Glossary — Crypto-View

Glossary

The same definitions shown on hover throughout the site and by crypto-view --define.

3DES: Triple DES. Withdrawn by NIST and limited by a 64-bit block that leaks on long sessions. Replace it with AES-256.
AES: The standard symmetric cipher. Quantum computers weaken it rather than break it; the answer is a longer key, not a different algorithm.
AES-128: Symmetric encryption with a 128-bit key. A quantum computer halves its effective strength, so use 256 bits for anything long-lived.
AES-256: Symmetric encryption with a 256-bit key. Not broken by a quantum computer; this is what most encrypted data should be using.
BouncyCastle: The most widely used Java cryptography library beyond the JDK. Ships ML-KEM and ML-DSA from version 1.79.
CBOM: Cryptographic Bill of Materials: a machine-readable inventory of every cryptographic algorithm, key and certificate a system uses.
crypto-agility: How easily a system can change the cryptographic algorithm it uses. A system that reads its algorithm from configuration is agile; one with the name compiled in is not.
CWE: Common Weakness Enumeration: a catalogue of software weakness types, used here to label what kind of defect a finding is.
CycloneDX: The OWASP bill-of-materials standard. Version 1.7 is the one that defines cryptographic assets, and is what Crypto-View writes.
DH: Diffie-Hellman key agreement over finite fields. Slower than the elliptic-curve form and no safer against a quantum attacker.
DSA: An older signature algorithm, deprecated by NIST for new work and broken by Shor.
ECDH: Elliptic-curve key agreement: how two parties agree a shared secret. Traffic protected by it and recorded today can be decrypted later.
ECDSA: Elliptic-curve digital signatures. Compact and fast, and broken by the same quantum algorithm that breaks RSA.
Ed25519: A specific EdDSA curve, widely used for SSH and code signing. Quantum-vulnerable.
EdDSA: A modern elliptic-curve signature scheme, usually Ed25519. Well built, and still broken by Shor's algorithm.
FIPS 203: The NIST standard defining ML-KEM, published August 2024.
FIPS 204: The NIST standard defining ML-DSA, published August 2024.
FIPS 205: The NIST standard defining SLH-DSA, published August 2024.
Grover's algorithm: A quantum search algorithm that halves the effective strength of a symmetric key. It weakens AES-128; it does not break AES-256.
harvest-now-decrypt-later: An attacker records encrypted traffic today and decrypts it once quantum computers arrive.
HMAC: A keyed fingerprint proving a message was not altered. Quantum computers do not break it.
HNDL: Harvest now, decrypt later: an attacker records encrypted traffic today and decrypts it once quantum computers arrive. The deadline has already passed for long-lived data.
HQC: A code-based key encapsulation mechanism selected by NIST in March 2025 as a backup to ML-KEM, resting on a different mathematical problem.
hybrid: Running a classical and a post-quantum algorithm together, so the result is no weaker than either. The standard way to migrate key exchange.
JCA: The Java Cryptography Architecture. Algorithms are selected by passing a string, which is why Java findings often name a transformation.
JOSE: The family of standards covering JSON signing and encryption, including JWT.
JWT: A signed token used for authentication. The signature algorithm is named in the token header; RS256 and ES256 are quantum-vulnerable, HS256 is not.
LMS: A hash-based signature scheme, RFC 8554. Quantum-safe, but stateful: reusing a one-time key destroys the security.
MD5: A hash function broken for over twenty years. Acceptable as a cache key, never as a security control.
ML-DSA: The NIST-standardised post-quantum signature algorithm, FIPS 204. Formerly called Dilithium. This is what replaces RSA and ECDSA signatures.
ML-DSA-65: The middle parameter set of ML-DSA (FIPS 204), targeting NIST security category 3.
ML-KEM: The NIST-standardised post-quantum key encapsulation mechanism, FIPS 203. Formerly called Kyber. This is what replaces RSA and ECDH key exchange.
ML-KEM-768: The middle parameter set of ML-KEM (FIPS 203), targeting NIST security category 3. The usual default choice.
NIST: The US National Institute of Standards and Technology, which ran the competition that selected the post-quantum algorithms.
PKCS#11: A standard interface to hardware security modules and smart cards. Where keys live when they are not in a file.
PKI: Public key infrastructure: the certificate authorities, certificates and revocation machinery that decide which public keys are trusted.
PQC: Post-quantum cryptography: algorithms designed to resist an attacker who has a large quantum computer.
RSA: The oldest public-key algorithm still in wide use. A quantum computer running Shor's algorithm breaks it outright, whatever the key size.
SARIF: A standard format for static-analysis results that editors and CI systems read directly. On the Crypto-View roadmap, not in this version.
SBOM: Software Bill of Materials: an inventory of the components a piece of software is built from. A CBOM is the cryptographic equivalent.
secp256k1: The elliptic curve used by Bitcoin and Ethereum. Public keys are usually published, so an attacker does not have to wait for a signature.
SHA-1: A hash function with practical collisions since 2017. Unsafe today, with no quantum computer involved.
SHA-256: The standard hash function. A quantum computer reduces its margin but does not break it; SHA-384 restores the full margin.
Shor's algorithm: The quantum algorithm that solves factoring and discrete logarithms efficiently, breaking every public-key algorithm in wide use today.
SLH-DSA: A hash-based post-quantum signature scheme, FIPS 205. Slower and larger than ML-DSA, and resting on far more conservative assumptions.
TLS: The protocol behind HTTPS. Its key exchange is where recorded-traffic exposure is largest, and where a hybrid post-quantum group helps most.
TLS 1.3: The current version of TLS. Still negotiates a classical key exchange unless a hybrid group such as X25519MLKEM768 is enabled.
X.509: The certificate format behind HTTPS and code signing. Certificates outlive most migrations, so their validity periods matter.
X25519: The elliptic-curve key agreement used in TLS 1.3 and Signal. The best classical option available, and still broken by a quantum computer.
XMSS: A hash-based signature scheme, RFC 8391. Quantum-safe and stateful, with the same key-management obligation as LMS.