext is XORed with the previous ciphertext block before being encrypted.
GCM (Galois/Counter Mode)	Provides both encryption and authentication, ensuring data integrity.
CTR (Counter Mode)	Transforms a block cipher into a stream cipher, allowing parallel encryption.
CCM (Counter with CBC-MAC)	Combines CTR mode for encryption and CBC-MAC for authentication.

---

Object Identifiers (OIDs)

Object Identifiers (OIDs) are globally unique identifiers used to name objects such as cryptographic algorithms in a standardized manner. They play a crucial role in various protocols and standards, ensuring consistent recognition and implementation of algorithms across different platforms and systems.

Algorithm	OID
AES-128	2.16.840.1.101.3.4.1.2
AES-192	2.16.840.1.101.3.4.1.22
AES-256	2.16.840.1.101.3.4.1.42
RSA Encryption	1.2.840.113549.1.1.1
SHA-256	2.16.840.1.101.3.4.2.1
DSA	1.2.840.10040.4.1
P-256	1.2.840.10045.3.1.7
P-384	1.3.132.0.34
P-521	1.3.132.0.35

---

Standards Organizations and Their Contributions

National Institute of Standards and Technology (NIST)

NIST is a pivotal organization in defining and maintaining cryptographic standards in the United States and internationally. Their Federal Information Processing Standards (FIPS) and Special Publications (SP 800 Series) provide comprehensive guidelines for cryptographic implementations.

Federal Information Processing Standards (FIPS)

• FIPS 197: Specifies the AES algorithm.
• FIPS 186-4: Defines the Digital Signature Algorithm (DSA).

Special Publications (SP 800 Series)

• SP 800-78-5: Details cryptographic algorithms and key sizes for Personal Identity Verification (PIV).
• SP 800-131A: Specifies approved algorithms and key sizes for federal use.
• SP 800-63B: Provides Digital Identity Guidelines, specifying algorithms for identity verification.

Internet Engineering Task Force (IETF)

The IETF develops and promotes voluntary Internet standards, particularly the standards that comprise the Internet protocol suite (TCP/IP). Key publications include Request for Comments (RFCs) that define protocols and algorithms.

Key RFCs

• RFC 3370: Defines conventions for using cryptographic algorithms with the Cryptographic Message Syntax (CMS), including OIDs.
• RFC 7696: Provides guidelines for cryptographic algorithm agility, ensuring protocols can migrate to new algorithms as needed.
• RFC 4880: Specifies OpenPGP, including algorithm identifiers used in encryption and signing.

Microsoft

Microsoft defines algorithm identifiers within its Cryptography API: Next Generation (CNG) and CryptoAPI. These identifiers are used in Windows environments to specify algorithms in various cryptographic operations.

Cryptography Next Generation (CNG)

• BCRYPT_AES_ALGORITHM: "AES"
• BCRYPT_SHA256_ALGORITHM: "SHA256"

CryptoAPI

• CALG_AES_256: 0x00006631
• CALG_SHA_256: 0x0000800C

International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC)

ISO and IEC collaborate to produce internationally recognized standards, including those related to cryptography.

Key Standards

• ISO/IEC 18033: Defines encryption algorithms, including block and stream ciphers.
• ISO/IEC 14888: Specifies digital signature algorithms and their parameters.

---

Algorithm Agility and Future-Proofing

Algorithm agility refers to the ability of a system to support multiple cryptographic algorithms and to transition to new algorithms as needed. This capability is essential for adapting to emerging security threats and advancements in cryptographic research.

Guidelines for achieving algorithm agility are outlined in documents like RFC 7696, which emphasizes the importance of supporting multiple algorithm suites and providing mechanisms for migration.

Implementing algorithm agility involves:

• Supporting a range of cryptographic algorithms and key sizes.
• Using standardized identifiers to facilitate interoperability.
• Designing systems to allow for the seamless addition or deprecation of algorithms.

---

Implementation in Software Libraries and Frameworks

Various cryptographic libraries and frameworks implement standardized algorithm identifiers to ensure compatibility and security across different applications and systems.

OpenSSL

OpenSSL is a widely used open-source library that implements SSL and TLS protocols, providing robust cryptographic functions.

Key Identifiers

• "aes-256-cbc": AES with 256-bit keys in CBC mode.
• "sha256": SHA-256 hashing algorithm.

Java Cryptography Architecture (JCA)

JCA defines a standard API for accessing cryptographic services in Java applications, utilizing standardized algorithm names.

Standard Algorithm Names

• "AES": Advanced Encryption Standard.
• "SHA-256": Secure Hash Algorithm 256-bit.

---

Conclusion

Cryptographic algorithm identifiers are fundamental to the secure and interoperable implementation of cryptographic systems. By adhering to standardized identifiers across various frameworks and standards, organizations can ensure consistent security measures, facilitate seamless communication between different systems, and maintain the flexibility to adapt to evolving security landscapes. Understanding and utilizing these identifiers is crucial for developing robust security infrastructures and safeguarding sensitive information in an increasingly digital world.

References