Cryptographic Algorithm Detection Reference

BTP detects cryptographic algorithms, protocols, and certificate issues across six categories during static binary analysis. Each detected algorithm is assigned a classification status based on its cryptographic strength and industry guidance. Active compliance reporting is scoped to NIST IR 8547 (post-quantum cryptography). The Weak and Deprecated classifications are informational, derived from industry consensus (NIST SP 800-131A, RFC 7568, RFC 8996) - BTP does not generate compliance reports against those standards.

Detection Coverage

Category	Detected By
Encryption algorithms	Code analysis (native) / API detection (managed runtimes)
Hashing algorithms	Code analysis (native) / API detection (managed runtimes)
Signing algorithms	Code analysis (native) / API detection (managed runtimes)
MAC algorithms	Code analysis (native) / API detection (managed runtimes)
Protocols	API detection
Certificate issues	X.509 DER/PEM structure parsing

See Cryptographic Detection for how detection works by binary type.

Classification

Status	Meaning
Current	No known weaknesses; suitable for new designs
Acceptable	No active vulnerabilities; not recommended for new designs
Deprecated	Formally deprecated by a standards body; migrate away
Weak	Known cryptographic weaknesses; avoid in all contexts
Insecure	Actively prohibited; no safe usage
Quantum-vulnerable	Secure against classical attacks; vulnerable to CRQC via Shor’s algorithm
PQC Compliant	Quantum-resistant per NIST IR 8547
Informative	Non-security-relevant; inventory only, no severity assigned

Encryption Algorithms

Algorithm	Class	Status	Notes
AES	`crypto/algorithm/encryption/aes`	Current	Key size ≥128-bit; preferred symmetric cipher
Salsa20	`crypto/algorithm/encryption/salsa20`	Current	Modern stream cipher
Twofish	`crypto/algorithm/encryption/twofish`	Acceptable	Not widely standardized
Camellia	`crypto/algorithm/encryption/camellia`	Acceptable	ISO/IEC 18033-3 standardized
3DES	`crypto/algorithm/encryption/3des`	Deprecated	NIST SP 800-131A
DES	`crypto/algorithm/encryption/des`	Weak	56-bit key
Blowfish	`crypto/algorithm/encryption/blowfish`	Weak	64-bit block size; birthday attack risk
CAST5	`crypto/algorithm/encryption/cast5`	Weak	64-bit block size
IDEA	`crypto/algorithm/encryption/idea`	Weak	64-bit block size
RC2	`crypto/algorithm/encryption/rc2`	Weak	Multiple known attacks
RC4	`crypto/algorithm/encryption/rc4`	Weak	Prohibited in TLS (RFC 7465)
RC5	`crypto/algorithm/encryption/rc5`	Weak	—
RC6	`crypto/algorithm/encryption/rc6`	Weak	—
Skipjack	`crypto/algorithm/encryption/skipjack`	Weak	Legacy; 80-bit key
TEA	`crypto/algorithm/encryption/tea`	Weak	Structural weaknesses
XTEA	`crypto/algorithm/encryption/xtea`	Weak	Structural weaknesses
XXTEA	`crypto/algorithm/encryption/xxtea`	Weak	Structural weaknesses
HC-128	`crypto/algorithm/encryption/hc-128`	Informative	eSTREAM portfolio; no known breaks
Sosemanuk	`crypto/algorithm/encryption/sosemanuk`	Informative	eSTREAM portfolio; no known breaks
VEST	`crypto/algorithm/encryption/vest`	Informative	Niche; inventory only
Curve25519	`crypto/algorithm/encryption/curve25519`	Quantum-vulnerable	ECDH key exchange
RSA (encryption)	`crypto/algorithm/encryption/rsa`	Quantum-vulnerable	Integer factorization; Shor’s algorithm

Hashing Algorithms

Algorithm	Class	Status	Notes
SHA-256	`crypto/algorithm/hashing/sha256`	Current	Recommended
SHA-384	`crypto/algorithm/hashing/sha384`	Current	Recommended
SHA-512	`crypto/algorithm/hashing/sha512`	Current	Recommended
SHA-512/224	`crypto/algorithm/hashing/sha512-224`	Current	Truncated SHA-512
SHA-512/256	`crypto/algorithm/hashing/sha512-256`	Current	Truncated SHA-512
SHA-224	`crypto/algorithm/hashing/sha224`	Current	Acceptable for most uses
SHA3-224	`crypto/algorithm/hashing/sha3-224`	Current	FIPS 202
SHA3-256	`crypto/algorithm/hashing/sha3-256`	Current	FIPS 202
SHA3-384	`crypto/algorithm/hashing/sha3-384`	Current	FIPS 202
SHA3-512	`crypto/algorithm/hashing/sha3-512`	Current	FIPS 202
SHAKE128	`crypto/algorithm/hashing/shake128`	Current	Extendable output; FIPS 202
SHAKE256	`crypto/algorithm/hashing/shake256`	Current	Extendable output; FIPS 202
BLAKE2b	`crypto/algorithm/hashing/blake2b`	Current	High performance
BLAKE2s	`crypto/algorithm/hashing/blake2s`	Current	High performance
RIPEMD-160	`crypto/algorithm/hashing/ripemd160`	Acceptable	Aging standard
SM3	`crypto/algorithm/hashing/sm3`	Acceptable	Chinese national standard (GM/T 0004)
MD5	`crypto/algorithm/hashing/md5`	Deprecated	Collision attacks demonstrated
SHA-1	`crypto/algorithm/hashing/sha1`	Deprecated	NIST SP 800-131A
Tiger	`crypto/algorithm/hashing/tiger`	Weak	Not recommended
MD4	`crypto/algorithm/hashing/md4`	Weak	Cryptographically broken
MD2	`crypto/algorithm/hashing/md2`	Weak	Withdrawn
DJB2	`crypto/algorithm/hashing/djb2`	Informative	Non-cryptographic; inventory only; native binaries only
FNV	`crypto/algorithm/hashing/fnv`	Informative	Non-cryptographic; inventory only; native binaries only
MurmurHash3	`crypto/algorithm/hashing/murmur3`	Informative	Non-cryptographic; inventory only; native binaries only

Signing Algorithms

Post-quantum algorithms

These algorithms are detected and classified as NIST IR 8547 compliant. Detection confirms their presence; adoption replaces quantum-vulnerable counterparts.

PQC digital signature algorithms are currently only detected in UEFI modules and certificates. These algorithms are not yet supported for detection in Java and Python managed runtimes or ELF native binaries.

Algorithm	Class	Status	Standard
ML-DSA-44	`crypto/algorithm/signing/ml-dsa-44`	PQC Compliant	FIPS 204 (CRYSTALS-Dilithium)
ML-DSA-65	`crypto/algorithm/signing/ml-dsa-65`	PQC Compliant	FIPS 204; recommended level
ML-DSA-87	`crypto/algorithm/signing/ml-dsa-87`	PQC Compliant	FIPS 204; highest level
LMS	`crypto/algorithm/signing/lms`	PQC Compliant	NIST SP 800-208 (hash-based)
SLH-DSA-SHA2-128f	`crypto/algorithm/signing/slh-dsa-sha2-128f`	PQC Compliant	FIPS 205 (SPHINCS+)
SLH-DSA-SHA2-128s	`crypto/algorithm/signing/slh-dsa-sha2-128s`	PQC Compliant	FIPS 205
SLH-DSA-SHA2-192f	`crypto/algorithm/signing/slh-dsa-sha2-192f`	PQC Compliant	FIPS 205
SLH-DSA-SHA2-192s	`crypto/algorithm/signing/slh-dsa-sha2-192s`	PQC Compliant	FIPS 205
SLH-DSA-SHA2-256f	`crypto/algorithm/signing/slh-dsa-sha2-256f`	PQC Compliant	FIPS 205
SLH-DSA-SHA2-256s	`crypto/algorithm/signing/slh-dsa-sha2-256s`	PQC Compliant	FIPS 205
SLH-DSA-SHAKE-128f	`crypto/algorithm/signing/slh-dsa-shake-128f`	PQC Compliant	FIPS 205
SLH-DSA-SHAKE-128s	`crypto/algorithm/signing/slh-dsa-shake-128s`	PQC Compliant	FIPS 205
SLH-DSA-SHAKE-192f	`crypto/algorithm/signing/slh-dsa-shake-192f`	PQC Compliant	FIPS 205
SLH-DSA-SHAKE-192s	`crypto/algorithm/signing/slh-dsa-shake-192s`	PQC Compliant	FIPS 205
SLH-DSA-SHAKE-256f	`crypto/algorithm/signing/slh-dsa-shake-256f`	PQC Compliant	FIPS 205
SLH-DSA-SHAKE-256s	`crypto/algorithm/signing/slh-dsa-shake-256s`	PQC Compliant	FIPS 205

Quantum-vulnerable algorithms

Algorithm	Class	Status	Notes
ECDSA-SHA224	`crypto/algorithm/signing/ecdsa-sha224`	Quantum-vulnerable	—
ECDSA-SHA256	`crypto/algorithm/signing/ecdsa-sha256`	Quantum-vulnerable	—
ECDSA-SHA384	`crypto/algorithm/signing/ecdsa-sha384`	Quantum-vulnerable	—
ECDSA-SHA512	`crypto/algorithm/signing/ecdsa-sha512`	Quantum-vulnerable	—
ECDSA-SHA3-224	`crypto/algorithm/signing/ecdsa-sha3-224`	Quantum-vulnerable	—
ECDSA-SHA3-256	`crypto/algorithm/signing/ecdsa-sha3-256`	Quantum-vulnerable	—
ECDSA-SHA3-384	`crypto/algorithm/signing/ecdsa-sha3-384`	Quantum-vulnerable	—
ECDSA-SHA3-512	`crypto/algorithm/signing/ecdsa-sha3-512`	Quantum-vulnerable	—
ECDSA-SHA1	`crypto/algorithm/signing/ecdsa-sha1`	Quantum-vulnerable	SHA-1 hash additionally deprecated
Ed25519	`crypto/algorithm/signing/ed25519`	Quantum-vulnerable	Modern; not quantum-safe
Ed448	`crypto/algorithm/signing/ed448`	Quantum-vulnerable	Modern; not quantum-safe
RSA	`crypto/algorithm/signing/rsa`	Quantum-vulnerable	Key size ≥2048-bit required
RSA-SHA224	`crypto/algorithm/signing/rsa-sha224`	Quantum-vulnerable	—
RSA-SHA256	`crypto/algorithm/signing/rsa-sha256`	Quantum-vulnerable	—
RSA-SHA384	`crypto/algorithm/signing/rsa-sha384`	Quantum-vulnerable	—
RSA-SHA512	`crypto/algorithm/signing/rsa-sha512`	Quantum-vulnerable	—
RSA-SHA512/224	`crypto/algorithm/signing/rsa-sha512-224`	Quantum-vulnerable	—
RSA-SHA512/256	`crypto/algorithm/signing/rsa-sha512-256`	Quantum-vulnerable	—
RSA-RIPEMD160	`crypto/algorithm/signing/rsa-ripemd160`	Quantum-vulnerable	—
RSA-SM3	`crypto/algorithm/signing/rsa-sm3`	Quantum-vulnerable	Chinese national standard
RSASSA-PKCS1-v1.5-SHA3-224	`crypto/algorithm/signing/rsassa-pkcs1-v1-5-sha3-224`	Quantum-vulnerable	—
RSASSA-PKCS1-v1.5-SHA3-256	`crypto/algorithm/signing/rsassa-pkcs1-v1-5-sha3-256`	Quantum-vulnerable	—
RSASSA-PKCS1-v1.5-SHA3-384	`crypto/algorithm/signing/rsassa-pkcs1-v1-5-sha3-384`	Quantum-vulnerable	—
RSASSA-PKCS1-v1.5-SHA3-512	`crypto/algorithm/signing/rsassa-pkcs1-v1-5-sha3-512`	Quantum-vulnerable	—
SM2	`crypto/algorithm/signing/sm2`	Quantum-vulnerable	ECC-based; Chinese national standard

Deprecated algorithms

Algorithm	Class	Status	Notes
DSA	`crypto/algorithm/signing/dsa`	Deprecated	NIST SP 800-131A
DSA-SHA1	`crypto/algorithm/signing/dsa-sha1`	Deprecated	NIST SP 800-131A
DSA-SHA224	`crypto/algorithm/signing/dsa-sha224`	Deprecated	DSA key deprecated
DSA-SHA256	`crypto/algorithm/signing/dsa-sha256`	Deprecated	DSA key deprecated
DSA-SHA384	`crypto/algorithm/signing/dsa-sha384`	Deprecated	DSA key deprecated
DSA-SHA512	`crypto/algorithm/signing/dsa-sha512`	Deprecated	DSA key deprecated
DSA-SHA3-224	`crypto/algorithm/signing/dsa-sha3-224`	Deprecated	DSA key deprecated
DSA-SHA3-256	`crypto/algorithm/signing/dsa-sha3-256`	Deprecated	DSA key deprecated
DSA-SHA3-384	`crypto/algorithm/signing/dsa-sha3-384`	Deprecated	DSA key deprecated
DSA-SHA3-512	`crypto/algorithm/signing/dsa-sha3-512`	Deprecated	DSA key deprecated
RSA-SHA1	`crypto/algorithm/signing/rsa-sha1`	Deprecated	SHA-1 hash deprecated; NIST SP 800-131A

Weak algorithms

Algorithm	Class	Status	Notes
RSA-MD5	`crypto/algorithm/signing/rsa-md5`	Weak	MD5 collision attacks enable signature forgery
RSA-MD2	`crypto/algorithm/signing/rsa-md2`	Weak	MD2 withdrawn; signatures can be forged

MAC Algorithms

Algorithm	Class	Status	Notes
HMAC-SHA224	`crypto/algorithm/mac/hmac-sha224`	Current	—
HMAC-SHA256	`crypto/algorithm/mac/hmac-sha256`	Current	Recommended
HMAC-SHA384	`crypto/algorithm/mac/hmac-sha384`	Current	—
HMAC-SHA512	`crypto/algorithm/mac/hmac-sha512`	Current	Recommended
HMAC-SHA512/224	`crypto/algorithm/mac/hmac-sha512-224`	Current	Truncated SHA-512
HMAC-SHA512/256	`crypto/algorithm/mac/hmac-sha512-256`	Current	Truncated SHA-512
HMAC-SHA3-224	`crypto/algorithm/mac/hmac-sha3-224`	Current	FIPS 202
HMAC-SHA3-256	`crypto/algorithm/mac/hmac-sha3-256`	Current	FIPS 202
HMAC-SHA3-384	`crypto/algorithm/mac/hmac-sha3-384`	Current	FIPS 202
HMAC-SHA3-512	`crypto/algorithm/mac/hmac-sha3-512`	Current	FIPS 202
Poly1305	`crypto/algorithm/mac/poly1305`	Current	Used with ChaCha20
HMAC-SM3	`crypto/algorithm/mac/hmac-sm3`	Acceptable	Chinese national standard (GM/T 0004)
HMAC-MD5	`crypto/algorithm/mac/hmac-md5`	Deprecated	MD5 hash deprecated
HMAC-SHA1	`crypto/algorithm/mac/hmac-sha1`	Deprecated	SHA-1 deprecated; NIST SP 800-131A

Pseudorandom Number Generators

Detection is available for native binaries only.

Algorithm	Class	Status	Notes
Mersenne Twister	`crypto/algorithm/prng/mersenne`	Weak	Not a CSPRNG; output is predictable given sufficient observations

Protocols

Protocol	Class	Status	Reference
TLS v1.3	`crypto/protocol/tls/v1-3`	Current	Recommended
TLS v1.2	`crypto/protocol/tls/v1-2`	Current	Acceptable with strong cipher suites
TLS v1.1	`crypto/protocol/tls/v1-1`	Deprecated	RFC 8996
TLS v1.0	`crypto/protocol/tls/v1-0`	Deprecated	RFC 8996
SSL v3.0	`crypto/protocol/ssl/v3-0`	Insecure	RFC 7568 (POODLE)
SSL v2.0	`crypto/protocol/ssl/v2-0`	Insecure	RFC 6176

Certificate Issues

Issue	Class	Severity	Notes
Expired certificate	`crypto/certificate/expired`	High	Validity period has passed
Invalid certificate	`crypto/certificate/invalid`	High	Invalid parameters or structure
Weak RSA key parameters	`crypto/rsa/weak-key-parameters`	High	Does not meet minimum key strength
Self-signed certificate	`crypto/certificate/self-signed`	Medium	Not signed by a recognized CA
Untrusted certificate	`crypto/certificate/untrusted`	Medium	Signed by an unrecognized CA

PQC Compliance Assessment

BTP’s active compliance reporting for cryptographic algorithms is scoped exclusively to NIST IR 8547. Weak and Deprecated classifications above are informational and do not constitute a compliance report.

Quantum-vulnerable algorithms remain secure against classical computers today. The risk is retroactive decryption by a future cryptographically-relevant quantum computer (CRQC) - a relevant threat for long-lived encrypted data.

BTP identifies all quantum-vulnerable algorithm instances per binary image, maps them to NIST IR 8547 guidance, and surfaces replacement recommendations. This assessment is published as the PQC Compliance Report (PDF and JSON). NIST IR 8547 migration timeline:

Timeline	Requirement
Short-term (by 2030)	Inventory all quantum-vulnerable algorithm usage
Mid-term (2030–2035)	Transition critical systems to PQC algorithms
Long-term (after 2035)	Complete deprecation of quantum-vulnerable algorithms

Detection

Findings

Risk Assessment

Analysis Engine

Compliance

Detection Coverage

Classification

Encryption Algorithms

Hashing Algorithms

Signing Algorithms

Post-quantum algorithms

Quantum-vulnerable algorithms

Deprecated algorithms

Weak algorithms

MAC Algorithms

Pseudorandom Number Generators

Protocols

Certificate Issues

PQC Compliance Assessment

​Detection Coverage

​Classification

​Encryption Algorithms

​Hashing Algorithms

​Signing Algorithms

​Post-quantum algorithms

​Quantum-vulnerable algorithms

​Deprecated algorithms

​Weak algorithms

​MAC Algorithms

​Pseudorandom Number Generators

​Protocols

​Certificate Issues

​PQC Compliance Assessment

​Related

Detection Coverage

Classification

Encryption Algorithms

Hashing Algorithms

Signing Algorithms

Post-quantum algorithms

Quantum-vulnerable algorithms

Deprecated algorithms

Weak algorithms

MAC Algorithms

Pseudorandom Number Generators

Protocols

Certificate Issues

PQC Compliance Assessment

Related