path: root/Standards.adoc

= Standards that define ciphersuites
Stefan Schumacher <public@cryptomancer.de>
v0.0.1, 2026/04/17, draft
// :doctype: book
:experimental:
:source-highlighter: rouge
:rouge-style: github
:stem: latexmath
:toc: macro
:sectnums: all
:toclevels: 4 
:sectnumlevels: 3
:html5s-image-default-link: self
:icons: image
:note-caption: ℹ️ 
:tip-caption: 💡
:important-caption: ❗
:caution-caption: 🔥 
:warning-caption: ⚠️
// ☢️

ifdef::backend-pdf[]
:icons: font
endif::backend-pdf[]

*{author}* <{email}>

toc::[]

* compiled at {localdate}  {localtime}  Version {revnumber} of {revdate}
* *Datei*: {docname}  

Scope: This document will list all standards that define the properties of ciphersuites (algorithm, key length, mode)
etc. The aim is to generate an exhaustive list of cryptographic material to be used as a database for CBOMs. 

== Taxonomy Dimensions

=== Braindump list

.Braindump
. Status 
.. Approved
.. Obsolete / Deprecated
.. Legacy
.. Broken
. Protocols
.. TLS
... TLS 1.3
... TLS 1.2
... TLS 1.1
... TLS 1.0
... SSL 3
... SSL 2
.. Secure Shell
... SSH1 (deprecated)
... SSH2
.... OpenSSH
.... Dropbear
.... SSH Tectia Client/Server 
.. Internet Key Exchange IKE
... IKEv1
... IKEv2
.. PPTP
.. Radius
.. MS-CHAP
.. IPSec
... OpenVPN
... FreeSWAN/StrongSWAN
... Wireguard
.. Online Certificate Status Protocol
.. OpenPGP
... LibrePGP
... GnuPG 
... age
.. Kerberos
.. JWT
... JOSE
.. FIDO2 Passkeys
. .PKI
... X.509
... Cryptographic Message Syntax
. Symmetric
. Asymmetric
. Key Exchange
. Key Length
.. 56, 128, 196, 256
. Operation Mode
.. Streamcipher
.. Blockcipher
.. Electronic Codebook Mode (ECB)
.. Cipher Block Chaining Mode (CBC)
.. Counter Mode (CTR)
.. Galois Counter Mode (GCM)
.. XOR-Encrypt-XOR (XEX)
.. XEX-based Tweaked-Codebook mode with ciphertext stealing (XTS)
.. Synthetic Initialization Vector (SIV)
.. Encrypt Mix Encrypt (EME)
.. Cipher Feedback Mode (CFB)
. IANA CipherSuite
. Hash
.. Message Authentication Code (MAC)
.. HMAC
. PQC
. PQC-Hybrid
. One Time Password (OTP)
.. Hash based OTP
.. Time based OTP 
. Cryptographically Secure Pseudorandom Number Generator (CSPRNG)
.. Dual_EC_DRBG
. WIFI
.. WEP
.. WPA
.. WPA2
.. WPA3


=== Taxonomy Categories (1st Level)

==== German BSI

.Sources:
. BSI TR-02102-x (Kryptographische Verfahren: Empfehlungen und Schlüssellängen)
. BSI AIS 20/31 (A proposal for: Functionality classes for random number generators - Version 3.0)
. BSI TR-03116 
. BSI TR-03111 Elliptic Curve Cryptography, Version 2.10


* Asymmetric Algorithms
  ** Digital Signature
  ** Key Exchange
* Symmetric Algorithms
* Hash Functions
* Message Authentication Codes (MACs)
* Random Number Generators


==== USA NIST

.sources:
. NIST SP 800-57  
. NIST SP 800-56A - KEX
. NIST FIPS 186-5 - Signatures
. NIST SP 800-38 - Symmetric
. NIST SP 800-185 - Hash/KDF
. NIST SP 800-90A - RNG
. NIST SP 800-208 - PQC Signatures


* Key Exchange / Key Establishment
* Public-Key Encryption
* Digital Signatures
* Symmetric Encryption
* Hash Functions
* MAC / AEAD
* Key Derivation Functions (KDFs)
* Random Number Generation


==== Attributes


. Protocol
. Library/Program/Implementation
.. Version
. State
.. Data at rest 
.. Data in transit
.. Data in Use


=== Protocols

* TLS (Transport Layer Security)
* SSH (Secure Shell)
* IPsec (Internet Protocol Security)
* HTTPS (HTTP over TLS)
* DTLS (Datagram Transport Layer Security)
* QUIC (Quick UDP Internet Connections)
* OpenPGP
* S/MIME (Secure/Multipurpose Internet Mail Extensions)
* Kerberos
* Wireless Security
* VPN 
* PKI
* Certificates
* Messaging security protocols
* File encryption
* Storage encryption




==== Protocols with Implementations


. TLS (Transport Layer Security)
.. TLS 1.2
.. TLS 1.3
. SSH (Secure Shell)
.. SSHv2
.. SFTP
.. SCP
. IPsec (Internet Protocol Security)
.. IKEv1
.. IKEv2
.. ESP
.. AH
. HTTPS (HTTP over TLS)
. DTLS (Datagram Transport Layer Security)
. QUIC (Quick UDP Internet Connections)
.. HTTP/3 over QUIC
. OpenPGP
. S/MIME (Secure/Multipurpose Internet Mail Extensions)
. Kerberos
.. Kerberos v5
. Wireless Security
.. WPA3
.. WPA2
. VPN
.. OpenVPN
.. WireGuard
.. L2TP
.. IPsec 
. PKI
.. X.509 
. Certificates
.. OCSP (Online Certificate Status Protocol)
.. CRL (Certificate Revocation List)
. Messaging security protocols
.. Matrix MegOlm
.. Matrix MLS
.. Signal
.. Threema
.. WhatsApp
.. XMPP
... Off-the-Record
... Omemo
... OpenPGP over XMPP
... S/MIME
... Jingle && DTLS-SRTP
. File encryption
. Storage encryption
. VoIP/Videoconference
.. TLS
.. SRTP
.. SRTCP
.. DTLS
.. DTLS-SRTP
.. ZRTP
.. MIKEY (KEX)
.. SDES (KEX)
.. IPsec
.. IKEv2
.. QUIC
.. MLS


== Hardware

What about Smartcards, Hardware-Token and TPM2?


.CPU-Properties: 
* AES-NI
* TPM2
* Intel SGX (Software Guard Extensions)
* Intel TDX (Trust Domain Extensions)
* AMD SEV (Secure Encrypted Virtualization)
* AMD SEV-SNP (Secure Nested Paging)
* ARM TrustZone