Stefan Schumacher <public@cryptomancer.de>

  • compiled at 2026-04-18 17:15:02 +0200 Version 0.0.1 of 2026/04/17, draft

  • Datei: Standards

Scope: This document will list all standards that define the properties of ciphersuites (algorithm, key length, mode) etc. The aim is to generate an exhaustive list of cryptographic material to be used as a database for CBOMs.

1. Taxonomy Dimensions

1.1. Braindump list

Braindump

  1. Status

    1. Approved

    2. Obsolete / Deprecated

    3. Legacy

    4. Broken

  2. Protocols

    1. TLS

      1. TLS 1.3

      2. TLS 1.2

      3. TLS 1.1

      4. TLS 1.0

      5. SSL 3

      6. SSL 2

    2. Secure Shell

      1. SSH1 (deprecated)

      2. SSH2

        1. OpenSSH

        2. Dropbear

        3. SSH Tectia Client/Server

    3. Internet Key Exchange IKE

      1. IKEv1

      2. IKEv2

    4. PPTP

    5. Radius

    6. MS-CHAP

    7. IPSec

      1. OpenVPN

      2. FreeSWAN/StrongSWAN

      3. Wireguard

    8. Online Certificate Status Protocol

    9. OpenPGP

      1. LibrePGP

      2. GnuPG

      3. age

    10. Kerberos

    11. JWT

      1. JOSE

    12. FIDO2 Passkeys

  3. .PKI

    1. X.509

    2. Cryptographic Message Syntax

  4. Symmetric

  5. Asymmetric

  6. Key Exchange

  7. Key Length

    1. 56, 128, 196, 256

  8. Operation Mode

    1. Streamcipher

    2. Blockcipher

    3. Electronic Codebook Mode (ECB)

    4. Cipher Block Chaining Mode (CBC)

    5. Counter Mode (CTR)

    6. Galois Counter Mode (GCM)

    7. XOR-Encrypt-XOR (XEX)

    8. XEX-based Tweaked-Codebook mode with ciphertext stealing (XTS)

    9. Synthetic Initialization Vector (SIV)

    10. Encrypt Mix Encrypt (EME)

    11. Cipher Feedback Mode (CFB)

  9. IANA CipherSuite

  10. Hash

    1. Message Authentication Code (MAC)

    2. HMAC

  11. PQC

  12. PQC-Hybrid

  13. One Time Password (OTP)

    1. Hash based OTP

    2. Time based OTP

  14. Cryptographically Secure Pseudorandom Number Generator (CSPRNG)

    1. Dual_EC_DRBG

  15. WIFI

    1. WEP

    2. WPA

    3. WPA2

    4. WPA3

1.2. Taxonomy Categories (1st Level)

1.2.1. German BSI

Sources:

  1. BSI TR-02102-x (Kryptographische Verfahren: Empfehlungen und Schlüssellängen)

  2. BSI AIS 20/31 (A proposal for: Functionality classes for random number generators - Version 3.0)

  3. BSI TR-03116

  4. BSI TR-03111 Elliptic Curve Cryptography, Version 2.10

    • Asymmetric Algorithms

      • Digital Signature

      • Key Exchange

    • Symmetric Algorithms

    • Hash Functions

    • Message Authentication Codes (MACs)

    • Random Number Generators

1.2.2. USA NIST

sources:

  1. NIST SP 800-57

  2. NIST SP 800-56A - KEX

  3. NIST FIPS 186-5 - Signatures

  4. NIST SP 800-38 - Symmetric

  5. NIST SP 800-185 - Hash/KDF

  6. NIST SP 800-90A - RNG

  7. NIST SP 800-208 - PQC Signatures

    • Key Exchange / Key Establishment

    • Public-Key Encryption

    • Digital Signatures

    • Symmetric Encryption

    • Hash Functions

    • MAC / AEAD

    • Key Derivation Functions (KDFs)

    • Random Number Generation

1.2.3. Attributes

  1. Protocol

  2. Library/Program/Implementation

    1. Version

  3. State

    1. Data at rest

    2. Data in transit

    3. Data in Use

1.3. Protocols

  • TLS (Transport Layer Security)

  • SSH (Secure Shell)

  • IPsec (Internet Protocol Security)

  • HTTPS (HTTP over TLS)

  • DTLS (Datagram Transport Layer Security)

  • QUIC (Quick UDP Internet Connections)

  • OpenPGP

  • S/MIME (Secure/Multipurpose Internet Mail Extensions)

  • Kerberos

  • Wireless Security

  • VPN

  • PKI

  • Certificates

  • Messaging security protocols

  • File encryption

  • Storage encryption

1.3.1. Protocols with Implementations

  1. TLS (Transport Layer Security)

    1. TLS 1.2

    2. TLS 1.3

  2. SSH (Secure Shell)

    1. SSHv2

    2. SFTP

    3. SCP

  3. IPsec (Internet Protocol Security)

    1. IKEv1

    2. IKEv2

    3. ESP

    4. AH

  4. HTTPS (HTTP over TLS)

  5. DTLS (Datagram Transport Layer Security)

  6. QUIC (Quick UDP Internet Connections)

    1. HTTP/3 over QUIC

  7. OpenPGP

  8. S/MIME (Secure/Multipurpose Internet Mail Extensions)

  9. Kerberos

    1. Kerberos v5

  10. Wireless Security

    1. WPA3

    2. WPA2

  11. VPN

    1. OpenVPN

    2. WireGuard

    3. L2TP

    4. IPsec

  12. PKI

    1. X.509

  13. Certificates

    1. OCSP (Online Certificate Status Protocol)

    2. CRL (Certificate Revocation List)

  14. Messaging security protocols

    1. Matrix MegOlm

    2. Matrix MLS

    3. Signal

    4. Threema

    5. WhatsApp

    6. XMPP

      1. Off-the-Record

      2. Omemo

      3. OpenPGP over XMPP

      4. S/MIME

      5. Jingle && DTLS-SRTP

  15. File encryption

  16. Storage encryption

  17. VoIP/Videoconference

    1. TLS

    2. SRTP

    3. SRTCP

    4. DTLS

    5. DTLS-SRTP

    6. ZRTP

    7. MIKEY (KEX)

    8. SDES (KEX)

    9. IPsec

    10. IKEv2

    11. QUIC

    12. MLS

2. Hardware

What about Smartcards, Hardware-Token and TPM2?

CPU-Properties:

  • AES-NI

  • TPM2

  • Intel SGX (Software Guard Extensions)

  • Intel TDX (Trust Domain Extensions)

  • AMD SEV (Secure Encrypted Virtualization)

  • AMD SEV-SNP (Secure Nested Paging)

  • ARM TrustZone