Implementation Map

aead::AES_256_GCM. Hardware-accelerated. Minimal unsafe surface.

Pure Rust with optional AES-NI. Part of the RustCrypto ecosystem.

cryptography.hazmat.primitives.ciphers.aead.AESGCM. Built on OpenSSL.

Pure JS/TS AES-GCM. No native dependencies.

crypto.subtle.encrypt({name:'AES-GCM',...}). Native browser implementation.

cipher.NewGCM(block). Standard library. Hardware-accelerated.

AesGcm class. .NET 6+. Uses OS-level crypto provider.

Cipher.getInstance("AES/GCM/NoPadding"). Built into the JDK.

XChaCha20Poly1305 type. Pure Rust, constant-time.

nacl.secret.Aead uses XChaCha20-Poly1305-IETF and wraps libsodium.

crypto_aead_xchacha20poly1305_ietf_encrypt. WebAssembly and JavaScript builds of libsodium.

chacha20poly1305.NewX() for XChaCha20. Official Go extended crypto.

.NET bindings to libsodium. SecretAead.Encrypt uses XChaCha20-Poly1305.

XChaCha20Poly1305 via BC lightweight API.

Pure Rust Argon2id. Implements RFC 9106.

Wraps the C reference implementation. OWASP-recommended defaults.

Node.js native binding to the C reference. Server-side only.

argon2.IDKey(). Official Go extended crypto library.

Pure .NET Argon2id implementation.

Argon2BytesGenerator class in BC lightweight API.

Part of the dalek ecosystem. Widely used in Rust crypto.

nacl.signing.SigningKey. Wraps libsodium Ed25519.

Ed25519PrivateKey.generate(). Built on OpenSSL 3.x.

ed25519.sign/verify. Pure JS with zero dependencies.

Standard library Ed25519. Used throughout Go ecosystem.

SignatureAlgorithm.Ed25519. Managed API backed by the platform-supported NSec native runtime.

Ed25519Signer class. Also available in JDK 15+ via EdDSA provider.

EphemeralSecret + PublicKey. Part of the dalek ecosystem.

nacl.public.Box for X25519 key agreement. Wraps libsodium.

x25519.getSharedSecret(). Pure JS.

ecdh.X25519(). Standard-library X25519 key agreement.

X25519 key agreement. Modern .NET crypto library.

X25519Agreement class. Also in JDK 11+ via XDH.

Hkdf::<Sha256>::new_from_prk(). Pure Rust.

cryptography.hazmat.primitives.kdf.hkdf.HKDF. Built on OpenSSL.

hkdf(sha256, inputKey, salt, info, length). Pure JS.

hkdf.Key and hkdf.Extract/Expand. Standard-library RFC 5869 implementation.

HKDF.DeriveKey/Extract/Expand implement RFC 5869.

HKDFBytesGenerator class.

hmac::sign/verify. Hardware-accelerated SHA-256.

hmac.new(key, msg, hashlib.sha256). Python standard library.

hmac(sha256, key, message). Pure JS.

crypto.subtle.sign('HMAC', key, data). Native browser.

hmac.New(sha256.New, key). Standard library.

HMACSHA256 class. Built into .NET.

Mac.getInstance("HmacSHA256"). Built into the JDK.

Pure Rust implementation of final FIPS 203 ML-KEM.

Pure Python implementation of final FIPS 203 ML-KEM.

ml_kem768 implementation of final FIPS 203 with ACVP and Wycheproof correctness tests.

Standard-library implementation of final FIPS 203 ML-KEM, including ML-KEM-768.

MLKem class for FIPS 203, including the ML-KEM-768 parameter set.

MLKEMKeyPairGenerator and MLKEMExtractor implement final FIPS 203 ML-KEM.

Pure Rust implementation of final FIPS 204 ML-DSA.

Pure Python implementation of final FIPS 204 ML-DSA.

ml_dsa65 implementation of final FIPS 204 with ACVP and Wycheproof correctness tests.

Cloudflare CIRCL implementation of final FIPS 204 ML-DSA, including ML-DSA-65.

MLDsa class for FIPS 204, including the ML-DSA-65 parameter set.

MLDSAKeyPairGenerator and MLDSASigner implement final FIPS 204 ML-DSA.