Comparison of cryptography libraries

The tables below compare cryptography libraries that deal with cryptography algorithms and have api function calls to each of the supported features.

Cryptography libraries and their origin

Implementation Company Development Language Open Source Software License FIPS 140 validated[1] FIPS 140-2 mode Latest Update Origin
Bouncy Castle Legion of the Bouncy Castle java Yes MIT License No No July 27, 2014 Australia
cryptlib cryptlib C Yes Sleepycat License and commercial license No[lower-alpha 1] Yes December 17, 2012 NZ
Crypto++ Crypto++ C++ Yes Boost Software License 1.0, while the individual files in the compilation are all public domain Yes Yes November 20, 2015
Libgcrypt GnuPG community and g10code C Yes GNU LGPL v2.1+ Yes Yes September 8, 2015 Germany
Nettle C Yes GNU GPL v2, GNU LGPL v3 No No January 7, 2013 Sweden
NaCl C, C++ Yes Public Domain No No 2013
wolfCrypt wolfSSL, Inc. C Yes GPL v2 and commercial license Yes Yes December 5, 2014 USA
  1. ↑ The actual cryptlib is not FIPS 140 validated, although a validation exists for an adapted cryptlib as part of a third party, proprietary, commercial product.

Key operations

Key operations include key generation algorithms, key exchange agreements and public key cryptography standards.

Key generation and exchange

Implementation EDH DH DSA RSA NTRU DSS ECC
Bouncy Castle No Yes Yes Yes Yes No Yes
cryptlib Yes Yes Yes Yes No Yes Yes
Crypto++ Yes Yes Yes Yes No No Yes
Libgcrypt Yes[lower-alpha 1] Yes Yes Yes No Yes Yes
Nettle No No Yes Yes No No Yes
NaCl No No Yes No No No Yes
wolfCrypt Yes Yes Yes Yes Yes Yes Yes
  1. ↑ By using the lower level interface.

Public key cryptography standards

Implementation PKCS#1 PKCS#5 PKCS#8 PKCS#12 IEEE P1363 Abstract Syntax Notation One
Bouncy Castle Yes Yes No Yes Yes Yes
cryptlib Yes Yes Yes Yes No Yes
Crypto++ Yes No No No Yes Yes
Libgcrypt Yes Yes[lower-alpha 1] Yes[lower-alpha 1] Yes[lower-alpha 1] Yes[lower-alpha 1] Yes[lower-alpha 1]
Nettle Yes Yes No No No No
NaCl No No No No No No
wolfCrypt Yes Yes Yes Yes No Yes
  1. 1 2 3 4 5 These Public Key Cryptographic Standards (PKCS) are supported by accompanying libraries and tools, which are also part of the GnuPG framework, although not by the actual libgcrypt library.

Hash functions

Comparison of supported cryptographic hash functions. At the moment this section also includes ciphers that are used for producing a MAC tag for a message. Here hash functions are defined as taking an arbitrary length message and producing a fixed size output that is virtually impossible to use for recreating the original message.

Hash algorithms

Implementation MD2 MD4 MD5 SHA-1 SHA-2 SHA-3 RIPEMD-160 Tiger Whirlpool (cryptography) GOST (hash function) BLAKE2 (hash function)
Bouncy Castle Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
cryptlib Yes Yes Yes Yes Yes Yes Yes No Yes No No
Crypto++ Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
Libgcrypt Yes Yes Yes Yes Yes No Yes Yes Yes Yes No
Nettle Yes Yes Yes Yes Yes Yes Yes No No Yes No
NaCl No No No No Yes No No No No No No
wolfCrypt Yes Yes Yes Yes Yes Yes Yes No No No Yes

MAC algorithms

Implementation HMAC-MD5 HMAC-SHA1 HMAC-SHA2 Poly1305-AES
Bouncy Castle Yes Yes Yes Yes
cryptlib Yes Yes Yes No
Crypto++ Yes Yes Yes No
Libgcrypt Yes Yes Yes No
Nettle Yes Yes Yes Yes
NaCl No No Yes Yes
wolfCrypt Yes Yes Yes Yes

Block ciphers

Includes a table that compares implementations of block ciphers. Block ciphers are defined as being deterministic and operating on a set number of bits (termed a block) using a symmetric key. Each block cipher where applicable is broken up into the possible key size and what mode it can be run with, i.e. CBC, CTR.

Implementation AES-128 AES-192 AES-256 AES-CBC AES-ECB AES-GCM AES-CCM AES-CTR Camellia-128 Camellia-192 Camellia-256 Camellia GCM Camellia CBC 3DES CBC Blowfish
Bouncy Castle[2] Yes Yes Yes Yes No Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
cryptlib[3] Yes Yes Yes Yes Yes No No Yes No No No No No Yes Yes
Crypto++[4] Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
Libgcrypt Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
Nettle Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
NaCl Yes No No No No No No Yes No No No No No No No
wolfCrypt Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes No No Yes No

Stream ciphers

Table that compares implementations of the various stream ciphers. Stream ciphers are defined as using plain text digits that are combined with a pseudorandom cipher digit stream. Stream ciphers are typically faster than block ciphers and may have lower hardware complexity, but may be more susceptible to attacks.

Implementation RC4 HC-128 HC-256 Rabbit (cipher) Salsa20 ChaCha SEAL (cipher) Panama (cryptography) WAKE (cipher) Grain (cipher) VMPC ISAAC (cipher)
Bouncy Castle Yes Yes Yes No Yes Yes No No No Yes Yes Yes
Cryptlib Yes No No No No No No No No No No No
Crypto++ Yes No No No Yes No Yes Yes Yes No No No
Libgcrypt Yes No No No Yes No No No No No No No
Nettle Yes No No No Yes Yes No No No No No No
NaCl No No No No Yes No No No No No No No
wolfCrypt Yes Yes Yes Yes Yes Yes No No No No No No

Hardware-assisted support

Tables that compare the ability to utilize hardware enhanced cryptography. With using the assistance of specific hardware the library can achieve faster speeds than otherwise. This is done through hardware that has been designed in such a way as to handle cryptography better.

Implementation PKCS #11 device Intel AES-NI VIA PadLock STM32F2 Cavium NITROX Freescale CAU/mmCAU ARMv8-A Microchip PIC32MZ
cryptlib Yes No Yes No No No No No
Crypto++ No Yes No No No No No No
Libgcrypt No Yes Yes No No No No No
wolfCrypt No Yes No Yes Yes Yes No Yes

Code size

Implementation Source Code Size

(kSLOC = 1000 lines of source code)

 Code Lines to Comment Lines Ratio
Bouncy Castle 1359[5] 5.26[5]
cryptlib 241 2.66
Crypto++ 159[6] 10.1[6]
Libgcrypt 216[7] 6.27[7]
Nettle 111[8] 4.08[8]
NaCl 14 16.0
wolfCrypt 39 5.69

Portability

Implementation Supported Operating System Thread Safety
cryptlib AMX, BeOS, ChorusOS, DOS, eCOS, FreeRTOS/OpenRTOS, uItron, MVS, OS/2, Palm OS, QNX Neutrino, RTEMS, Tandem NonStop, ThreadX, uC/OS II, Unix (AIX, FreeBSD, HPUX, Linux, OS X, Solaris, etc.), VDK, VM/CMS, VxWorks, Win16, Win32, Win64, WinCE/PocketPC/etc, XMK Thread-safe
Crypto++ Unix (OpenBSD, Linux, OS X, etc.), Win32, Win64, Android, iOS, ARM
Libgcrypt All 32 bit and 64 bit Unix Systems, Win32, WinCE
wolfCrypt Win32/64, Linux, Mac OS X, Solaris, ThreadX, VxWorks, FreeBSD, NetBSD, OpenBSD, embedded Linux, WinCE, Haiku, OpenWRT, iPhone (iOS), Android, Nintendo Wii and Gamecube through DevKitPro, QNX, MontaVista, NonStop, TRON/ITRON/µITRON, Micrium's µC/OS, FreeRTOS, SafeRTOS, Freescale MQX, Nucleus, TinyOS, HP/UX Thread-safe

References

  1. ↑ Validated FIPS 140 Cryptographic Modules, NIST.gov, retrieved 2015-12-22
  2. ↑ Bouncy Castle Specifications, bouncycastle.org, retrieved 2015-11-28
  3. ↑ cryptlib Encryption Toolkit, Peter Gutmann, retrieved 2015-11-28
  4. ↑ Crypto++ Library, Cryptopp.com, retrieved 2015-11-28
  5. 1 2 Language Analysis of Bouncy Castle, OpenHub.net, retrieved 2015-12-23
  6. 1 2 Language Analysis of Crypto++, OpenHub.net, retrieved 2015-12-23
  7. 1 2 Language Analysis of Libgcrypt, OpenHub.net, retrieved 2015-12-23
  8. 1 2 Language Analysis of Nettle, OpenHub.net, retrieved 2015-12-23
This article is issued from Wikipedia - version of the Thursday, February 04, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.