Cryptography
Cryptography is one of the most important tools businesses use to secure the systems that hold its most important asset – data – whether it is at-rest or in-motion. Data is vital information in the form of customer PII, employee PII, intellectual property, business plans, and any other confidential information. Therefore, cryptography is critical infrastructure because increasingly the security of sensitive data relies on cryptographical solutions.
Contents
Theory
Algorithms
Symmetric encryption
- 3DES - Symmetric-key block cipher (or Triple Data Encryption Algorithm (TDEA or Triple DEA), which applies the Data Encryption Standard (DES) cipher algorithm three times to each data block.
- AES - Symmetric-key block cipher algorithm and U.S. government standard for secure and classified data encryption and decryption (also known as Rijndael).
- Blowfish - Symmetric-key block cipher, designed in 1993 by Bruce Schneier. Notable features of the design include key-dependent S-boxes and a highly complex key schedule.
Asymmetric encryption
- DH - A method of exchanging cryptographic keys securely over a public channel. Unlike RSA, the Diffie-Hellman Key Exchange is not encryption, and is only a way for two parties to agree on a shared secret value. Since the keys generated are completely pseudo-random, DH key exchanges can provide forward secrecy (https://en.wikipedia.org/wiki/Forward_secrecy).
- ECC - Public-key cryptosystems based on the algebraic structure of elliptic curves over finite fields.
- RSA - One of the first practical public-key cryptosystems and is widely used for secure data transmission. In RSA, this asymmetry is based on the practical difficulty of factoring the product of two large prime numbers, the factoring problem.
- Transform Encryption (aka Proxy Re-Encryption) - Transform encryption uses three mathematically related keys: one to encrypt plaintext to a recipient, a second to decrypt the ciphertext, and a third to transform ciphertext encrypted to one recipient so it can be decrypted by a different recipient.
Hash functions
- MD5 - Widely used hash function producing a 128-bit hash value. MD5 was initially designed to be used as a cryptographic hash function, but it has been found to suffer from extensive vulnerabilities. It can still be used as a checksum to verify data integrity, but only against unintentional corruption.
- SHA1 - Cryptographic hash function designed by the NSA. SHA-1 produces a 160-bit hash value known as a message digest. SHA-1 is no longer considered secure against well-funded opponents.
- SHA2 - Set of hash functions designed by the NSA. SHA-256 and SHA-512 are novel hash functions computed with 32-bit and 64-bit words, respectively. They use different shift amounts and additive constants, but their structures are otherwise virtually identical, differing only in the number of rounds.
Articles
Books
- A Graduate Course in Applied Cryptography - The book covers many constructions for different tasks in cryptography.
- An Introduction to Mathematical Cryptography - Introduction to modern cryptography.
- Crypto101 - Crypto 101 is an introductory course on cryptography.
- Cryptography Engineering - Learn to build cryptographic protocols that work in the real world.
- Handbook of Applied Cryptography - This book is intended as a reference for professional cryptographers.
- Introduction to Modern Cryptography - Introductory-level treatment of cryptography written from a modern, computer science perspective.
- OpenSSL Cookbook - The book about OpenSSL.
- Practical Cryptography for Developers - Developer-friendly book on modern cryptography (hashes, MAC codes, symmetric and asymmetric ciphers, key exchange, elliptic curves, digital signatures) with lots of code examples.
- Real World Cryptography - This book teaches you applied cryptographic techniques to understand and apply security at every level of your systems and applications.
- Security Engineering - There is an extraordinary textbook written by Ross Anderson, professor of computer security at University of Cambridge.
- Serious Cryptography - A Practical Introduction to Modern Encryption by Jean-Philippe Aumasson.
- The Code Book - This book is a digest of the history of cryptography, covering both ancient times, and newer cryptography methods. There are exercises at the end and the solution of those was rewarded with $10.000.
- The Cryptoparty Handbook - This book provides a comprehensive guide to the various topics of the computer and internet security.
- Understanding Cryptography - Often overlooked, this book is a boon for beginners to the field. It contains plenty of exercises at the end of each chapter, aimed at reinforcing concepts and cementing ideas.
- Cryptography: A Very Short Introduction - This book is a clear and informative introduction to cryptography and data protection - subjects of considerable social and political importance.
Courses
- A Self-Study Course In Block-Cipher Cryptanalysis - This paper attempts to organize the existing literature of block-cipher cryptanalysis in a way that students can use to learn cryptanalytic techniques and ways to break algorithms, by Bruce Schneier.
- Applied Cryptography - Cryptography is present in everyday life, from paying with a credit card to using the telephone. Learn all about making and breaking puzzles in computing.
- Crypto Strikes Back! - This talk will cover crypto vulnerabilities in widely-deployed systems and how the smallest oversight resulted in catastrophe.
- Cryptography - A practical oriented course in Cryptography by University of Maryland College Park.
- Cryptography - Stanford University - This course explains the inner workings of cryptographic primitives and how to correctly use them. Students will learn how to reason about the security of cryptographic constructions and how to apply this knowledge to real-world applications.
- Cryptography I - The course begins with a detailed discussion of how two parties who have a shared secret key can communicate securely when a powerful adversary eavesdrops and tampers with traffic. We will examine many deployed protocols and analyze mistakes in existing systems.
- Cybrary Cryptography - This online course we will cover how cryptography is the cornerstone of security, and how through its use of different encryption methods, such as ciphers, and public or private keys, you can protect private or sensitive information from unauthorized access.
- Harvard’s Cryptography Lecture notes - An introductory but fast-paced undergraduate/beginning graduate course on cryptography, Used for Harvard CS 127.
- Journey into cryptography - The course of cryptography by Khan Academy.
- Practical Aspects of Modern Cryptography - Practical Aspects of Modern Cryptography, Winter 2006 University of Washington CSE.
- Theory and Practice of Cryptography - Introduction to Modern Cryptography, Using Cryptography in Practice and at Google, Proofs of Security and Security Definitions and A Special Topic in Cryptography.
Other lists
- Awesome crypto-papers – A curated list of cryptography papers, articles, tutorials and howtos.
- Awesome HE – A curated list of homomorphic encryption libraries, software and resources.
Standalone
- Bcrypt - Cross-platform file encryption utility.
- blackbox - safely store secrets in Git/Mercurial/Subversion.
- certbot - Previously the Let’s Encrypt Client, is EFF’s tool to obtain certs from Let’s Encrypt, and (optionally) auto-enable HTTPS on your server. It can also act as a client for any other CA that uses the ACME protocol.
- Coherence - Cryptographic server for modern web apps.
- cryptomator - Multi-platform transparent client-side encryption of your files in the cloud.
- Databunker - API based personal data or PII storage service built to comply with GDPR and CCPA.
- gpg - Complete and free implementation of the OpenPGP standard. It allows to encrypt and sign your data and communication, features a versatile key management system. GnuPG is a command line tool with features for easy integration with other applications.
- ironssh - End-to-end encrypt transferred files using sftp/scp and selectively share with others. Automatic key management works with any SSH server. Encrypted files are gpg compatible.
- Nipe - Nipe is a script to make Tor Network your default gateway.
- sops - sops is an editor of encrypted files that supports YAML, JSON and BINARY formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault and PGP.
- ves - End-to-end encrypted sharing via cloud repository, secure recovery through a viral network of friends in case of key loss.
- cryptool - EThe CT project develops the world’s most-widespread free e-learning programs in the area of cryptography and cryptanalysis. All learning programs in the CT project are open source and available for free.
Plugins
Git
- git-crypt - Transparent file encryption in git.
- git-secret - Bash-tool to store your private data inside a git repository.
Playgrounds
- Cryptography Playground - A simple web tool to play and learn basic concepts of cryptography like, hashing, symmetric, asymmetric, zkp etc.
Frameworks and Libs
C
- crypto-algorithms - Basic implementations of standard cryptography algorithms, like AES and SHA-1.
- libgcrypt - Cryptographic library developed as a separated module of GnuPG.
- libsodium - Modern and easy-to-use crypto library.
- libtomcrypt - Fairly comprehensive, modular and portable cryptographic toolkit.
- libVES.c - End-to-end encrypted sharing via cloud repository, secure recovery through a viral network of friends in case of key loss.
- milagro-crypto-c - Small, self-contained and fast open source crypto library. It supports RSA, ECDH, ECIES, ECDSA, AES-GCM, SHA2, SHA3 and Pairing-Based Cryptography.
- monocypher - small, portable, easy to use crypto library inspired by libsodium and TweetNaCl.
- NaCl - High-speed library for network communication, encryption, decryption, signatures, etc.
- OpenSSL - TLS/SSL and crypto library.
- PolarSSL - PolarSSL makes it trivially easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) products, facilitating this functionality with a minimal coding footprint.
- RHash - Great utility for computing hash sums.
- themis - High level crypto library for storing data (AES), secure messaging (ECC + ECDSA / RSA + PSS + PKCS#7) and session-oriented, forward secrecy data exchange (ECDH key agreement, ECC & AES encryption). Ported on many languages and platforms, suitable for client-server infastructures.
- tiny-AES128-C - Small portable AES128 in C.
- wolfSSL - Small, fast, portable implementation of TLS/SSL for embedded devices to the cloud.
- xxHash - Extremely fast hash algorithm.
C++
- Botan - Cryptography library written in
C++11.
- cryptopp - Crypto++ Library is a free C++ class library of cryptographic schemes.
- HElib - Software library that implements homomorphic encryption (HE).
- Nettle - Low-level cryptographic library.
- s2n - Implementation of the TLS/SSL protocols.
C-sharp
Clojure
- buddy-core - Cryptographic Api.
- clj-crypto - Wrapper for Bouncy Castle.
- pandect - Fast and easy-to-use Message Digest, Checksum and HMAC library for Clojure.
- secrets.clj - A Clojure library designed to generate cryptographically strong random numbers suitable for managing data such as passwords, account authentication, security tokens, and related secrets.
Common Lisp
- crypto-shortcuts - Collection of common cryptography functions.
- ironclad - Collection of common crypto shortcuts.
- trivial-ssh - SSH client library for Common Lisp (Built on libssh2).
Delphi
- DelphiEncryptionCompendium - Cryptographic library for Delphi.
- LockBox - LockBox 3 is a Delphi library for cryptography.
- SynCrypto - Fast cryptographic routines (hashing and cypher), implementing AES, XOR, RC4, ADLER32, MD5, SHA1, SHA256 algorithms, optimized for speed.
- TForge - TForge is open-source crypto library written in Delphi, compatible with FPC.
Elixir
- cipher - Elixir crypto library to encrypt/decrypt arbitrary binaries.
- cloak - Cloak makes it easy to use encryption with Ecto.
- comeonin - Password authorization (bcrypt) library for Elixir.
- elixir-rsa -
:public_key cryptography wrapper for Elixir.
- elixir_tea - TEA implementation in Elixir.
- ex_crypto - Elixir wrapper for Erlang
:crypto and :public_key modules. Provides sensible defaults for many crypto functions to make them easier to use.
- exgpg - Use gpg from Elixir.
- pot - Erlang library for generating one time passwords compatible with Google Authenticator.
- siphash-elixir - Elixir implementation of the SipHash hash family.
Erlang
- crypto - Functions for computation of message digests, and functions for encryption and decryption.
- public_key - Provides functions to handle public-key infrastructure.
Go
- crypto - Official Website Resources.
- cryptoballot - Cryptographically secure online voting.
- dedis/crypto - Advanced crypto library for the Go language.
- dkeyczar - Port of Google’s Keyczar cryptography library to Go.
- gocrypto - Example source code for the Practical Crypto with Go book.
- goThemis - Go wrapper on Themis. High level crypto library for storing data (AES), secure messaging (ECC + ECDSA / RSA + PSS + PKCS#7) and session-oriented, forward secrecy data exchange (ECDH key agreement, ECC & AES encryption).
Haskell
Haxe
JavaScript
- asmCrypto - JavaScript implementation of popular cryptographic utilities with performance in mind.
- bcrypt-Node.js - Native implementation of bcrypt for Node.js.
- cifre - Fast crypto toolkit for modern client-side JavaScript.
- closure-library - Google’s common JavaScript library.
- cryptico - Easy-to-use encryption system utilizing RSA and AES for JavaScript.
- crypto-js - JavaScript library of crypto standards.
- cryptojs - Provide standard and secure cryptographic algorithms for Node.js.
- forge - Native implementation of TLS in JavaScript and tools to write crypto-based and network-heavy webapps.
- IronNode - Transform encryption library, a variant of proxy re-encryption, for encrypting to users or groups, and easily adding strong data controls to Node.js apps.
- IronWeb - Transform encryption library, a variant of proxy re-encryption, for easily managing end-to-end encryption securely in the browser.
- javascript-crypto-library - JavaScript Crypto Library provides web developers with an extensive and efficient set of cryptographic functions.
- js-nacl - Pure-JavaScript High-level API to Emscripten-compiled libsodium routines.
- jsencrypt - JavaScript library to perform OpenSSL RSA Encryption, Decryption, and Key Generation.
- JShashes - Fast and dependency-free cryptographic hashing library for Node.js and browsers (supports MD5, SHA1, SHA256, SHA512, RIPEMD, HMAC).
- jsrsasign - The ‘jsrsasign’ (RSA-Sign JavaScript Library) is an opensource free cryptography library supporting RSA/RSAPSS/ECDSA/DSA signing/validation.
- jsThemis - JavaScript wrapper on Themis. High level crypto library for storing data (AES), secure messaging (ECC + ECDSA / RSA + PSS + PKCS#7) and session-oriented, forward secrecy data exchange (ECDH key agreement, ECC & AES encryption).
- libsodium.js - libsodium compiled to pure JavaScript, with convenient wrappers.
- libVES.js - End-to-end encrypted sharing via cloud repository, secure recovery through a viral network of friends in case of key loss.
- milagro-crypto-js - MCJS is a standards compliant JavaScript cryptographic library with no external dependencies except for the random seed source. Compatible for Node.js and browser. It supports RSA, ECDH, ECIES, ECDSA, AES-GCM, SHA2, SHA3, Pairing-Based Cryptography and New Hope.
- noble - high-security, easily auditable set of contained cryptographic libraries and tools. Zero dependencies each.
- node.bcrypt.js - bcrypt for Node.js.
- OpenPGP.js - OpenPGP implementation for JavaScript.
- PolyCrypt - Pure JS implementation of the WebCrypto API.
- rusha - High-performance pure-javascript SHA1 implementation suitable for large binary data, reaching up to half the native speed.
- sjcl - Stanford JavaScript Crypto Library.
- TweetNaCl.js - A port of TweetNaCl / NaCl for JavaScript for modern browsers and Node.js.
- URSA - RSA public/private key OpenSSL bindings for Node.
Java
- Apache Shiro - Performs authentication, authorization, cryptography and session management.
- Bouncy Castle - All-purpose cryptographic library. JCA provider, wide range of functions from basic helpers to PGP/SMIME operations.
- Flexiprovider - Powerful toolkit for the Java Cryptography Architecture.
- GDH - Generalized Diffie-Hellman key exchange Java library for multiple parties built on top of the Vert.x framework.
- Google Keyczar - Easy to use, yet safe encryption framework with key versioning.
- Google Tink - A small crypto library that provides a safe, simple, agile and fast way to accomplish some common crypto tasks.
- Java Themis - Java/Android wrapper on Themis. High level crypto library for storing data (AES), secure messaging (ECC + ECDSA / RSA + PSS + PKCS#7) and session-oriented, forward secrecy data exchange (ECDH key agreement, ECC & AES encryption).
- jbcrypt - jBCrypt is an implementation the OpenBSD Blowfish password hashing
algorithm.
- Keycloak - Open Source Identity and Access Management For Modern Applications and Services.
- keywhiz - A system for distributing and managing secrets.
- pac4j - Security engine.
- Password4j - A Java user-friendly cryptographic library for hashing and checking passwords with different Key derivation functions (KDFs) and Cryptographic hash functions (CHFs).
- Project Kalium - Java binding to the Networking and Cryptography (NaCl) library with the awesomeness of libsodium.
- scrypt - Pure Java implementation of the scrypt key derivation function and a JNI interface to the C implementations, including the SSE2 optimized version.
- securitybuilder - Fluent Builder API for JCA/JSSE objects.
Julia
- Crypto.jl - Library that wraps OpenSSL, but also has pure Julia implementations for reference.
- MbedTLS.jl - Wrapper around the mbed TLS and cryptography C libary.
- Nettle.jl - Julia wrapper around nettle cryptographic hashing/
encryption library providing MD5, SHA1, SHA2 hashing and HMAC functionality, as well as AES encryption/decryption.
- SHA.jl - Performant, 100% native-julia SHA1, SHA2-{224,256,384,512} implementation.
Lua
- lua-lockbox - Collection of cryptographic primitives written in pure Lua.
- LuaCrypto - Lua bindings to OpenSSL.
Objective-C
- CocoaSecurity - AES, MD5, SHA1, SHA224, SHA256, SHA384, SHA512, Base64, Hex.
- ObjC Themis - ObjC wrapper on Themis for iOS and macOS. High level crypto library for storing data (AES), secure messaging (ECC + ECDSA / RSA + PSS + PKCS#7) and session-oriented, forward secrecy data exchange (ECDH key agreement, ECC & AES encryption).
- ObjectivePGP - ObjectivePGP is an implementation of OpenPGP protocol for iOS and macOS. OpenPGP is the most widely used email encryption standard.
- RNCryptor - CCCryptor (AES encryption) wrappers for iOS and Mac.
PHP
- halite - Simple library for encryption using
libsodium.
- libsodium-laravel - Laravel Package Abstraction using
libsodium.
- PHP Encryption - Library for encrypting data with a key or password in PHP.
- PHP Themis - PHP wrapper on Themis. High level crypto library for storing data (AES), secure messaging (ECC + ECDSA / RSA + PSS + PKCS#7) and session-oriented, forward secrecy data exchange (ECDH key agreement, ECC & AES encryption).
- TCrypto - TCrypto is a simple and flexible PHP 5.3+ in-memory key-value storage library.
Python
- bcrypt - Modern password hashing for your software and your servers.
- charm - Framework for rapidly prototyping cryptosystems.
- Crypto-Vinaigrette - Quantum resistant asymmetric key generation tool for digital signatures.
- cryptography - Python library which exposes cryptographic recipes and primitives.
- cryptopy - Pure python implmentation of cryptographic algorithms and applications.
- django-cryptography - Easily encrypt data in Django.
- hashids - Implementation of hashids in Python.
- paramiko - Python implementation of the SSHv2 protocol, providing both client and server functionality.
- Privy - An easy, fast lib to correctly password-protect your data.
- pycryptodome - Self-contained Python package of low-level cryptographic primitives.
- PyElliptic - Python OpenSSL wrapper. For modern cryptography with ECC, AES, HMAC, Blowfish.
- pynacl - Python binding to the Networking and Cryptography (NaCl) library.
- pythemis - Python wrapper on Themis. High level crypto library for storing data (AES), secure messaging (ECC + ECDSA / RSA + PSS + PKCS#7) and session-oriented, forward secrecy data exchange (ECDH key agreement, ECC & AES encryption).
R
- rscrypt - Package for a collection of scrypt cryptographic functions.
Ruby
- bcrypt-ruby - Ruby binding for the OpenBSD bcrypt() password hashing algorithm, allowing you to easily store a secure hash of your users’ passwords.
- RbNaCl - Ruby binding to the Networking and Cryptography (NaCl) library.
- Ruby Themis - Ruby wrapper on Themis. High level crypto library for storing data (AES), secure messaging (ECC + ECDSA / RSA + PSS + PKCS#7) and session-oriented, forward secrecy data exchange (ECDH key agreement, ECC & AES encryption).
Rust
- dalek cryptography - Fast yet safe mid-level API for ECC, Bulletproofs, and more.
- mundane - is a Rust cryptography library backed by BoringSSL that is difficult to misuse, ergonomic, and performant.
- ockam - is a Rust library for end-to-end encryption and mutual authentication.
- octavo - Highly modular & configurable hash & crypto library.
- proteus - Axolotl protocol implementation, without header keys, in Rust.
- recrypt - A pure-Rust library that implements cryptographic primitives for building a multi-hop Proxy Re-encryption scheme, known as Transform Encryption.
- ring - Safe, fast, small crypto using Rust & BoringSSL’s cryptography primitives.
- rust-crypto - Mostly pure-Rust implementation of various cryptographic algorithms.
- rust-openssl - OpenSSL bindings for Rust.
- rustls - Rustls is a new, modern TLS library written in Rust.
- sodiumoxide - Sodium Oxide: Fast cryptographic library for Rust (bindings to libsodium).
- suruga - TLS 1.2 implementation in Rust.
- webpki - Web PKI TLS X.509 certificate validation in Rust.
Scala
- recrypt - Transform encryption library for Scala.
- scrypto - Cryptographic primitives for Scala.
- tsec - A type-safe, functional, general purpose security and cryptography library.
Swift
- CryptoSwift - Crypto related functions and helpers for Swift implemented in Swift programming language.
- IDZSwiftCommonCrypto - Wrapper for Apple’s CommonCrypto library written in Swift.
- OpenSSL - Swift OpenSSL for macOS and Linux.
- SweetHMAC - Tiny and easy to use Swift class to encrypt strings using HMAC algorithms.
- Swift-Sodium - Swift interface to the Sodium library for common crypto operations for iOS and macOS.
- SwiftSSL - Elegant crypto toolkit in Swift.
- SwiftThemis - Swift wrapper on Themis for iOS and macOS. High level crypto library for storing data (AES), secure messaging (ECC + ECDSA / RSA + PSS + PKCS#7) and session-oriented, forward secrecy data exchange (ECDH key agreement, ECC & AES encryption).
Resources
Blogs
- A Few Thoughts on Cryptographic Engineering - Some random thoughts about crypto.
- Bristol Cryptography Blog - Official blog for the University of Bristol cryptography research group. It’s a group blog, primarily targeted towards cryptographers and crypto students.
- Charles Engelke’s Blog - WebCrypto Blog Posts.
- Root Labs rdist - Nate Lawson and his co-authors write on a variety of topics including hardware implementation, cryptographic timing attacks, DRM, and the Commodore 64.
- Salty Hash - Covers topics on encryption, data control, privacy, and security.
- Schneier on security - One of the oldest and most famous security blogs. Bruce covers topics from block cipher cryptanalysis to airport security.
Mailing lists
- metzdowd.com - “Cryptography” is a low-noise moderated mailing list devoted to cryptographic technology and its political impact.
- Modern Crypto - Forums for discussing modern cryptographic practice.
- randombit.net - List for general discussion of cryptography, particularly the technical aspects.
- Boxentriq - Easy to use tools for analysis and code-breaking of the most frequent ciphers, including Vigenère, Beaufort, Keyed Caesar, Transposition Ciphers, etc.
- Cryptolab - is a set of cryptography related tools.
- CrypTool - Great variety of ciphers, encryption methods and analysis tools are introduced, often together with illustrated examples.
- CyberChef - a web app for encryption, encoding, compression, and data analysis.
- factordb.com - Factordb.com is tool used to store known factorizations of any number.
- keybase.io - Keybase maps your identity to your public keys, and vice versa.
Web-sites
- Applied Crypto Hardening - A lot ready to use best practice examples for securing web servers and more.
- Cryptocurrencies Dashboard - A dashboard of most active cryptocurrencies discussed on Reddit.
- Cryptography Stackexchange - Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography.
- Cryptohack - A platform with lots of interactive cryptography challenges, similar to Cryptopals.
- Cryptopals Crypto Challenges - A series of applied cryptography challenges, starting from very basic challenges, such as hex to base 64 challanges, and gradually increasing the difficulty up to abstract algebra.
- Garykessler Crypto - An Overview of Cryptography.
- IACR - The International Association for Cryptologic Research is a non-profit scientific organization whose purpose is to further research in cryptology and related fields.
- Learn Cryptography - Dedicated to helping people understand how and why the cryptographic systems they use everyday without realizing work to secure and protect their privacy.
- Subreddit of Cryptography - This subreddit is intended for links and discussions surrounding the theory and practice of strong cryptography.
- TikZ for Cryptographers - A collection of block diagrams of common cryptographic functions drawn in TikZ to be used in research papers and presentations written in LaTeX.
- WebCryptoAPI - This specification describes a JavaScript API for performing basic cryptographic operations in web applications, such as hashing, signature generation and verification, and encryption and decryption.
special thanks to Paul Veillard.