Algorithm Selection Guide

This page covers the commonly used algorithms in cryptopp-modern and how to choose between them. It is a curated selection, not an exhaustive catalogue: the library also carries the wider inherited Crypto++ algorithm set, and fork additions such as XAES-256-GCM and AES-CTR-HMAC appear in their sections below.

Hash Functions

Recommended for new work

Legacy (Compatibility Only)

Header files: blake3.h, sha.h, sha3.h, blake2.h, md5.h, ripemd.h, tiger.h, whirlpool.h

Password Hashing & Key Derivation

Password Hashing

Key Derivation Functions (KDF)

Header files: argon2.h, scrypt.h, pwdbased.h, hkdf.h

Symmetric Encryption

Block Ciphers

Stream Ciphers

Authenticated Encryption

Classical Modes (Require Separate MAC)

Header files: aes.h, chacha.h, serpent.h, twofish.h, camellia.h, aria.h, modes.h, gcm.h, ccm.h, eax.h, chachapoly.h, xaes_256_gcm.h, aes_ctr_hmac.h

Public-Key Cryptography

Digital Signatures

Key Exchange

Public-Key Encryption

Header files: xed25519.h, eccrypto.h, rsa.h, dsa.h

Post-Quantum Cryptography

Key Encapsulation

X-Wing is a hybrid of X25519 and ML-KEM-768. It implements a specific draft revision, named above; confirm the peer implements the same revision before relying on wire interoperability.

Digital Signatures

LMS/HSS is stateful: each signature consumes state that must be persisted durably. See the Stateful Signing Guide before using, and the Choosing LMS/HSS Parameters guide for signature sizes per configuration. Mixed per-level hierarchies and the LM-OTS W1/W2/W4 sets arrive in 2026.8.0.

Header files: mlkem.h, mldsa.h, slhdsa.h, xwing.h, lms.h, hss.h, stateful.h

Message Authentication Codes (MAC)

Header files: hmac.h, blake3.h, cmac.h, poly1305.h, siphash.h

Elliptic Curves

Modern Curves

NIST Curves

Other Curves

Header files: xed25519.h, eccrypto.h, asn.h (for curve OIDs)

Random Number Generators

Application CSPRNGs

Hardware entropy sources

Header files: osrng.h, randpool.h, rdrand.h

Encoding & Utilities

Encoders

Compression

Header files: hex.h, base64.h, base32.h, gzip.h, zlib.h

Algorithm Selection Guide

By Use Case

I need to hash data (file integrity, checksums):

• Modern projects: BLAKE3
• FIPS-standardised: SHA-256 or SHA-512
• Legacy compatibility: SHA-1 (deprecated)

I need to hash passwords:

• Modern projects: Argon2id
• Compatibility: PBKDF2 or scrypt

I need to encrypt data:

• Modern projects: AES-GCM or ChaCha20-Poly1305
• No AES hardware: ChaCha20-Poly1305
• FIPS-standardised: AES-GCM

I need digital signatures:

• Modern projects: Ed25519
• NIST-standardised: ECDSA (P-256)
• Legacy systems: RSA (2048-bit minimum)
• Long-lived or post-quantum requirements: ML-DSA, or a hybrid classical + PQC design where the protocol requires it
• Hash-based post-quantum: SLH-DSA for stateless use; LMS/HSS only where durable signer state can be managed

I need key exchange:

• Modern projects: X25519
• NIST-standardised: ECDH (P-256)
• Long-lived or post-quantum requirements: ML-KEM, or X-Wing where its exact draft revision is acceptable
• Legacy systems: DH (2048-bit minimum)

I need message authentication:

• General purpose: HMAC-SHA256
• Fast keyed hashing: BLAKE3 keyed mode
• Block cipher-based: CMAC-AES

Security Levels

Key Size Equivalents

Hash equivalence in this table refers to collision resistance.

Recommended Minimum Sizes (2026)

• Symmetric encryption: 128-bit (AES-128)
• Hash functions: 256-bit (SHA-256, BLAKE3)
• RSA: 2048-bit (3072-bit for long-term)
• Elliptic curves: 256-bit (P-256, Curve25519)
• Diffie-Hellman: 2048-bit

Standards Compliance

FIPS 140-2/140-3

FIPS-standardised algorithms implemented by cryptopp-modern:

• AES (all key sizes)
• SHA-2 family (SHA-224, SHA-256, SHA-384, SHA-512)
• SHA-3 family
• RSA (2048-bit minimum)
• ECDSA (P-256, P-384, P-521)
• HMAC (with approved hash functions)

Note: implementing a FIPS-specified algorithm is not the same as providing a FIPS-approved operational implementation. cryptopp-modern is not a FIPS 140-validated module; it implements the algorithms in a form suitable for integration into an appropriately validated module.

FIPS Post-Quantum Standards

• FIPS 203 - ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism)
• FIPS 204 - ML-DSA (Module-Lattice-Based Digital Signature Algorithm)
• FIPS 205 - SLH-DSA (Stateless Hash-Based Digital Signature Algorithm)
• SP 800-208 - LMS/HSS (Stateful Hash-Based Signature Schemes). Conformant signing deployments have additional hardware-module and key-handling requirements beyond the algorithm implementation; see the LMS/HSS API reference.

NIST Recommendations

• Hash: SHA-256, SHA-384, SHA-512, SHA-3
• Symmetric: AES-128, AES-256
• Signatures: ECDSA (P-256+), RSA (2048-bit+), ML-DSA, SLH-DSA, LMS/HSS (stateful)
• Key Exchange: ECDH (P-256+), ML-KEM

RFC Standards

• Argon2: RFC 9106
• scrypt: RFC 7914
• ChaCha20-Poly1305: RFC 8439
• Ed25519: RFC 8032
• X25519: RFC 7748
• HMAC: RFC 2104
• HKDF: RFC 5869
• ARIA: RFC 5794

Deprecated Algorithms

Do not use for new projects:

Quick Reference

Most common combinations:

// File hashing
BLAKE3 or SHA-256

// Password storage
Argon2id

// Symmetric encryption
AES-256-GCM or ChaCha20-Poly1305

// Digital signatures
Ed25519 or ECDSA-P256 (classical), ML-DSA (post-quantum)

// Key exchange
X25519 or ECDH-P256 (classical), ML-KEM (post-quantum)

// Message authentication
HMAC-SHA256 or BLAKE3 keyed mode

Documentation Links

• Hash Functions - Detailed hash function guide
• BLAKE3 - BLAKE3 documentation
• Argon2 - Password hashing guide
• Symmetric Encryption - AES, ChaCha20 guide
• Public-Key Cryptography - RSA, ECDSA, Ed25519, X25519
• Post-Quantum Cryptography - ML-KEM, ML-DSA, SLH-DSA, LMS/HSS, X-Wing
• Security Concepts - Security best practices
• Beginner’s Guide - Complete tutorial

Platform Support

The library baseline is C++11. See the build documentation and the repository CI matrix for the compilers and architectures currently built and tested; algorithm availability is not separately guaranteed per platform beyond what CI covers.

Hardware acceleration is used where the CPU supports it:

• AES (AES-NI on x86/x64)
• SHA-256 (SHA extensions)
• ChaCha20 (SSE2, SSSE3, AVX2, NEON, Altivec)
• BLAKE3 (SSE4.1, AVX2, AVX-512)