Comparison of cryptography libraries

The tables below compare cryptography libraries that deal with cryptography algorithms and have api function calls to each of the supported features.

Cryptography libraries and their origin

Implementation Company Development Language Open Source Software License FIPS 140 validated[1] FIPS 140-2 mode Latest Update Origin
Botan Jack Lloyd C++ Yes Simplified BSD No No March 20, 2016 USA
Bouncy Castle Legion of the Bouncy Castle Java Yes MIT License No No July 27, 2014 Australia
cryptlib cryptlib C Yes Sleepycat License and commercial license No[lower-alpha 1] Yes March 25, 2016 NZ
Crypto++ Crypto++ C++ Yes Boost Software License 1.0, while the individual files in the compilation are all public domain Yes Yes November 20, 2015
Libgcrypt GnuPG community and g10code C Yes GNU LGPL v2.1+ Yes Yes April 15, 2016 Germany
libsodium Frank Denis C Yes ISC license No No April 4, 2016 France
NaCl C, C++ Yes Public Domain No No 2013
Nettle C Yes GNU GPL v2, GNU LGPL v3 No No January 7, 2013 Sweden
OpenSSL The OpenSSL Project C Yes Apache Licence 1.0 or 4-Clause BSD Licence No No March 1, 2016
wolfCrypt wolfSSL, Inc. C Yes GPL v2 and commercial license Yes Yes December 5, 2014 USA
  1. ↑ The actual cryptlib is not FIPS 140 validated, although a validation exists for an adapted cryptlib as part of a third party, proprietary, commercial product.

Key operations

Key operations include key generation algorithms, key exchange agreements and public key cryptography standards.

Key generation and exchange

Implementation EDH DH DSA RSA NTRU DSS ECC
Bouncy Castle No Yes Yes Yes Yes No Yes
cryptlib Yes Yes Yes Yes No Yes Yes
Crypto++ Yes Yes Yes Yes No No Yes
Libgcrypt Yes[lower-alpha 1] Yes Yes Yes No Yes Yes
Nettle No No Yes Yes No No Yes
NaCl No No Yes No No No Yes
libsodium No No Yes No No No Yes
wolfCrypt Yes Yes Yes Yes Yes Yes Yes
  1. ↑ By using the lower level interface.

Public key cryptography standards

Implementation PKCS#1 PKCS#5 PKCS#8 PKCS#12 IEEE P1363 ASN.1
Bouncy Castle Yes Yes No Yes Yes Yes
cryptlib Yes Yes Yes Yes No Yes
Crypto++ Yes No No No Yes Yes
Libgcrypt Yes Yes[lower-alpha 1] Yes[lower-alpha 1] Yes[lower-alpha 1] Yes[lower-alpha 1] Yes[lower-alpha 1]
Nettle Yes Yes No No No No
NaCl No No No No No No
wolfCrypt Yes Yes Yes Yes No Yes
  1. 1 2 3 4 5 These Public Key Cryptographic Standards (PKCS) are supported by accompanying libraries and tools, which are also part of the GnuPG framework, although not by the actual libgcrypt library.

Hash functions

Comparison of supported cryptographic hash functions. At the moment this section also includes ciphers that are used for producing a MAC tag for a message. Here hash functions are defined as taking an arbitrary length message and producing a fixed size output that is virtually impossible to use for recreating the original message.

Implementation MD5 SHA-1 SHA-2 SHA-3 RIPEMD-160 Tiger Whirlpool GOST BLAKE2
OpenSSL Yes Yes Yes Yes Yes Yes Yes Yes Yes
libsodium No No Yes No No No No No Yes
Botan Yes Yes Yes Yes Yes Yes Yes Yes Yes
Bouncy Castle Yes Yes Yes Yes Yes Yes Yes Yes Yes
cryptlib Yes Yes Yes Yes Yes No Yes No No
Crypto++ Yes Yes Yes Yes Yes Yes Yes Yes Yes
Libgcrypt Yes Yes Yes Yes Yes Yes Yes Yes No
Nettle Yes Yes Yes Yes Yes No No Yes No
NaCl No No Yes No No No No No No
wolfCrypt Yes Yes Yes Yes Yes No No No Yes

MAC algorithms

Comparison of implementations of message authentication code (MAC) algorithms. A MAC is a short piece of information used to authenticate a message—in other words, to confirm that the message came from the stated sender (its authenticity) and has not been changed in transit (its integrity).

Implementation HMAC-MD5 HMAC-SHA1 HMAC-SHA2 Poly1305-AES BLAKE2-MAC
Bouncy Castle Yes Yes Yes Yes Yes
cryptlib Yes Yes Yes No No
Crypto++ Yes Yes Yes No Yes
Libgcrypt Yes Yes Yes Yes No
Nettle Yes Yes Yes Yes No
NaCl No No Yes Yes No
wolfCrypt Yes Yes Yes Yes Yes
libsodium No No Yes Yes Yes
Botan (programming library) Yes Yes Yes Yes Yes

Block ciphers

Table compares implementations of block ciphers. Block ciphers are defined as being deterministic and operating on a set number of bits (termed a block) using a symmetric key. Each block cipher where applicable is broken up into the possible key size and what mode it can be run with, i.e. CBC, CTR.

Implementation AES-128 AES-192 AES-256 AES-CBC AES-ECB AES-GCM AES-CCM AES-CTR Camellia-128 Camellia-192 Camellia-256 Camellia GCM Camellia CBC 3DES CBC Blowfish
Bouncy Castle[2] Yes Yes Yes Yes No Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
cryptlib[3] Yes Yes Yes Yes Yes No No Yes No No No No No Yes Yes
Crypto++[4] Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
Libgcrypt Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
Nettle Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
NaCl Yes No No No No No No Yes No No No No No No No
libsodium Yes No Yes No No Yes No Yes No No No No No No No
wolfCrypt Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes No No Yes No

Stream ciphers

Table compares implementations of the various stream ciphers. Stream ciphers are defined as using plain text digits that are combined with a pseudorandom cipher digit stream. Stream ciphers are typically faster than block ciphers and may have lower hardware complexity, but may be more susceptible to attacks.

Implementation RC4 HC-128 HC-256 Rabbit Salsa20 ChaCha SEAL Panama WAKE Grain VMPC ISAAC
Bouncy Castle Yes Yes Yes No Yes Yes No No No Yes Yes Yes
cryptlib Yes No No No No No No No No No No No
Crypto++ Yes No No No Yes No Yes Yes Yes No No No
Libgcrypt Yes No No No Yes Yes No No No No No No
Nettle Yes No No No Yes Yes No No No No No No
NaCl No No No No Yes No No No No No No No
libsodium No No No No Yes Yes No No No No No No
wolfCrypt Yes Yes Yes Yes Yes Yes No No No No No No

Hardware-assisted support

Table compares the ability to utilize hardware enhanced cryptography. With using the assistance of specific hardware the library can achieve faster speeds than otherwise. This is done through hardware that has been designed in such a way as to handle cryptography better.

Implementation PKCS #11 device Intel AES-NI VIA PadLock STM32F2 Cavium NITROX Freescale CAU/mmCAU ARMv8-A Microchip PIC32MZ
cryptlib Yes No Yes No No No No No
libsodium No Yes No No No No No No
Crypto++ No Yes No No No No No No
Libgcrypt No Yes Yes No No No No No
wolfCrypt No Yes No Yes Yes Yes No Yes

Code size

Implementation Source Code Size

(kSLOC = 1000 lines of source code)

 Code Lines to Comment Lines Ratio
Bouncy Castle 1359[5] 5.26[5]
cryptlib 241 2.66
Crypto++ 159[6] 10.1[6]
Libgcrypt 216[7] 6.27[7]
Nettle 111[8] 4.08[8]
NaCl 14 16.0
wolfCrypt 39 5.69

Portability

Implementation Supported Operating System Thread safe
libsodium OS X, Linux, OpenBSD, NetBSD, FreeBSD, DragonflyBSD, Android, iOS, 32 and 64-bit Windows (Visual Studio, MinGW, C++ Builder), NativeClient, QNX, Javascript, AIX, Minix, Solaris Yes
cryptlib AMX, BeOS, ChorusOS, DOS, eCOS, FreeRTOS/OpenRTOS, uItron, MVS, OS/2, Palm OS, QNX Neutrino, RTEMS, Tandem NonStop, ThreadX, uC/OS II, Unix (AIX, FreeBSD, HPUX, Linux, OS X, Solaris, etc.), VDK, VM/CMS, VxWorks, Win16, Win32, Win64, WinCE/PocketPC/etc, XMK Yes
Crypto++ Unix (OpenBSD, Linux, OS X, etc.), Win32, Win64, Android, iOS, ARM
Libgcrypt All 32 bit and 64 bit Unix Systems, Win32, WinCE Yes[9]
wolfCrypt Win32/64, Linux, Mac OS X, Solaris, ThreadX, VxWorks, FreeBSD, NetBSD, OpenBSD, embedded Linux, WinCE, Haiku, OpenWRT, iPhone (iOS), Android, Nintendo Wii and Gamecube through DevKitPro, QNX, MontaVista, NonStop, TRON/ITRON/µITRON, Micrium's µC/OS, FreeRTOS, SafeRTOS, Freescale MQX, Nucleus, TinyOS, HP/UX Yes

References

  1. ↑ Validated FIPS 140 Cryptographic Modules, NIST.gov, retrieved 2015-12-22
  2. ↑ Bouncy Castle Specifications, bouncycastle.org, retrieved 2015-11-28
  3. ↑ cryptlib Encryption Toolkit, Peter Gutmann, retrieved 2015-11-28
  4. ↑ Crypto++ Library, Cryptopp.com, retrieved 2015-11-28
  5. 1 2 Language Analysis of Bouncy Castle, OpenHub.net, retrieved 2015-12-23
  6. 1 2 Language Analysis of Crypto++, OpenHub.net, retrieved 2015-12-23
  7. 1 2 Language Analysis of Libgcrypt, OpenHub.net, retrieved 2015-12-23
  8. 1 2 Language Analysis of Nettle, OpenHub.net, retrieved 2015-12-23
  9. ↑ GnuPG documentation: Libgcrypt overview - thread safety, GnuPG.org, retrieved 2016-04-16

External links

This article is issued from Wikipedia - version of the Monday, April 25, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.