Algorithm reference
Read every algorithm in full or narrow the page by name, concept, cipher type or historical status. Every entry includes an overview, internal mechanics, step-by-step explanation, security discussion and references.
Showing 30 of 30 algorithms and constructions.
No matching algorithms. Try clearing the filters.
Foundational and historical algorithms (12 sections)
Block cipherLegacy
Overview — what is it?
Blowfish was designed as a fast, royalty-free alternative to DES. It encrypts a 64-bit chunk of data under a secret key that can vary substantially in length. Its most important design feature is a 16-round Feistel network with key-dependent substitution tables: different keys effectively create different internal lookup tables.
How the algorithm works
A Blowfish block is split into two 32-bit halves. During each round, one half is combined with a round subkey, passed through a function F, and mixed into the other half with XOR. F splits its 32-bit input into four bytes, looks them up in four S-boxes, and combines the results using 32-bit modular addition and XOR. A final pair of key XORs finishes the block. Decryption follows the Feistel process with the round subkeys in reverse order. The large, expensive key setup is deliberate: it is economical when the same key encrypts many blocks, but not when a new key is required for each short message.
Step by step
- Initialize an 18-entry P-array and four 256-entry S-boxes from published hexadecimal digits of π.
- XOR the user key into the P-array, wrapping around shorter keys.
- Repeatedly encrypt a 64-bit zero block, replacing P-array and then S-box entries with the output; 521 block encryptions complete setup.
- Run the data through 16 Feistel rounds, using one P-array entry per round; complete the final XORs with the last two entries.
Security and use today
Blowfish has no practical general-purpose break of its full cipher under ordinary assumptions, but its 64-bit block size is a serious limitation when large volumes are encrypted under one key. Designers should prefer a well-supported 128-bit-block cipher or modern AEAD. This limitation is distinct from the bcrypt password-hashing construction, which uses an adapted, expensive Blowfish key setup and is not a bulk-data encryption mode.
Teaching point: Its key schedule shows that two ciphers with similar-looking Feistel rounds can behave very differently in practice. Compare its S-box setup with the fixed tables of DES and the key-dependent tables of Twofish.
Block cipherModern
Overview — what is it?
AES is the internationally prominent general-purpose block cipher selected by NIST from the Rijndael family. All AES variants transform a fixed 128-bit block; AES-128, AES-192, and AES-256 refer to key length, not the block length. AES is an encryption primitive. It does not by itself detect tampering or define how a file or long message should be encrypted.
How the algorithm works
AES arranges the 16 input bytes into a four-by-four array called the state. Each ordinary round applies four layers: SubBytes uses a nonlinear S-box, ShiftRows moves byte positions, MixColumns combines bytes within columns using finite-field arithmetic, and AddRoundKey XORs the state with a round key. The opening operation is an AddRoundKey; the final round omits MixColumns. A key schedule turns the original key into a different round key for each stage. This is a substitution–permutation network (SPN), not a Feistel cipher.
Step by step
- Load 16 bytes of plaintext into the state and derive the round keys.
- XOR the initial round key into the state.
- For nine, eleven, or thirteen ordinary rounds, perform substitution, row shifting, column mixing, and round-key XOR.
- Execute a final round without MixColumns; output the 16 ciphertext bytes.
Security and use today
AES remains a standard modern cipher when implemented correctly. For new messages and network protocols, use it within a sound authenticated-encryption design such as AES-GCM, with unique nonces and verified tags. AES-ECB reveals repeated plaintext blocks and should not be used for ordinary data. The 2023 update to FIPS 197 revised presentation, not the underlying algorithm.
Teaching point: Show students how changing one state byte can spread to many bytes after several rounds. This is diffusion, whereas the S-box provides nonlinearity or confusion.
Block cipherLegacy
Overview — what is it?
Skipjack is a historical U.S. government cipher associated with the Clipper chip and the Escrowed Encryption Standard. Its history is inseparable from the controversy over key escrow: a mechanism by which designated parties could obtain information enabling decryption, subject to specified authorization procedures. Key escrow was a system policy and design feature, not a mathematical requirement of every use of the Skipjack cipher.
How the algorithm works
The cipher encrypts a 64-bit block using an 80-bit key. Its 32 rounds apply a specially structured, unbalanced Feistel-like process to four 16-bit words. The inner G permutation operates on 16-bit words using an 8-bit substitution table and key bytes. Rounds alternate between two update rules, commonly called Rule A and Rule B, in groups of eight. These variations move and combine the words differently so that data influences different parts of the state over time.
Step by step
- Break the 64-bit input into four 16-bit words.
- Use the key to drive the G permutation in successive rounds.
- Process eight rounds with Rule A, eight with Rule B, and repeat that A/B sequence.
- Reverse the rule schedule and key usage to decrypt.
Security and use today
An 80-bit key and 64-bit block do not meet the expectations for new general-purpose encryption. NIST withdrew FIPS 185 in 2015; Skipjack is not approved for applying new cryptographic protection in NIST’s block-cipher guidance. Its key-escrow controversy should be studied separately from its cipher design.
Teaching point: An excellent case study of how public policy, hardware design, classified algorithms, independent review, and trust in an encryption system interact.
Block cipherEstablished
Overview — what is it?
Serpent was one of the five finalists in the AES competition. Its designers favored a conservative security margin, using 32 rounds rather than attempting to minimize the number of rounds. It remains an instructive alternative to AES with a different engineering emphasis.
How the algorithm works
Serpent is a 128-bit substitution–permutation network. Each round combines the state with a 128-bit round key, applies one of eight small four-bit S-boxes to many parallel groups, and then spreads information using a linear transformation. The final round uses a different ending arrangement. A bit-sliced implementation performs S-box substitutions using Boolean operations on machine words rather than looking up individual bytes in tables. That design can also reduce some lookup-table timing hazards if implemented carefully.
Step by step
- Expand the supplied key into 33 round subkeys.
- XOR in a round key and apply the round’s designated S-box in parallel.
- Mix bits across the 128-bit state using the linear transformation; repeat for 32 rounds.
- Apply the last subkey and reverse the transformations in the appropriate order for decryption.
Security and use today
There is no widely accepted practical break of full-round Serpent. Its main limitations are interoperability and implementation availability rather than its 128-bit block or supported key sizes. Being an AES finalist does not make it a NIST-approved AES variant.
Teaching point: Teaches the tradeoff between throughput and conservative round count, and gives a natural comparison with the faster, standardized AES design.
Block cipherResearch
Overview — what is it?
SHARK is an important research predecessor to the style of wide-trail cipher design later associated with Rijndael/AES. It was designed to obtain strong diffusion in a small number of rounds, at the cost of more work in each round. Its name is simply the name of a cipher—not an encryption mode or family standard.
How the algorithm works
SHARK transforms a 64-bit block as eight bytes. Each main round combines the block with key material, substitutes each byte using an invertible 8-bit S-box, and mixes the resulting bytes with a linear diffusion layer based on a maximum-distance-separable (MDS) code over GF(2^8). The purpose of the MDS layer is to make changes in a few input bytes affect many output bytes, limiting sparse difference patterns across rounds. The published cipher proposes six rounds and a 128-bit key. Its structure differs from a Feistel network because the whole block is transformed in each round.
Step by step
- Represent the 64-bit input as eight bytes.
- Mix in a round key and perform eight parallel nonlinear byte substitutions.
- Apply the MDS diffusion layer so changes spread across bytes.
- Repeat the round process and apply the design’s concluding key/diffusion transformations.
Security and use today
SHARK is historically instructive but is not a modern deployment default. Its 64-bit block size and narrow ecosystem are drawbacks even apart from the research history. Cryptographic design principles derived from SHARK are more influential than actual adoption of the cipher.
Teaching point: Illustrates the connection between error-correcting codes and cryptography: an MDS matrix used for diffusion is not correcting an encryption error; it is deliberately spreading differences.
Block cipherLegacy
Overview — what is it?
GOST 28147-89 is a Soviet-era block cipher often compared to DES because both use a Feistel design. This classic algorithm should not be confused with every modern cipher carrying a GOST designation. In newer Russian standards, the 64-bit cipher is closely related to Magma, while Kuznyechik is a different 128-bit-block cipher.
How the algorithm works
The cipher splits a 64-bit block into two 32-bit halves. In each of 32 rounds, it adds a 32-bit round subkey to one half modulo 2^32, replaces eight four-bit chunks using S-boxes, rotates the result left by 11 bits, and XORs that word into the other half before the halves exchange roles. The 256-bit key is divided into eight 32-bit words and reused according to a defined schedule. Historically, sets of S-box values varied across profiles; which substitution tables are used is part of interoperability and security analysis.
Step by step
- Split the input into two 32-bit halves and expand the 256-bit key into eight words.
- Add a round key modulo 2^32, then apply eight 4-to-4-bit S-box lookups.
- Rotate the result 11 bits left and XOR it into the opposite block half.
- Complete 32 rounds using the specified forward/reverse subkey order.
Security and use today
The classical 64-bit block size is inappropriate for large-volume new applications without restrictive usage limits. The exact S-box profile and variant matter; implementers cannot assume all GOST-labeled products are interoperable. A 256-bit key does not erase the birthday-bound issue caused by a 64-bit block.
Teaching point: Highlights why key length and block length measure different things, and why “addition modulo 2^32” is not the same operation as a bitwise XOR (addition modulo 2).
Stream cipherLegacy
Overview — what is it?
RC4 is a historical stream cipher, once deployed in protocols such as WEP and older TLS configurations. It does not encrypt fixed blocks; it generates a sequence of key-dependent bytes and XORs them with plaintext bytes. The same XOR operation decrypts a message when the receiver can reproduce the identical keystream.
How the algorithm works
RC4 maintains a permutation of 256 byte values in an array S and two indices, i and j. The key-scheduling algorithm (KSA) first initializes S and repeatedly swaps entries under the influence of key bytes. The pseudorandom generation algorithm (PRGA) then updates indices, swaps entries again, and outputs one selected byte at a time. Although the evolving permutation looks random, statistical biases in RC4’s early and later output can leak information across many encryptions. Early use in WEP also combined RC4 with weak IV/key handling and insufficient integrity.
Step by step
- Initialize S to 0, 1, 2, …, 255.
- Scramble S through the KSA using the provided key.
- Repeat the PRGA index-update, swap, and table-lookup operation to obtain each keystream byte.
- XOR each plaintext byte with one keystream byte; repeating the same keystream to decrypt recovers the plaintext.
Security and use today
RC4 is unsafe for new designs and is prohibited in TLS by RFC 7465. It has keystream biases, and stream keystream/key+nonce reuse is dangerous generally. A historic protocol’s use of RC4 is not evidence that it remains a suitable contemporary algorithm.
Teaching point: Compare RC4’s table-based generator with ChaCha20’s arithmetic-based generator. Both are stream ciphers; one is obsolete for protocol encryption, the other is widely used within a modern authenticated construction.
Stream cipherResearch
Overview — what is it?
FISH stands for Fibonacci Shrinking. It is a historical software-oriented stream cipher proposed by Siemens. The design combines lagged Fibonacci pseudorandom generators with a shrinking technique: one source influences which outputs from another source are accepted. FISH is valuable for understanding stream-cipher cryptanalysis, not for protecting modern data.
How the algorithm works
A lagged Fibonacci generator produces a new word by combining words from earlier positions in its own state; “lagged” refers to those fixed distances into the earlier sequence. The shrinking mechanism selectively discards candidate output words according to control information. Discarding values makes the visible stream less regular, but it does not automatically remove exploitable relationships between generator state and outputs. Ross Anderson showed that FISH could be attacked using known plaintext, which exposes the matching keystream when plaintext and ciphertext are XORed.
Step by step
- Fill the generator states with secret-derived initial values.
- Advance the lagged Fibonacci generators to create candidate words.
- Use control output to decide which candidate words become the emitted keystream.
- XOR the accepted keystream with message data; an analyst with known plaintext may recover corresponding keystream portions.
Security and use today
FISH should be treated as broken for contemporary security. The critical lesson is that a pseudorandom-looking stream and a large internal state do not establish cryptographic unpredictability. No practical security recommendation follows simply from adding a shrinking generator.
Teaching point: Gives students an early example of a stream cipher improved by a successor (PIKE) after cryptanalysis revealed a weakness. Compare how generator design differs from standardized cryptographic keystreams.
Stream cipherResearch
Overview — what is it?
PIKE is Ross Anderson’s redesign of FISH following a known-plaintext attack against FISH. It retains the general idea of word-oriented lagged Fibonacci generators but strengthens the way generator states are advanced. PIKE is an academic stream cipher and should not be treated as equivalent to a modern standardized stream cipher.
How the algorithm works
PIKE uses three word-based lagged Fibonacci generators. In a common description, their feedback distances are (55,24), (57,7), and (58,19), with 32-bit addition performed modulo 2^32. The carry information controls irregular clocking: when the carries agree the generators advance together; otherwise the two with matching carry decisions are advanced. The control is delayed so that the output decision and immediate clocking do not have an obvious direct relationship. The three outputs are combined using XOR into a keystream word. This construction aims to complicate the simple generator-state relationships that made FISH vulnerable.
Step by step
- Initialize three independent lagged Fibonacci state arrays from secret keying material.
- Calculate prospective generator words using their respective lagged-word sums modulo 2^32.
- Use delayed majority decisions from carry bits to control which generators advance.
- XOR the selected generator outputs to create a 32-bit keystream word; XOR this with data to encrypt or decrypt.
Security and use today
The design has not received anything like the widespread security analysis and deployment validation of ChaCha20. A statement that PIKE improved on FISH is a historical comparison, not a modern security certification. Particular implementations may differ in state initialization and should not be interchanged without a specification.
Teaching point: Useful for teaching carry bits, irregular clocking, lagged Fibonacci recurrence, and the difference between increasing attack difficulty and demonstrating contemporary security.
Block cipherLegacy
Overview — what is it?
DES, the Data Encryption Standard, is foundational for understanding practical block-cipher engineering. It was published as FIPS 46 in 1977 after a U.S. standards process. It is a 64-bit-block Feistel cipher with a 56-bit effective cryptographic key. The frequently mentioned 64-bit key representation includes eight parity bits; those are not eight additional secret key bits.
How the algorithm works
DES splits the 64-bit plaintext into two 32-bit halves after an initial permutation. Its 16 Feistel rounds expand one 32-bit half to 48 bits, XOR it with a 48-bit round key, pass the result through eight S-boxes mapping 6 bits to 4 bits, permute the resulting 32 bits, and XOR that into the other half. The key schedule selects and rotates portions of the 56 effective key bits to produce 16 distinct round keys. A final permutation reverses the opening arrangement. Encryption and decryption share the network, reversing the round-key order.
Step by step
- Place the bits through the initial permutation, then split the result in half.
- Derive sixteen 48-bit round subkeys from the 56 cryptographic key bits.
- For each round: expand, XOR round key, substitute via S-boxes, permute, XOR into the other half, and swap.
- Recombine halves and apply the final permutation.
Security and use today
DES is not secure against exhaustive key search with modern resources; 56 bits is far too small. NIST withdrew DES in 2005. The S-boxes and Feistel concept remain educationally significant, but learning DES must not be mistaken for choosing DES in current deployments.
Teaching point: An excellent step-by-step teaching cipher because its E expansion, S-boxes, P permutation, and key schedule can be examined individually.
Block cipherLegacy
Overview — what is it?
FEAL means Fast Data Encipherment Algorithm. It was built to be fast on processors for which DES’s bit-level permutations were relatively costly. FEAL-4 uses four rounds, FEAL-8 uses eight, and FEAL-N permits larger round counts. FEAL is particularly important historically because its weaknesses helped make differential and linear cryptanalysis major tools of modern cipher evaluation.
How the algorithm works
FEAL-N uses a Feistel-based 64-bit block construction with initial/final mixing and key whitening. Its internal operations are byte-oriented, relying mainly on XOR, addition modulo 256, and a two-bit left rotation. The key nonlinear ingredients can be described as S₀(x,y) = ROTL₂((x+y) mod 256) and S₁(x,y) = ROTL₂((x+y+1) mod 256). The round function combines bytes through these operations instead of relying on large substitution tables. That software simplicity made the design attractive; unfortunately, patterns across too few rounds can be followed by differential attacks.
Step by step
- Split the 64-bit data block into two 32-bit sides and derive whitening and round subkeys.
- Within the round function, combine 8-bit pieces by XOR and 8-bit modular addition.
- Rotate intermediate 8-bit sums left by two positions, then mix the computed 32-bit output into the other half.
- Repeat according to the FEAL variant and apply final mixing/whitening.
Security and use today
FEAL-4 and FEAL-8 were successfully attacked; FEAL’s family is not appropriate for modern protection. Increasing the round count may raise attack costs but should not be read as a blanket modern endorsement. FEAL-NX also changes the keying arrangements, so specifications must name the precise variant.
Teaching point: The classic lesson is that “simple, fast, and more rounds than a toy cipher” is not a substitute for public cryptanalysis. FEAL is ideal for showing how predictable input differences can survive several rounds.
Block cipherEstablished
Overview — what is it?
Camellia is a modern Japanese-designed 128-bit-block cipher with key sizes matching AES. It is structurally different from AES: Camellia uses a Feistel network and special mixing transformations. Its design offers a useful reminder that multiple strong block ciphers can have very different internal structures.
How the algorithm works
For a 128-bit key, Camellia uses 18 Feistel rounds; the 192- and 256-bit-key variants use 24. The round function applies 8-bit S-box transformations followed by byte mixing. At six-round intervals, special FL and inverse-FL functions add nonlinear Boolean mixing, and key whitening applies subkeys before and after the Feistel rounds. The FL layer is not an additional ordinary Feistel round—it is a separate transformation inserted between groups of six rounds. Decryption is implemented by applying the corresponding inverse/reversed sequence.
Step by step
- Expand the user key into whitening, Feistel-round, and FL-layer subkeys.
- Apply initial key whitening and split the 128-bit block into two 64-bit halves.
- Run six Feistel rounds, then insert paired FL and FLINV transformations; repeat by the key-length schedule.
- Finish the last rounds and output whitening; reverse for decryption.
Security and use today
Camellia has received extensive analysis and is a credible established block cipher. As with AES, a suitable mode and authentication are needed for actual messages; Camellia by itself does not include an authentication tag. It is not the same algorithm as AES even though the key and block sizes coincide.
Teaching point: A concise comparison: AES is an SPN with 10/12/14 rounds, Camellia is a Feistel cipher with 18/24 rounds and special FL layers.
Further algorithms and authenticated constructions (18 sections)
Block cipherEstablished
Overview — what is it?
Twofish was an AES finalist built by a team including Bruce Schneier. It can be considered a design descendant of Blowfish in its emphasis on key-dependent S-boxes and careful key scheduling, but it expands the block length to 128 bits, addressing an important limitation of Blowfish.
How the algorithm works
It is a 16-round Feistel-related block cipher with four key-dependent 8×8 S-boxes. The F function employs an MDS matrix over a finite field, a pseudo-Hadamard transform, modular addition, and bit rotations. Whitening XORs key material with the input and output. Its flexible implementation strategy allows tradeoffs among memory, key setup time, and encryption throughput.
Step by step
- Derive round keys and key-dependent S-box material.
- XOR whitening subkeys into four 32-bit input words.
- Perform 16 rounds involving key-dependent substitution, MDS mixing, pseudo-Hadamard steps, rotations, and XORs.
- Apply output whitening and collect the 128-bit ciphertext.
Security and use today
Full-round Twofish remains a serious analyzed cipher; however, it is not itself AES and is less universally supported. Use a vetted library and an appropriate authenticated mode when interoperability permits. Do not equate an AES finalist with a NIST-approved AES algorithm.
Teaching point: Contrast Blowfish’s 64-bit block and costly setup with Twofish’s 128-bit block and more flexible performance options.
Block cipherLegacy
Overview — what is it?
Triple DES was a transitional way to extend the lifetime of the DES ecosystem without replacing every DES-based device. Rather than inventing an entirely new round function, it executes DES three times, usually using an encrypt–decrypt–encrypt (EDE) construction.
How the algorithm works
With three independent key components, encryption computes E(K3, D(K2, E(K1, P))). The middle operation is DES decryption; it is included so that an all-equal key setting is compatible with single DES. Two-key variants reuse K1 as K3. Key-size labels such as 168 bits refer to the nominal three 56-bit DES keys, not a 168-bit effective generic security level. Meet-in-the-middle attacks and the 64-bit block limit reduce the practical security margin.
Step by step
- Split the input into a 64-bit DES block.
- Encrypt with DES under K1.
- Decrypt that intermediate result under K2.
- Encrypt again under K3; reverse all steps to decrypt.
Security and use today
NIST withdrew SP 800-67 effective January 1, 2024. Applying new TDEA protection is disallowed under NIST transition guidance, while some processing of already-protected data remains allowable. The birthday limits of 64-bit blocks also constrain use independently of the nominal key size.
Teaching point: This is the clearest demonstration that repeating an old cipher can extend a system’s lifetime but cannot fix every property of the underlying block design.
Block cipherLegacy
Overview — what is it?
IDEA (International Data Encryption Algorithm) is a historically important cipher used in earlier versions of PGP. It was designed as a stronger general-purpose alternative to DES and deliberately combines arithmetic operations drawn from different algebraic structures.
How the algorithm works
IDEA splits a 64-bit block into four 16-bit words. Its rounds combine XOR, addition modulo 2^16, and multiplication modulo 2^16+1 (with a defined representation for zero). The different algebraic structures complicate the formation of simple linear patterns across rounds. Eight full rounds are followed by a final output transformation, often called a half-round. The key schedule rotates material from the 128-bit key to supply many 16-bit subkeys.
Step by step
- Divide a 64-bit block into four 16-bit words.
- Combine the words and round subkeys using XOR and two distinct modular arithmetic operations.
- Exchange and mix intermediate words through eight rounds.
- Apply the last output transformation.
Security and use today
IDEA is not the default for new systems because it has a 64-bit block size and limited modern protocol support. Its historical patents have expired. Its algebraic construction remains a useful contrast with S-box-heavy designs.
Teaching point: An elegant example of a cipher relying on the interplay of modular multiplication, modular addition, and XOR rather than a Feistel network.
Block cipherLegacy
Overview — what is it?
CAST-128 is a Feistel block cipher used in some PGP implementations and other older protocols. CAST5 is another common name for this design. It illustrates a distinctive approach: alternating among different round functions rather than repeating exactly the same one every round.
How the algorithm works
A 64-bit plaintext block is divided into 32-bit halves. Each round uses both a 32-bit masking subkey and a 5-bit rotation subkey. Three round types combine modular addition, subtraction, XOR, fixed S-box lookups, and circular rotations in different orders. Keys up to 80 bits use 12 rounds; longer keys use 16. The key schedule produces the round-specific masks and rotations.
Step by step
- Expand the user key into masking and rotation subkeys.
- Split the block into two 32-bit halves.
- Alternate the three prescribed F-function types across 12 or 16 Feistel rounds.
- Swap and rejoin the halves; invert with the key order reversed.
Security and use today
CAST-128 is primarily relevant for compatibility and historical study. Its 64-bit blocks and possible short keys make it a poor new general-purpose default, despite a thoughtful design.
Teaching point: Compare CAST-128’s three round types to Blowfish’s single round-function pattern and the simple but weak FEAL round function.
Block cipherLegacy
Overview — what is it?
RC5 is a parameterized cipher: the designer or protocol specifies the word size, number of rounds, and key length. The often-cited RC5-32/12/16 version uses 32-bit words, a 64-bit block, 12 rounds, and a 16-byte key.
How the algorithm works
RC5 divides a block into two machine words, A and B, and repeatedly uses XOR, addition modulo 2^w, and data-dependent circular rotations. The unusual feature is that the amount of rotation depends on data from the other half, rather than being fixed in advance. The key schedule mixes a byte key into an expanded sequence of word subkeys using constants derived from mathematical numbers.
Step by step
- Select word length, round count, and key length as explicit parameters.
- Expand the key into round-dependent subkeys.
- Add initial subkeys to A and B; repeatedly XOR, rotate by an amount taken from the other word, and add subkeys.
- Reverse the round operations for decryption.
Security and use today
It is impossible to assess a generic “RC5” deployment without its full parameter set. Short rounds, 64-bit-block variants, and unsupported modes create avoidable risks; RC5 is largely a legacy or teaching algorithm.
Teaching point: Excellent for demonstrating data-dependent rotations and why a cipher family’s parameter choices are part of its security definition.
Block cipherEstablished
Overview — what is it?
RC6 is a successor to RC5 and was one of the five AES finalists. It retains data-dependent rotations and modular operations but works on four 32-bit words to produce a 128-bit block.
How the algorithm works
Each of 20 main rounds mixes four 32-bit state words with arithmetic and XOR. Multiplication of word values supplies rotation amounts, making the flow of data-dependent rotations more complex than in RC5. Pre-whitening and post-whitening introduce additional subkeys. RC6 was designed to be efficient on processors with fast integer arithmetic.
Step by step
- Expand a 128-, 192-, or 256-bit key into round subkeys.
- Load four 32-bit state words and add the opening subkeys.
- Perform 20 rounds of multiplication-assisted rotation, XOR, modular arithmetic and word rearrangement.
- Apply final subkeys and emit the encrypted block.
Security and use today
RC6 is not the selected AES standard, and modern support is narrower. It remains educationally valuable and well studied, but should only be deployed as part of a maintained, evaluated system.
Teaching point: Compare RC6’s integer multiplication and rotation strategy against AES’s byte-oriented substitution and finite-field diffusion.
Block cipherLegacy
Overview — what is it?
The Tiny Encryption Algorithm (TEA) and its follow-on XTEA are intentionally compact ciphers based on simple integer arithmetic. They were attractive for constrained environments because the implementation can be very short, without large lookup tables.
How the algorithm works
TEA encrypts two 32-bit halves using a 128-bit key, modular addition, XOR, and fixed shifts. A running sum based on the golden-ratio-related constant 0x9E3779B9 changes the subkey mixing each cycle. Its standard form has 32 cycles, each updating both halves, which is commonly counted as 64 Feistel-style half-rounds. XTEA rearranges the key selection and mixing to address weaknesses of the original. They are not interchangeable even though both use a 64-bit block.
Step by step
- Split the plaintext into two 32-bit words.
- Iteratively add the round constant to a running sum.
- Mix the words with the key, shifts, additions and XORs.
- Complete the prescribed cycles; decryption subtracts and reverses the operations.
Security and use today
TEA has known equivalent-key and related-key weaknesses; XTEA remedies some but not every concern. Both are affected by small 64-bit blocks and are uncommon choices for new data protection.
Teaching point: Demonstrates that a tiny implementation is not automatically a secure or suitable modern implementation.
Stream cipherModern
Overview — what is it?
ChaCha20 is a modern stream cipher that produces pseudorandom bytes from a key, nonce, and counter. It is often chosen where high-performance software encryption is important. Unlike a block cipher, its generated keystream is XORed directly with the message. For authenticated messages, it is normally used as ChaCha20-Poly1305.
How the algorithm works
The IETF form uses a 256-bit secret key, a 96-bit nonce, and a 32-bit counter. These initialize a 4×4 matrix of sixteen 32-bit words. ChaCha20 performs twenty rounds built from “quarter-round” operations combining addition modulo 2^32, XOR, and fixed rotations. Groups of four words are mixed first along columns and then diagonals. After the rounds, the initial state is added back to the transformed state to emit 64 bytes of keystream.
Step by step
- Choose a secret key and a nonce that will not repeat with that key.
- Initialize sixteen 32-bit state words with constants, key, counter and nonce.
- Run 10 column/diagonal double-rounds of add–rotate–XOR mixing.
- Generate 64 keystream bytes, XOR them with data, increment the counter for the next block.
Security and use today
ChaCha20 alone provides confidentiality, not an integrity tag. ChaCha20-Poly1305 adds authenticated encryption; its nonce must remain unique for each key. Counter exhaustion and implementation-level key/nonce management still matter.
Teaching point: This is the main modern stream-cipher contrast to RC4 and the historical FISH/PIKE designs.
Stream cipherEstablished
Overview — what is it?
Salsa20 helped establish arithmetic, rotation and XOR (“ARX”) as a powerful approach to efficient software stream ciphers. ChaCha20 is closely related but changes the quarter-round schedule and rotation values.
How the algorithm works
Salsa20 arranges constants, key words, nonce and counter in a 4×4 state matrix of 32-bit words. A 20-round core repeatedly applies quarter-round transformations to rows and columns. The transformed state is combined with the original input to produce a 64-byte keystream block. As with any stream cipher, encrypting means XORing this stream with the plaintext; decryption repeats the same XOR.
Step by step
- Initialize a 16-word matrix with key, nonce, counter and constants.
- Apply alternating column and row rounds using add–rotate–XOR operations.
- Add the starting state back into the processed state to form 64 keystream bytes.
- XOR with plaintext and increment the counter.
Security and use today
Salsa20 has had substantial research attention, but for new interoperable Internet protocols ChaCha20-Poly1305 is more commonly available. A repeated (key, nonce) pair is dangerous, and Salsa20 by itself does not authenticate messages.
Teaching point: Lets learners see how small changes to a round schedule create a new cipher while preserving the overall ARX design philosophy.
Block cipherEstablished
Overview — what is it?
ARIA is a South Korean standard block cipher. Its interface resembles AES because it uses 128-bit blocks and the familiar three key lengths, but its internal substitution and diffusion strategy is independently designed.
How the algorithm works
ARIA uses a substitution–permutation network with alternating odd and even substitution layers. Each round adds a subkey, applies S-box substitutions and mixes state bytes through a diffusion layer; the last round is modified. The number of rounds is 12, 14 or 16 according to whether the key has 128, 192 or 256 bits. The key schedule derives round subkeys from the original key using a small internal Feistel construction and rotations.
Step by step
- Split the input into 16 bytes and expand the encryption key.
- XOR a round key and apply the specified odd or even substitution layer.
- Diffuse byte changes across the state and repeat for the scheduled rounds.
- Apply the final substituted/keyed output transformation.
Security and use today
ARIA is a credible standard option where its ecosystem supports it. Its availability and implementation quality—not only its mathematical parameters—determine whether it is suitable for a particular system.
Teaching point: Compare ARIA and AES: identical external block/key sizes do not imply identical S-boxes, key schedules, round counts or certification status.
Block cipherEstablished
Overview — what is it?
SEED is a South Korean block cipher designed for use in government and commercial systems. It has a 128-bit block and a 128-bit key, making it structurally and operationally different from older 64-bit ciphers.
How the algorithm works
SEED uses a 16-round Feistel network. The 128-bit plaintext divides into two 64-bit halves, and the F function mixes the active half with 64-bit round subkeys. Within that function, 32-bit values are combined using XOR, modular addition, and an S-box-based transform G. Two related 8×8 S-boxes and carefully selected byte mixing provide nonlinearity and diffusion. Each round changes one block half in terms of the other.
Step by step
- Expand the 128-bit master key into sixteen 64-bit round subkeys.
- Split a 128-bit plaintext into two 64-bit halves.
- Run 16 Feistel rounds with nested G transformations using S-box substitution and modular arithmetic.
- Combine the halves into the output block.
Security and use today
SEED is a national-standard cipher, but use should depend on protocol support and a correctly designed encryption/authentication mode. Its standardization does not make every SEED-containing protocol secure automatically.
Teaching point: Distinguish SEED’s Feistel approach from the SPN structure in AES and ARIA.
Block cipherEstablished
Overview — what is it?
SM4 is a standardized Chinese 128-bit block cipher used in several ShangMi cryptographic profiles. It has a 128-bit key, a 128-bit block, and 32 rounds. Its appearance in international protocol documentation does not mean that every deployment or certificate accepts it as interchangeable with AES.
How the algorithm works
SM4 divides the state into four 32-bit words. Each round uses a round key, combines word inputs with XOR, applies a nonlinear 8-bit S-box to each byte, and uses a linear transformation built from XORs and fixed rotations. The result updates the oldest state word, and words shift position for the next round. The key schedule has a similar transform with different constants and rotations.
Step by step
- Derive 32 round keys from the 128-bit master key.
- Represent the 128-bit input as four 32-bit words.
- For each of 32 rounds, XOR three words with the round key; apply byte substitution and linear rotation/XOR mixing.
- Shift/update the state words and reverse the final word order.
Security and use today
SM4 is a serious block cipher with defined profiles, including GCM/CCM-based TLS 1.3 suites. It is not a substitute for appropriate authentication, nonce control or implementation review.
Teaching point: Good for comparing classic Feistel designs with a four-word, round-updated state design.
Block cipherEstablished
Overview — what is it?
Kuznyechik (meaning “grasshopper” in Russian) is a 128-bit block cipher standardized alongside the 64-bit Magma design. Its larger block is a major structural difference from the older GOST 28147-89 cipher.
How the algorithm works
Kuznyechik is an SPN design using a 256-bit key. It repeatedly XORs the state with a round key, substitutes bytes through an 8-bit nonlinear mapping, and diffuses information with a linear transform over a finite field. The published specification describes nine full key–substitution–linear layers followed by the final key addition, using ten round keys in total. A Feistel-like procedure is used in key expansion, even though the data path is an SPN.
Step by step
- Expand the 256-bit secret into ten round keys.
- XOR the round key into a 128-bit state.
- Substitute all 16 bytes and apply the specified linear diffusion transform.
- Repeat for nine full layers, then XOR the tenth round key.
Security and use today
Its 128-bit block avoids the same generic high-volume collision ceiling as 64-bit ciphers, but selection still depends on standards requirements, trusted implementations and modes. Do not use “GOST” as if it identified a single unique cipher.
Teaching point: Contrasts historic GOST 28147-89 (Magma family) with a later Russian SPN design.
Block cipherResearch
Overview — what is it?
PRESENT is a lightweight block cipher built for devices with tiny hardware budgets. It prioritizes very low gate count, which can matter for simple tags, sensors and embedded equipment.
How the algorithm works
PRESENT is a 31-round SPN. Every round XORs a round key into a 64-bit state, applies sixteen parallel 4-bit S-boxes, and permutes individual bit positions to spread their influence. A final key addition follows the 31st round. The key register changes between rounds by rotations, S-box application and a round counter, with details depending on whether an 80- or 128-bit key is used.
Step by step
- Initialize the 64-bit state and the 80- or 128-bit key register.
- XOR a round key into the state.
- Apply 4-bit S-box substitutions, then permute individual state bits.
- Repeat for 31 rounds and XOR the concluding subkey.
Security and use today
Its small 64-bit blocks require care with the number of blocks protected under one key, and lightweight hardware has distinct side-channel concerns. It is best treated as a specialized or research/legacy choice rather than a universal replacement for AES or Ascon.
Teaching point: Highlights the engineering tradeoff among circuit area, energy, latency, and generic security margins.
AEAD constructionModern
Overview — what is it?
Ascon-AEAD128 is a lightweight authenticated-encryption algorithm standardized by NIST in SP 800-232 (August 2025). Unlike a bare block cipher such as AES, it produces both ciphertext and an authentication tag, protecting confidentiality and detecting tampering. It is especially relevant to constrained devices and embedded systems.
How the algorithm works
Ascon maintains an internal 320-bit state and repeatedly applies a nonlinear permutation to mix secret key material, nonce, associated data and message data. It follows a sponge-like pattern with initialization, processing of authenticated associated data, encryption of message bytes, and finalization to produce an authentication tag. The standardized Ascon-AEAD128 uses a 128-bit key, a 128-bit nonce and a 128-bit authentication tag. It is important not to confuse the final NIST standard’s exact specification with earlier competition versions.
Step by step
- Select a fresh nonce for the secret key and identify any metadata to authenticate without encrypting.
- Initialize the permutation state with key, nonce and algorithm parameters.
- Absorb associated data and encrypt plaintext while updating the state.
- Finalize and output a tag; on decryption, verify the tag before releasing plaintext.
Security and use today
Ascon-AEAD128 is a strong contemporary choice in the context of its defined implementation and use constraints, not an excuse to invent a bespoke protocol. Nonce rules, constant-time code, key handling and tag verification remain essential.
Teaching point: A key teaching distinction: authenticated encryption answers “was this modified?” as well as “is this secret?”; AES alone answers only the latter.
AEAD constructionModern
Overview — what is it?
AES-GCM is one of the most important ways AES is used in real systems. It is not a different AES block cipher: it is an authenticated-encryption mode that combines AES counter-mode encryption with a polynomial authentication function called GHASH.
How the algorithm works
For confidentiality, AES encrypts counter blocks to generate a keystream and XORs that stream with plaintext. For integrity and authenticity, GHASH incorporates ciphertext and optional additional authenticated data (AAD), producing a value combined with an AES-derived mask to form an authentication tag. AAD can be a packet header or record identifier: the receiver can verify it while leaving it readable. GCM security critically depends on never repeating a key-and-nonce pair, because repetition can destroy confidentiality and integrity guarantees.
Step by step
- Choose a key and unique nonce/IV.
- Use AES counter-mode processing to encrypt the message.
- Authenticate ciphertext lengths and any AAD through GHASH.
- Send ciphertext and tag; verify the tag before treating plaintext as authentic.
Security and use today
Nonce uniqueness, secure tag verification, appropriate message limits, and vetted APIs are mandatory. Neither “AES-256” nor “GCM” compensates for an implementation that reuses nonces or ignores a failed tag.
Teaching point: An essential bridge from studying internal cipher rounds to building an actual secure application.
AEAD constructionModern
Overview — what is it?
ChaCha20-Poly1305 is a complete authenticated-encryption construction. ChaCha20 hides the plaintext; Poly1305 authenticates the ciphertext and any associated data. It is widely used in secure network protocols and is especially convenient in software without dedicated AES acceleration.
How the algorithm works
For each message, ChaCha20 derives a one-time Poly1305 key from block counter zero, then encrypts the message starting at counter one. Poly1305 computes a message authentication code over a precise encoding of AAD, ciphertext, padding and lengths. The standard IETF construction uses a 256-bit encryption key, a 96-bit nonce and a 128-bit authentication tag. The tag is not an optional extra: decryption must validate it before treating the plaintext as trustworthy.
Step by step
- Assign a unique 96-bit nonce for the encryption key.
- Derive the one-time Poly1305 key from the ChaCha20 block function.
- Encrypt plaintext with ChaCha20 and authenticate AAD plus ciphertext.
- Transmit the tag; decrypt and accept only if tag verification succeeds.
Security and use today
Reusing the same key and nonce is dangerous. Developers should use a maintained AEAD library rather than implementing the primitives or message formatting by hand.
Teaching point: Gives a concrete comparison with AES-GCM: both are AEAD, but one is based on an ARX stream cipher and MAC, and the other on AES counter mode plus GHASH.
AEAD constructionModern
Overview — what is it?
AES-GCM-SIV is an authenticated-encryption construction intended to limit the damage of accidentally repeating a nonce. The “SIV” name refers to a synthetic initialization vector derived from the message and other inputs.
How the algorithm works
Unlike ordinary AES-GCM, AES-GCM-SIV derives message-specific material and processes the input to calculate an authentication value before completing encryption. This requires two passes when encrypting but gives a stronger failure mode under accidental nonce reuse. It uses AES and a polynomial hash function called POLYVAL. Both AES-128-GCM-SIV and AES-256-GCM-SIV are defined in RFC 8452.
Step by step
- Provide a key, nonce, associated data and plaintext.
- Derive per-message keys and compute a synthetic authentication value from the message.
- Use that result to drive AES counter-mode encryption.
- Verify the authentication result during decryption before accepting the message.
Security and use today
Nonce misuse resistance does not make intentional nonce reuse a good policy: repeated identical inputs may still reveal equality. Use unique or random nonces per the specification and a vetted library.
Teaching point: Illustrates how modern cryptographic engineering can change a system’s behavior when a common operational error occurs.