1
$\begingroup$

I am using micro-services to interact between various cryptographic technologies like HSMs, keystores, vaults, etc., that are written in different languages. Usually, each technology, or even vendor, is using different names of the cryptographic algorithms, and in some cases they are also case-sensitive.

For example, Java Security Standard Algorithm Names contains different algorithm names as JSON Object Signing and Encryption (JOSE).

Another thing is that the list of algorithms are expanding, especially with the adoption of quantum-safe cryptography.

In my case, it is important to have one consistent list of names of cryptographic algorithms that can be translated for each technology. Otherwise I am not able to interact between them as there will be conflicts in the names.

Is there any internationally recognized standard that lists cryptographic algorithm names or identifiers that can be consistently used programmatically and I can refer to? (is there something in NIST, or ISO?)

$\endgroup$
1
  • $\begingroup$ I am unsure if such a list exists, it will neither be universal [covering everything of practical interest] nor stable over time. This sounds like something you should be doing. Note that there may be naming conventions within ISO or NIST that go part of the way. Also, not my strength, but is HSM a "technology"? You may need to think about defining your terms $\endgroup$
    – kodlu
    Oct 29, 2022 at 13:25

1 Answer 1

2
$\begingroup$

Even if the names are specified in a standard, then they are often not used. See e.g. the RSA algorithm names in PKCS#1 v2.x or the cipher suites with OpenSSL specific names next to the ones in the RFC. There are also naming conventions in various programming languages. Basically, the answer is no.

Probably the closest you can come is the OID scheme that is used for more common algorithms. See for instance this page where the various SHA hash algorithms are listed by OID. Similarly, there are OID's for RSA as well. However, the OID registry is far from complete, and it may contain duplicates.

Note too that OID's are generally used within ASN.1 AlgorithmIdentifier, see the definition below:

AlgorithmIdentifier ::= SEQUENCE {
  algorithm       OBJECT IDENTIFIER,
  parameters      ANY DEFINED BY algorithm OPTIONAL
}

Here the OBJECT IDENTIFIER is where the OID is placed. Although many algorithms have NULL as parameters, others will have a set of configuration parameters. This is why there isn't a hash-specific RSA OID mentioned in the list shown before.

Note that the OID registry is hierarchical. So an organization such as NIST can use their own registry (e.g. the CSOR for the SHA-1 hash algorithms) to indicate a standardized algorithm.

Some libraries and frameworks such as Java JCA have an aliasing scheme where algorithms can be retrieved both by name and by OID. Many other cryptographic libraries only work with algorithms by name though. If libraries support OID's then they normally use the "dot notation" rather than the full notation (e.g. 1.2.840.113549.1.1.11 rather than the full OID {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-1(1) sha256WithRSAEncryption(11)}).

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.