Simple Algorithms Catalog - 89 Algorithms

Complete reference of all single-component cryptographic algorithms supported by ANKASecure platform.

Note: This catalog covers simple (single-component) algorithms. For hybrid classical+PQC combinations, see Composite Algorithms Catalog (41 combinations). For a complete overview of all 130 algorithms, see Complete Catalog Overview.

The code catalogue is the authority. AlgorithmCatalogue in ankasecure-common-algorithms is the platform's single algorithm vocabulary: the metering path resolves every algorithm name through it, derives post-quantum from AlgorithmProfile.category(), and buckets the per-family usage counters from the profile's own kty, so a new catalogue entry is metered and audited with no other code change.

The catalogue holds 89 simple profiles (50 CLASSICAL, 39 POST_QUANTUM), and the matrix below carries one row per profile, with the Standards column equal to each profile's standards() set. The authoritative list is returned by GET /api/v3/key-management/supported-algorithms.

Algorithm Categories

The Standards column of this table is the union of the attributions of the profiles in the category; no single profile necessarily carries all of them. The per-profile sets are in the matrix below, and they are the catalogue's standards() sets.

Complete Algorithm Matrix (89 Total)

Post-Quantum KEM (Key Encapsulation Mechanisms)

HQC is a declared exception to the attribution rule. Everywhere else an attribution means the body recommends the parameter set. HQC-128/192/256 carry NIST (selected for standardization in March 2025; FIPS 207 not yet published) and ETSI (a specification in draft), although neither body recommends HQC today. Both attributions are kept; each profile's advisory states the standardization status, and the exception is revisited when FIPS 207 is published. Because of it, NIST_APPROVED and a custom mandatoryStandards: ["NIST"] policy admit stand-alone HQC.

NTRU Prime follows section 8, "Expected strength", of the NTRU Prime round-3 specification (2020-10-07): NTRUPRIME-761 (ntrulpr761) is NIST category 2, with a classical security strength of 128 bits and security level 1, the level of ML-DSA-44, which is also category 2; NTRUPRIME-857 (ntrulpr857) is category 3, 192 bits and level 3. A policy whose minimum security level is 3 therefore does not admit NTRUPRIME-761 for a new key, a rotation or an import. The rotation policy's requireNoDowngrade axis compares weakest-link levels, so rotating a level 3 key (ML-KEM-768, NTRUPRIME-857) to NTRUPRIME-761 is a downgrade. It is refused when requireNoDowngrade is set, and otherwise admitted only with the operator's downgrade consent. Rotating an NTRUPRIME-761 key to a level 1 target (ML-KEM-512, BIKE-128) is not a downgrade.

SMAUG-T is the module-lattice KEM of Korea's post-quantum competition (KpqC), whose final selection was announced in January 2025 (kpqc.cryptolab.co.kr, accessed 2026-10-03). Korean Standard (KS) work on it is in progress, so no published standard names it; no body the catalogue carries recommends it, so its standards set is empty and it is EXPERIMENTAL. The security levels (MODE1 L1, MODE3 L3, MODE5 L5) are the designers' claims in the SMAUG-T specification dated 2026-02-04, not a NIST evaluation. SMAUG-T-MODET (TiMER) is not offered: that specification (end of §4) recommends limiting the number of encapsulations and decapsulations per key when the TiMER set is used, a limit the platform does not model for KEM keys. Like the other stand-alone KEMs, a SMAUG-T key needs a hybrid under a policy that requires one.

Post-Quantum Signatures

Stateful hash-based rows (NIST SP 800-208, RFC 8391, RFC 8554). Each row is one approved parameter set, and a key can produce a fixed number of signatures — every one under a one-time index the platform commits as spent before the signature exists (Stateful Hash-Based Signature Keys). XMSS^MT stays under the key type XMSS and HSS under LMS; every row name begins with its key type.

Every row is level 1: SP 800-208 states no NIST PQC category for any set (§3.1). The multi-tree rows carry no NSA: the CNSA 2.0 FAQ does not allow HSS or XMSS^MT. LMS-SHA256-M24-H10-W4 carries no ENISA, although the SHA-256/256 row does: ECCG ACM v2.0 lists LMS without a parameter restriction, but its Note 46 agrees a hash-based scheme only where the underlying hash function is agreed, and its agreed hash functions do not include SHA-256/192. Not offered, because creating the key — or, for XMSS^MT 40/4, producing its first signature — does not fit the synchronous request budget: XMSS-SHA2_16_256 (key generation measured at 213 s against the SDK's 30 s read timeout), XMSS-SHA2_20_256 (key generation did not finish), XMSSMT-SHA2_40/4_256 (first signature ~21.5 s) and LMS-SHA256-M32-H15-W4 (key generation 24 s).

The ML-DSA signature sizes are those of FIPS 204 Table 2: 2,420 / 3,309 / 4,627 bytes for ML-DSA-44 / 65 / 87.

Classical Asymmetric

Symmetric AEAD (Authenticated Encryption)

MAC/PRF (Message Authentication)

Regional/National Standards (Complete Coverage)

ANKASecure supports national cryptographic standards from 5 jurisdictions, covering the algorithm requirements of local regulations in regulated industries. Most regional algorithms are also ISO/IEC standardised; the per-algorithm Standards columns below say which.

Total Regional/National Algorithms: 18 across 5 jurisdictions (the rows of the five tables below)

🇨🇳 Chinese Standards (GMT - State Cryptography Administration)

Regulatory Context: Cryptography Law of the People's Republic of China (2020) - Mandatory for critical information infrastructure

Market: China (1.4B people, $19T GDP)

Policy Template: CHINA_GMT_COMPLIANT

Use Cases:

• Financial services (payment systems, banks)
• Government systems (eGovernment, national security)
• Critical infrastructure (telecommunications, energy)
• Enterprise applications operating in China

🇯🇵 Japanese Standards (CRYPTREC)

Regulatory Context: e-Government Recommended Ciphers List (May 2024 revision) - Recommended for government procurement

Market: Japan (125M people, $4.9T GDP)

Policy Template: JAPAN_CRYPTREC

Historical Context: Camellia was developed by NTT and Mitsubishi Electric (2000), adopted as:

• ISO/IEC 18033-3 international standard (2005)
• NESSIE European project finalist (2003) — a historical evaluation outcome, not a standards attribution the platform records
• CRYPTREC e-Government cipher (2003-present)

Use Cases:

• Government systems (e-Government, national security)
• Financial institutions (banks, securities)
• Critical infrastructure
• EU/Japan interoperability (via ISO/IEC 18033-3)

🇰🇷 South Korean Standards (KISA)

Regulatory Context: Korea Information Security Agency (KISA) - Mandatory for government systems under KCMVP certification

Market: South Korea (51M people, $1.7T GDP)

Policy Template: KOREA_KCMVP

Historical Context:

• SEED (1998): First Korean national cipher, developed by KISA
• ARIA (2004): Second generation cipher, developed by multiple Korean universities

SEED is an ISO/IEC 18033-3 cipher. ARIA is not: ISO/IEC 18033-3:2010 standardises AES, Camellia and SEED as its 128-bit block ciphers, and its 2021 amendment adds SM4 only, so the catalogue carries no ISO attribution on ARIA.

Korean post-quantum (KpqC). The catalogue also offers SMAUG-T-MODE1/3/5, the KEM Korea's post-quantum competition selected (final selection announced in January 2025; Korean Standard work in progress), listed with the post-quantum KEMs above rather than here: no published standard names it, carries no KISA attribution and is not counted among the 18 regional algorithms. Because KOREA_KCMVP mandates the KISA and ISO attributions, that template does not admit it; a template that mandates no standard does.

Use Cases:

• Government systems (mandatory under KCMVP)
• 5G telecommunications infrastructure
• Financial services (banks, payment processors)
• Critical infrastructure

🇷🇺 Russian Standards (GOST)

Regulatory Context: Federal Law 149-FZ - Mandatory for state information systems and critical infrastructure

Market: Russia + CIS countries (300M people, $2T GDP)

Policy Template: GOST_COMPLIANT

Historical Context:

• GOST-EC (2012): Elliptic curve digital signature standard
• Streebog (2012): Hash function (also known as GOST R 34.11-2012)
• Grasshopper (2015): Block cipher GOST R 34.12-2015 (not currently supported)

Use Cases:

• Government systems (mandatory for state agencies)
• Banking and financial services
• Energy sector (critical infrastructure)
• Telecommunications
• CIS region interoperability

🌐 Global Internet Standards (IETF)

Regulatory Context: Internet Engineering Task Force RFCs - Global protocol standards for TLS, VPN, SSH

Market: Global (5B+ internet users)

Policy Template: IETF_RFC

Historical Context:

• Developed by Daniel J. Bernstein (djb)
• Adopted by IETF (2015) as RFC 7539, updated to RFC 8439 (2018)
• Used in TLS 1.3, WireGuard VPN, OpenSSH

Technical Advantages:

• Performance on ARM: 2-3x faster than AES-GCM on mobile/IoT devices (no AES-NI instruction set)
• Constant-time: Resistant to cache-timing attacks (better than table-based AES)
• Software-friendly: Pure software implementation without hardware acceleration

Use Cases:

• Mobile applications (iOS, Android)
• IoT and embedded devices
• VPN services (WireGuard protocol)
• TLS 1.3 connections
• SSH protocol (OpenSSH 6.5+)

🇪🇺 European Adopted Standards

Camellia (Japanese origin, European adoption):

• Selected by the NESSIE evaluation project (New European Schemes for Signatures, Integrity, and Encryption, 2000-2003) — historical provenance only; NESSIE is not a standards body and the platform does not carry it as an attribution
• Adopted by European Commission for eGovernment interoperability
• ISO/IEC 18033-3 international standard (global recognition)

Policy Templates: JAPAN_CRYPTREC, GLOBAL_ISO_COMPLIANT (not EU_COMPLIANT — Camellia carries no ENISA attribution)

Regional Standards Summary

Total Coverage:

• 5 Jurisdictions with dedicated national cipher support
• 18 Regional/National Algorithms total
• ISO/IEC attribution on 11 of these algorithms (the catalogue carries no ISO on ARIA or ChaCha20-Poly1305)
• Market Coverage: 2B+ people, $30T+ GDP

Standards Alignment:

Note: ARIA (six profiles) and ChaCha20-Poly1305 carry no ISO/IEC attribution; every other regional algorithm does.

Total: 89 Algorithms (23 PQC KEM + 16 PQC Signatures + 17 Classical Asymmetric + 19 Symmetric AEAD + 14 MAC/PRF)

Algorithm Discovery API

Purpose: Dynamic discovery of platform capabilities with policy-aware filtering.

Technical Capabilities:

• Algorithm Metadata (per algorithm):
  • kty: Key type — one of the twenty-one published tokens; COMPOSITE for every hybrid pairing
  • compositeMode: COMPOSITE_KEM_COMBINE | COMPOSITE_SIGNATURE (composite entries only; absent for simple algorithms)
  • alg: Specific algorithm identifier — for a composite, the exact pairing (X25519+ML-KEM-768)
  • keyOps: Supported operations
  • status: RECOMMENDED | LEGACY | EXPERIMENTAL
  • sunsetDate: Algorithm deprecation date (if applicable)
  • advisory: Migration guidance
  • securityLevel: NIST security assurance level (1-5)
  • standards: Ratifying bodies (NIST, ETSI, ANSSI, BSI, NSA, ISO, etc.)
  • category: CLASSICAL | POST_QUANTUM | HYBRID

Business Value:

• Standards Compliance: Filter algorithms by regulatory body (ANSSI for France, BSI for Germany)
• Security Assurance: Choose algorithms by NIST security level
• Sunset Planning: Identify algorithms approaching deprecation
• Migration Planning: Discover replacement algorithms with advisory guidance

Use Cases:

• Query: "Show me all NIST-approved post-quantum algorithms"
• Query: "Which algorithms are marked LEGACY?"
• Query: "What's the recommended replacement for RSA-2048?"
• Query: "Show algorithms approved by ANSSI for French government"

Standards & Regulatory Bodies

ANKASecure algorithms are aligned with 14 international and national cryptographic standards, enabling global regulatory compliance and market access.

For complete regulatory alignment details, guidance documents, and policy template mappings, see: Standards & Regulatory Alignment

Global Standards

NIST (United States)

Aligned with the U.S. National Institute of Standards and Technology Post-Quantum Cryptography standardization process, including ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205).

ISO/IEC JTC 1 (Global)

Compatible with ISO/IEC international standardization efforts on quantum-resistant cryptography, including digital signatures and key establishment. 11 of the 18 regional algorithms carry an ISO/IEC attribution.

IETF (Internet Protocols)

Aligned with Internet Engineering Task Force RFCs for TLS, VPN, SSH modernization (ChaCha20-Poly1305, ML-KEM, ML-DSA, XMSS and XMSS^MT, LMS and HSS).

European Standards

ENISA (European Union)

Consistent with the European Union Agency for Cybersecurity's PQC migration guidelines and recommended approaches for quantum-resistant key establishment and digital signatures.

BSI TR-02102 (Germany)

Aligned with the Bundesamt für Sicherheit in der Informationstechnik technical guideline TR-02102-1, which recommends ML-KEM-768/1024, ML-DSA-65/87, SLH-DSA at categories 3 and 5, FrodoKEM, XMSS and LMS and their multi-tree variants XMSS^MT and HSS for quantum-resilient cryptography. It recommends no Falcon parameter set and, among elliptic curves, only the Brainpool curves. BSI advises that Classic McEliece should no longer be used for new developments or in the planning of new cryptographic applications, so the catalogue attributes Classic McEliece to ISO/IEC 18033-2 alone and lists it as LEGACY; existing Classic McEliece keys keep every operation.

ANSSI RGS (France)

Compatible with the Référentiel Général de Sécurité (RGS) and ANSSI guidance on post-quantum cryptography (ANSSI-PG-083 and ANSSI's PQC transition position), including ML-KEM-768/1024, ML-DSA-65/87, FALCON-1024 and hybrid migration strategies.

ETSI (EU Telecommunications)

Aligned with ETSI technical reports (TR 103 619, TS 103 744) and guidance on post-quantum transitions for TLS, PKI and secure communications, including HQC as diversified approach.

Asia-Pacific Standards

CRYPTREC (Japan)

e-Government Recommended Ciphers List alignment with ML-KEM, ML-DSA, Camellia (national cipher), XMSS, LMS.

GMT (China)

Consistency with State Cryptography Administration (Guó Mì) standards: SM2, SM4, SM3 algorithms.

KISA (South Korea)

Alignment with Korea Information Security Agency national cipher requirements: SEED (1998), ARIA (2004). SMAUG-T, from Korea's post-quantum competition (KpqC), is offered without a KISA attribution.

MySEAL 2.0 (Malaysia/ASEAN)

Consistent with Malaysian Cybersecurity Agency framework for Southeast Asia critical infrastructure.

Defense & Specialized Standards

NSA CNSA 2.0 (US Defense/Intelligence)

Aligned with National Security Agency Commercial National Security Algorithm Suite 2.0 - quantum-resistant suite for national security systems. The catalogue attributes NSA to exactly nine profiles: ML-KEM-1024, ML-DSA-87, XMSS-SHA2_10_256, LMS-SHA256-M32-H10-W4, LMS-SHA256-M24-H10-W4, AES-GCM-256, AES-CCM-256, HMAC-SHA384 and HMAC-SHA512. The multi-tree rows XMSSMT-SHA2_20/2_256 and LMS-HSS-L2-SHA256-M32-H10-W4 carry none, because the CNSA 2.0 FAQ does not allow HSS or XMSS^MT. CNSA 2.0 enumerates no MAC construction, so CMAC-AES-256 carries none; HMAC-SHA384/512 rest on SHA-384/512.

GOST (Russia + CIS)

Compatible with GOST R 34.10/34.11 cryptographic family for state information systems (Federal Law 149-FZ).

NCA-NCS (Saudi Arabia/GCC)

Aligned with National Cybersecurity Authority standards for critical infrastructure (classical algorithms: RSA, EC, AES).

Regional Policy Templates (NOT standards bodies)

NCSC (United Kingdom), CCN-CERT / ENS (Spain) and ACN (Italy) are national cyber authorities whose guidance ANKASecure ships as regional policy templates (NCSC_UK_PQC, CCN_CERT_ENS, ACN_ITALY_PQC). They are not members of the CryptoStandard vocabulary and are never carried as an algorithm standards attribution. Each template composes the real standards above — NCSC and ACN build on ENISA plus the NIST PQC selections; CCN-CERT / ENS adopts the ENISA and NIST PQC positioning for the Esquema Nacional de Seguridad.

Standards Summary

• Total Standards: 14 international and national regulatory authorities (the complete CryptoStandard vocabulary: NIST, ETSI, NSA, ISO, BSI, ANSSI, ENISA, IETF, KISA, CRYPTREC, GMT, MYSEAL, NCA_NCS, GOST)
• Geographic Coverage: Americas, Europe, Asia-Pacific, Middle East, CIS
• Market Coverage: $50+ trillion GDP, 4.5+ billion people
• Policy Templates: 29 pre-configured templates for instant compliance
• ISO/IEC attribution: 11 of the 18 regional algorithms

→ Complete standards alignment guide and policy configuration