Standardized names of cryptographic algorithms

Question

I am using micro-services to interact between various cryptographic technologies like HSMs, keystores, vaults, etc., that are written in different languages. Usually, each technology, or even vendor, is using different names of the cryptographic algorithms, and in some cases they are also case-sensitive.

For example, Java Security Standard Algorithm Names contains different algorithm names as JSON Object Signing and Encryption (JOSE).

Another thing is that the list of algorithms are expanding, especially with the adoption of quantum-safe cryptography.

In my case, it is important to have one consistent list of names of cryptographic algorithms that can be translated for each technology. Otherwise I am not able to interact between them as there will be conflicts in the names.

Is there any internationally recognized standard that lists cryptographic algorithm names or identifiers that can be consistently used programmatically and I can refer to? (is there something in NIST, or ISO?)

Answer 1

Even if the names are specified in a standard, then they are often not used. See e.g. the RSA algorithm names in PKCS#1 v2.x or the cipher suites with OpenSSL specific names next to the ones in the RFC. There are also naming conventions in various programming languages. Basically, the answer is no.

Probably the closest you can come is the OID scheme that is used for more common algorithms. See for instance this page where the various SHA hash algorithms are listed by OID. Similarly, there are OID's for RSA as well. However, the OID registry is far from complete, and it may contain duplicates.

Note too that OID's are generally used within ASN.1 AlgorithmIdentifier, see the definition below:

AlgorithmIdentifier ::= SEQUENCE {
  algorithm       OBJECT IDENTIFIER,
  parameters      ANY DEFINED BY algorithm OPTIONAL
}

Here the OBJECT IDENTIFIER is where the OID is placed. Although many algorithms have NULL as parameters, others will have a set of configuration parameters. This is why there isn't a hash-specific RSA OID mentioned in the list shown before.

Note that the OID registry is hierarchical. So an organization such as NIST can use their own registry (e.g. the CSOR for the SHA-1 hash algorithms) to indicate a standardized algorithm.

Some libraries and frameworks such as Java JCA have an aliasing scheme where algorithms can be retrieved both by name and by OID. Many other cryptographic libraries only work with algorithms by name though. If libraries support OID's then they normally use the "dot notation" rather than the full notation (e.g. 1.2.840.113549.1.1.11 rather than the full OID {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-1(1) sha256WithRSAEncryption(11)}).