Browse the catalog Filter, sort, and compare side by side.
All 100 CSPRNG 5 Symmetric 10 Elliptic Curves 10 Hash 8 MAC 5 KDF 5 Password 5 Asymmetric 5 KEM 9 Signatures 9 Threshold Sigs 5 Sharing 5 HE 4 ZKP 4 MPC 4 OT / PIR 4 Stego 5 All categories (100) Sort: Name Filters How to read this site
Symmetric 10 shown / 100 total5 recommended152 citations · 117 unique sourcesReviewed September 2026
10 algorithms shown
AES-256-GCM Recommended Compare ☆
AES · 🇧🇪 Belgium· NIST Standard· mature· PQ-ready
General-purpose authenticated record, message, and object encryption. TLS 1.3 and government-approved systems. Full-disk encryption normally uses a storage-specific mode such as XTS-AES instead.
AEAD profile · confidentiality and forgery bounds are separate
Key-search estimate 256-bit classical · 128-bit Grover model
Authentication 128-bit tag; usage limits affect forgery probability
Nonce / IV 96 bits; construction-specific uniqueness rules apply
AES-256-GCM-SIV Recommended Compare ☆
AES · 🇺🇸/🇮🇱 US/Israel· IETF RFC 8452· established· PQ-ready
Nonce-misuse-resistant authenticated encryption. Systems where nonce uniqueness cannot be guaranteed — distributed systems, cloud KMS, at-rest encryption.
AEAD profile · confidentiality and forgery bounds are separate
Key-search estimate 256-bit classical · 128-bit Grover model
Authentication 128-bit tag; usage limits affect forgery probability
Nonce / IV 96 bits; construction-specific uniqueness rules apply
ARIA-256 Acceptable Compare ☆
ARIA · 🇰🇷 South Korea· Korean Standard KS X 1213
Korean government and financial systems.
AEAD profile · confidentiality and forgery bounds are separate
Key-search estimate 256-bit classical · 128-bit Grover model
Authentication 128-bit tag; usage limits affect forgery probability
Nonce / IV 128 bits; construction-specific uniqueness rules apply
Ascon-AEAD128 Recommended Compare ☆
Ascon · 🇦🇹/🇩🇪/🇳🇱 Europe· NIST SP 800-232· emerging· PQ-vulnerable
Authenticated encryption for constrained devices, embedded systems, low-power sensors, and platforms where AES-GCM is resource-intensive.
AEAD profile · confidentiality and forgery bounds are separate
Key-search estimate 128-bit classical · 64-bit Grover model
Authentication 128-bit tag; usage limits affect forgery probability
Nonce / IV 128 bits; construction-specific uniqueness rules apply
Camellia-256 Acceptable Compare ☆
Camellia · 🇯🇵 Japan· CRYPTREC / ISO / IETF
Japanese government, TLS suites, NESSIE-approved applications.
AEAD profile · confidentiality and forgery bounds are separate
Key-search estimate 256-bit classical · 128-bit Grover model
Authentication 128-bit tag; usage limits affect forgery probability
Nonce / IV 128 bits; construction-specific uniqueness rules apply
ChaCha20-Poly1305 Recommended Compare ☆
ChaCha · 🇺🇸 United States· IETF RFC 8439· mature· PQ-ready
Authenticated encryption without AES hardware. Mobile, TLS 1.3 fallback, WireGuard.
AEAD profile · confidentiality and forgery bounds are separate
Key-search estimate 256-bit classical · 128-bit Grover model
Authentication 128-bit tag; usage limits affect forgery probability
Nonce / IV 96 bits; construction-specific uniqueness rules apply
Kuznyechik Acceptable Compare ☆
GOST · 🇷🇺 Russia· GOST R 34.12-2015
Russian government and military systems.
AEAD profile · confidentiality and forgery bounds are separate
Key-search estimate 256-bit classical · 128-bit Grover model
Authentication 128-bit tag; usage limits affect forgery probability
Nonce / IV 128 bits; construction-specific uniqueness rules apply SM4 · 🇨🇳 China· GB/T 32907 / ISO 18033-3
Chinese government, banking, wireless LAN (WAPI).
Cipher profile · authentication must be supplied separately
Key-search estimate 128-bit classical · 64-bit Grover model
Authentication Not built in
Nonce / IV 128 bits; construction-specific uniqueness rules apply SNOW · 🇸🇪 Sweden· Research design / SNOW family lineage
Research and high-throughput stream-cipher evaluation. Proposed as a 256-bit successor to the SNOW family; it is not the SNOW 3G algorithm standardized for 4G/LTE.
Cipher profile · authentication must be supplied separately
Key-search estimate 256-bit classical · 128-bit Grover model
Authentication Not built in
Nonce / IV 128 bits; construction-specific uniqueness rules apply
XChaCha20-Poly1305 Recommended Compare ☆
ChaCha · 🇺🇸 United States· Expired IRTF draft / libsodium· established· PQ-ready
File/at-rest encryption needing random nonces safely. libsodium default.
AEAD profile · confidentiality and forgery bounds are separate
Key-search estimate 256-bit classical · 128-bit Grover model
Authentication 128-bit tag; usage limits affect forgery probability
Nonce / IV 192 bits; construction-specific uniqueness rules apply References & terminology +