Brokenclassical
Caesar Cipher
A simple shift substitution cipher where each letter in the plaintext is shifted by a fixed number of positions.
CIPHER LIFECYCLE BADGES #496
Cryptographic Security Lifecycle
Standardized security classification badges for every algorithm in CryptoViz based on NIST SP 800-57 guidelines and modern cryptanalysis standards.
Lifecycle Classification Matrix
Understanding security status criteria and operational recommendations.
Recommended4 algorithms
Actively recommended by NIST or equivalent standards bodies for new systems.
Secure56 algorithms
No known practical attacks. Suitable for production use in current systems.
Experimental2 algorithms
Standardised but not yet widely deployed; may see parameter or API changes.
Legacy6 algorithms
No longer recommended for new systems but still in use for interoperability.
Deprecated3 algorithms
Officially deprecated. Migrate away; support may be withdrawn in future tooling.
Broken12 algorithms
Practical attacks exist. Do NOT use for security-sensitive purposes.
Algorithm Security Registry
Filter algorithms by lifecycle stage or search by name.
Brokenclassical
ROT13
A special case of Caesar cipher with a fixed shift value of 13.
Brokenclassical
Vigenère Cipher
A polyalphabetic substitution cipher that uses a keyword to shift characters in repeating cycles.
Brokenclassical
Atbash Cipher
A monoalphabetic substitution cipher formed by reversing the alphabet (A becomes Z, B becomes Y, etc.).
Brokenclassical
Playfair Cipher
A polygraphic substitution cipher that encrypts pairs of letters using a dynamic 5x5 key matrix.
Brokenclassical
Rail Fence Cipher
A transposition cipher where plaintext is written diagonally down and up on successive "rails" of a fence.
Deprecatedsymmetric
XOR Cipher
A simple stream cipher performing byte-wise XOR operations between plaintext and key.
Securesymmetric
One-Time Pad (OTP)
An unbreakable cipher when used with a truly random, single-use key of equal length to the plaintext.
Brokensymmetric
DES
Data Encryption Standard. A legacy 64-bit block cipher utilizing a 56-bit key size.
Deprecatedsymmetric
3DES (Triple DES)
Applies the DES algorithm three times to each data block with two or three keys to increase security.
Securesymmetric
AES-XTS
A tweakable mode (IEEE P1619) for disk-sector encryption, composed from the existing AES module — the sector number IS the tweak, so no IV needs to be stored per sector. Confidentiality-only, no authentication tag (unlike AES-GCM).
Recommendedsymmetric
AES
Advanced Encryption Standard. A highly secure, standard block cipher supporting key sizes of 128, 192, or 256 bits.
Securesymmetric
Camellia
A symmetric key block cipher jointly developed by Mitsubishi Electric and NTT, widely used and standardized (RFC 3713).
Securesymmetric
Serpent
An AES finalist (1998, runner-up to Rijndael) with the largest security margin of the finalists — 32 rounds using 8 different S-boxes cycled per round, versus AES's single S-box.
Recommendedsymmetric
ChaCha20-Poly1305
RFC 8439 AEAD combining the existing ChaCha20 and Poly1305 modules — the software-oriented alternative to AES-GCM, used by TLS 1.3 and WireGuard when hardware AES acceleration isn't available.
Securesymmetric
Speck128/128
An NSA lightweight ARX cipher (2013) using only addition, rotation, and XOR — no S-boxes or lookup tables at all, unlike every other symmetric cipher in this registry.
Securesymmetric
AES-CCM
Counter with CBC-MAC (NIST SP 800-38C) — an authenticated mode composed from AES, contrasted with AES-GCM: authentication here is literal CBC-MAC re-running the block cipher, not GHASH polynomial evaluation.
Securesymmetric
Threefish-256
A tweakable, large-block ARX cipher (2008) underlying the Skein hash function (a SHA-3 finalist). 256-bit block, 72 rounds, and a 128-bit tweak that varies ciphertext without changing the key — no other cipher here exposes a tweak input.
Securesymmetric
XChaCha20
The 192-bit-nonce extension of ChaCha20 (used by libsodium) — an HChaCha20 subkey-derivation step, the ChaCha20 sibling of this batch's XSalsa20, lets you pick nonces randomly instead of managing a counter.
Securesymmetric
Twofish
AES finalist by Bruce Schneier et al. (1998). 128-bit block, 128/192/256-bit keys, 16-round Feistel. Uses key-dependent S-boxes (derived via RS matrix over GF(2^8)), MDS matrix diffusion, PHT, and 40 subkeys. Used in GnuPG and VeraCrypt. Never broken.
Securesymmetric
GOST 28147-89
The Soviet/Russian government standard block cipher (declassified 1994) — 256-bit key, 32-round Feistel. Uniquely, the S-boxes are a negotiated parameter, not fixed by the standard; this demo uses a published reference set.
Brokensymmetric
RC2
Ron Rivest's 1987 variable-key block cipher (RFC 2268). First cipher exportable from the US under 1990s export controls via "effective key bits" parameter. Used in SSL 2/3, TLS, and S/MIME. Mix-and-mash round structure. Historical/educational only — broken at ≤40-bit effective keys.
Brokensymmetric
Enigma (I, 3-rotor)
The historical WWII 3-rotor Wehrmacht cipher machine, with plugboard and reflector. Self-reciprocal (same settings encrypt and decrypt), and — a real historical weakness — no letter ever maps to itself.
Securesymmetric
ASCON-128
NIST-selected lightweight cryptography standard (SP 800-232, 2023). Authenticated encryption with associated data (AEAD) — encrypts and authenticates simultaneously using a 320-bit sponge permutation. Designed for IoT and constrained devices. Output = nonce + ciphertext + 128-bit tag.
Securesymmetric
XSalsa20
The 192-bit-nonce extension of Salsa20 (used by NaCl/libsodium) — an HSalsa20 subkey-derivation step lets you pick nonces randomly instead of managing a counter.
Legacysymmetric
Trivium
eSTREAM Phase 3 stream cipher (ISO/IEC 29192-3). Three coupled 93/84/111-bit NLFSRs with 288-bit total state. 80-bit key, 80-bit IV, 1152 warm-up clocks before keystream. Most analysed stream cipher — one AND gate per output bit in hardware. Output = IV(20 hex) + ciphertext.
Securesymmetric
SM4
Chinese national standard block cipher (GB/T 32907-2016, ISO/IEC 18033-3, RFC 8998). Mandatory in Chinese internet and financial infrastructure; now part of TLS 1.3 cipher suites. 128-bit block, 128-bit key, 32-round SPN with a single S-box and linear transform.
Legacysymmetric
PRESENT
Ultra-lightweight block cipher (ISO/IEC 29192-2:2012). Smallest standardised cipher: PRESENT-80 fits in 1,075 gate equivalents — vs AES's ~3,400 GE. 64-bit block, 80 or 128-bit key, 31-round SPN with a 4-bit S-box and a 64-bit bit-permutation P-layer.
Securesymmetric
SIMON-32/64
NSA lightweight block cipher targeting 8/16-bit microcontrollers. Uses 16-bit words, a 32-bit block, and a 64-bit key across 32 Feistel rounds. The smallest variant of the SIMON family.
Legacysymmetric
TEA
The original 1994 predecessor to XTEA (also in this registry). Simple ARX Feistel cipher, no S-boxes — but has a documented equivalent-key weakness (4 related keys produce identical ciphertext), which XTEA's extra key mixing was designed specifically to fix.
Securesymmetric
NOEKEON
NESSIE-submitted 128-bit block cipher. Unique for having ZERO lookup tables; its non-linear Gamma layer uses exactly 5 bitwise AND/OR/XOR operations. Ideal for VLSI/FPGA environments.
Securesymmetric
LEA
Korean lightweight ARX block cipher (IETF RFC 9998, 2024). Pure Add/Rotate/XOR — no S-boxes, making it 3–4× faster than AES on 32-bit processors. 128-bit block, 128/192/256-bit keys, 24/28/32 rounds. Used in Korean IoT and mobile applications.
Securesymmetric
GIFT-64
Ultra-lightweight 64-bit block cipher (CHES 2017). Uses a 4-bit S-box and 28-round SPN. 5x more hardware-efficient than PRESENT and underlies the NIST Lightweight Finalist GIFT-COFB.
Legacysymmetric
XXTEA
Corrected Block TEA (Wheeler & Needham, 1998). The final and strongest member of the TEA family. Unlike TEA/XTEA, it operates on the entire message as a single variable-length block (min 2 words) for full diffusion. Widely used historically but unauthenticated.
Legacysymmetric
Blowfish
Bruce Schneier's 1993 Feistel block cipher — pre-AES era workhorse used in SSH, OpenSSH, and the bcrypt key schedule. Unique for its key-dependent S-box structure: the 4×256 S-boxes are entirely re-derived from each key, making it immune to weak-key attacks that plagued DES.
Securehash
Streebog-256
Russian national hash function (GOST R 34.11-2012, RFC 6986). 512-bit internal state processed through 12 rounds of a Kuznyechik-family SPN in a Miyaguchi-Preneel-like compression function, with a unique checksum-based finalization step.
Legacysymmetric
SEED-128
Korean national block cipher (RFC 4269, 2005; ISO/IEC 18033-3). Mandatory in Korean financial and government systems for over a decade. 128-bit block, 128-bit key, 16-round Feistel with G-function using two GF(2^8)-derived S-boxes. Superseded by LEA for new Korean deployments.
Securesymmetric
Kuznyechik
Russian national block cipher (GOST R 34.12-2015, RFC 7801). 128-bit block, 256-bit key, 9-round SPN. Replaces the legacy 1989 GOST cipher. Uses a fixed 256-byte S-box and a linear transform built from 16 GF(2^8) feedback steps.
Securesymmetric
SIMON-128/128
NSA hardware-optimised lightweight block cipher (IACR 2013/404). Sibling of SPECK — SIMON targets gate-minimal hardware via bitwise AND while SPECK targets software via ARX. 128-bit block, 128-bit key, 68-round Feistel. Round function: f(x)=(x<<<1 & x<<<8)⊕x<<<2.
Securesymmetric
Rabbit
eSTREAM Portfolio Phase 3 stream cipher (RFC 4503). 128-bit key, 64-bit IV. Distinctive non-linear counter system (no LFSR) using 64-bit squaring and XOR to generate 128 bits of keystream per iteration. Extremely fast in software.
Securesymmetric
HC-128
eSTREAM Phase 3 software-profile stream cipher by Hongjun Wu. Uses two 512-word (2 KB each) key/IV-derived lookup tables P and Q that update themselves during keystream generation. The fastest stream cipher in the eSTREAM portfolio on 32-bit software. Output = IV(32 hex) + ciphertext.
Securesymmetric
Anubis
NESSIE-submitted block cipher (2000). 128-bit block, 128/192/256-bit key. Unique involutional design: the S-box, diffusion layer, and round structure are all self-inverse. Decryption is literally the same code as encryption, just with reversed round keys.
Securesymmetric
MARS
IBM AES finalist (1998). 128-bit block, 32-round heterogeneous SPN. Unique for combining 4 different round types (forward mixing, forward E-rounds, backward E-rounds, backward mixing) for defense-in-depth. Lost to Rijndael (AES) on performance/simplicity, but unbroken.
Securesymmetric
CLEFIA
ISO/IEC 29192-2 lightweight block cipher (Sony, 2007). 4-branch generalized Feistel network (GFN) with parallel F0/F1 functions using distinct S-boxes and diffusion matrices. Pairs with PRESENT to complete the ISO lightweight standard duo.
Securesymmetric
MISTY1
CRYPTREC-recommended, RFC 2994. 64-bit block, 128-bit key. Unique recursive Feistel network: main rounds call FO, which calls FI, which uses 7-bit/9-bit S-boxes. Ancestor of KASUMI (3G/GSM).
Securesymmetric
ARIA
Korean national standard block cipher (KS X 1213, RFC 5794). AES-like SPN but alternates between two involutional S-box pairs (SB1/SB2) and uses a pure GF(2) involutional diffusion matrix. Completes the SEED/LEA/ARIA Korean trio.
Brokensymmetric
KASUMI
3GPP TS 35.202 (GSM A5/3, UMTS f8/f9). MISTY1-derived hardware-optimized cipher. Status: BROKEN (2010 related-key attack). Included for educational value as a once-deployed mobile standard.
Recommendedhash
SHA-256
Secure Hash Algorithm 2. Produces a unique 256-bit hash output representing the input message.
Securehash
SHA-512
Secure Hash Algorithm 2 with 64-bit words, producing a secure 512-bit digest.
Securehash
SM3 Hash
Chinese National Standard cryptographic hash function (GB/T 32905-2016). Produces a 256-bit message digest using 64 ARX compression rounds.
Brokenhash
MD5
A widely used legacy hash producing a 128-bit output. Cryptographically broken due to collision vulnerabilities.
Securehash
HMAC-SHA256
Keyed-hash Message Authentication Code. Combines SHA-256 with a cryptographic secret key.
Securehash
AES-CMAC
A MAC built entirely from AES block-cipher calls plus a GF(2^128) subkey-derivation step (NIST SP 800-38B) — no separate hash function, unlike HMAC. Composed from the existing AES module, no new dependencies.
Recommendedhash
Bcrypt
A password hashing function incorporating a salt and cost factor, designed to be slow to prevent brute force.
Deprecatedhash
XXHash32
A very fast non-cryptographic 32-bit hash used for checksums, hash tables, and data integrity demos.
Securehash
Bloom Filter Simulator
A space-efficient probabilistic data structure testing set membership with zero false negatives and a tunable false-positive probability.
Securehash
HKDF (HMAC Key Derivation)
HMAC-based Extract-and-Expand Key Derivation Function (RFC 5869) that converts weak or shared input keying material into cryptographically strong output keys.
Securehash
BLAKE2s
The 32-bit-word sibling of BLAKE2b (2012), optimized for 8- to 32-bit platforms — smaller blocks, fewer rounds, 256-bit max output. Used internally by Argon2.
Securehash
SHA-224
A truncated SHA-2 family member (FIPS 180-4) with its OWN initial hash value — not simply SHA-256's output cut short, which is a deliberate design choice to prevent leaking one digest from the other.
Securehash
SHA-384
The 384-bit truncated member of the SHA-512 family (FIPS 180-4), with its own distinct initial hash value, same design principle as SHA-224 relative to SHA-256.
Experimentalhash
SHAKE128
An extendable-output function (XOF, NIST FIPS 202) — unlike every other hash here, output length is a parameter you choose, not fixed. Same Keccak permutation family as SHA-3.
Experimentalhash
SHAKE256
The wider-capacity sibling of SHAKE128 (NIST FIPS 202) — same extendable-output design, larger security margin.
Securehash
PBKDF2
RFC 8018 (PKCS #5). The most widely deployed KDF in the world (WPA2, iOS keychain). Iteratively applies HMAC to a password+salt. Slower iteration counts increase brute-force resistance.
Brokenhash
MD4
The direct predecessor to MD5 (1990) — fully broken today. Simpler than MD5: only 3 rounds (vs MD5's 4) and no additive per-step constants, illustrating exactly what MD5 was designed to fix.
Securehash
Argon2id
PHC Winner (2015), RFC 9106. Memory-hard password hashing with hybrid addressing (Argon2i for side-channel resistance, Argon2d for GPU resistance). Modern successor to bcrypt.
Securehash
Skein-256
SHA-3 finalist (Skein v1.3, 2010) by Schneier et al. Built on Threefish-256 via UBI (Unique Block Iteration) chaining — a Davies-Meyer construction. Pipeline: Config → Message → Output. Each block encrypted with Threefish-256 then XORed with plaintext. 256-bit output.
Securehash
LSH-256
Korean national hash standard (KS X 3262, 2014). Wide-pipe ARX+Boolean design with 1024-bit internal state. Completes the SEED/LEA/ARIA/LSH Korean cryptographic suite.
Securehash
Tiger
Fast 192-bit hash designed for 64-bit processors (Anderson & Biham, 1995). Uses three 64-bit chaining variables and 3 passes of 8 rounds over four 256-entry 64-bit S-boxes. Fills the 192-bit output gap in this repo.
Securehash
Grøstl-256
SHA-3 finalist (2008). AES-based wide-pipe hash using dual permutations P and Q in a Davies-Meyer-like compression function. Operates on an 8x8 byte state with AES-style SubBytes/ShiftBytes/MixBytes rounds.
Secureasymmetric
RSA-2048
An asymmetric cipher based on the difficulty of factoring large semiprimes. Supports key generation, encryption, and decryption.
Secureasymmetric
DSA
The finite-field discrete-log ancestor of ECDSA (NIST FIPS 186, 1994) — same r/s signature equation, computed in a prime-order subgroup instead of on a curve. Demo uses toy parameters; real DSA needs p>=2048 bits, q>=224 bits.
Secureasymmetric
Diffie-Hellman
A key exchange protocol enabling two parties to establish a shared secret over an insecure channel.
Secureasymmetric
X448
Diffie-Hellman key exchange over Curve448 (RFC 7748) — the higher-security sibling of X25519, targeting ~224-bit security with 56-byte keys instead of X25519's 32-byte keys.
Secureasymmetric
ECC (ECDSA P-256)
Elliptic Curve Cryptography. Implements ECDSA signing and verification over the NIST P-256 curve.
Secureasymmetric
Schnorr (BIP340)
Schnorr signatures per BIP340 over secp256k1, using x-only public keys. Provably secure under a simpler assumption than ECDSA and supports clean signature aggregation (MuSig) — compare against ecdsa.ts on the same curve.
Secureasymmetric
ElGamal Signature
The ElGamal signature scheme (1985) — distinct from ElGamal encryption already in this registry. Historically the direct ancestor of DSA: DSA is this scheme computed in a smaller prime-order subgroup for shorter signatures.
Secureasymmetric
ML-DSA-65
Post-quantum digital signatures (NIST FIPS 204, formerly Dilithium), pairing with ML-KEM the same way Ed25519 pairs with X25519 classically — except the hard problem here is lattice-based (Module-LWE/SIS), not elliptic-curve discrete log.
Secureasymmetric
ECIES (X25519)
Hybrid encryption: ephemeral X25519 key agreement + HKDF + AEAD, letting a sender encrypt an arbitrary-length message directly to a recipient's public key — no other asymmetric module here does this end-to-end.
Secureasymmetric
ML-KEM-768
Post-quantum key encapsulation (NIST FIPS 203, formerly Kyber), based on the Module Learning With Errors lattice problem — secure against both classical and quantum attackers, unlike every other asymmetric module here.
Secureasymmetric
FrodoKEM-640
Post-quantum key encapsulation mechanism (KEM) based on unstructured Learning With Errors (LWE) on standard matrices, offering conservative security without algebraic ring assumptions.
Secureasymmetric
Ed448
EdDSA signatures over Curve448 (RFC 8032) — the higher-security-margin sibling of Ed25519, using SHAKE256 internally instead of SHA-512. Completes the Curve25519/Curve448 x agreement/signing grid alongside x25519, x448, and ed25519.
Secureasymmetric
Shamir's Secret Sharing
A threshold scheme (1979): splits a secret into N shares such that any K reconstruct it, but K-1 reveal nothing. Uses GF(256) polynomial arithmetic — a different mathematical toolkit from every other module here.
Secureasymmetric
NTRU
Lattice-based public-key cryptosystem (IEEE P1363.1, 1996). Operates in polynomial ring Z[x]/(x^N-1). Predates NIST PQC by 20+ years. WARNING: Visualizer uses small pedagogical parameters (N=11) for teaching; NOT secure at this size.