crypto-algorithms

Crypto Algorithms

Algorithm selection guide -- when to use what, key sizes, modes of operation, and the decision tree for cryptographic choices.

Knowledge Base

The Algorithm Decision Tree

What do you need to do?
|
├── Encrypt data (make it unreadable without a key)
|   ├── Symmetric (same key for encrypt/decrypt, fast)
|   |   ├── Prefer: AES-256-GCM or ChaCha20-Poly1305
|   |   ├── Alternative: XChaCha20-Poly1305 (extended nonce)
|   |   └── Never: ECB mode, DES, 3DES, RC4, Blowfish
|   |
|   └── Asymmetric (different keys, slower, for key exchange)
|       ├── Key exchange: X25519 (ECDH on Curve25519)
|       ├── Encryption: RSA-OAEP (2048+ bits), or hybrid with X25519
|       └── Never: RSA-PKCS1v15 for new systems
|
├── Sign data (prove authenticity and integrity)
|   ├── Prefer: Ed25519 (fast, short signatures, secure)
|   ├── Alternative: ECDSA P-256, RSA-PSS (3072+ bits)
|   └── Never: RSA-PKCS1v15 signatures, DSA
|
├── Hash data (one-way fingerprint)
|   ├── General purpose: SHA-256, SHA-384, SHA-512, BLAKE2b, BLAKE3
|   ├── Short output: SHA-256 truncated, BLAKE2s
|   └── Never for security: MD5, SHA-1 (collision attacks exist)
|
├── Hash passwords (intentionally slow, salt required)
|   ├── Prefer: Argon2id (memory-hard, GPU/ASIC resistant)
|   ├── Alternative: bcrypt (cost >= 12), scrypt
|   ├── Legacy acceptable: PBKDF2-HMAC-SHA256 (iterations >= 600000)
|   └── Never: plain SHA-256, MD5, SHA-1, single-round anything
|
├── Authenticate messages (verify integrity with a key)
|   ├── Prefer: HMAC-SHA-256
|   ├── Within AEAD: Poly1305 (built into ChaCha20-Poly1305, GCM)
|   └── Never: MAC-then-encrypt (use encrypt-then-MAC or AEAD)
|
└── Derive keys (from a master key or password)
    ├── From master key: HKDF-SHA-256 (extract-then-expand)
    ├── From password: Argon2id, scrypt, PBKDF2
    └── Never: Simple hash of password, XOR with constant

Key Size Guidelines (2025+)