Cryptographic Test Vectors

This folder contains test vectors for the hash, MAC and cipher algorithms in this package, from official sources.

Implementation Status

FIPS 180-4 (Secure Hash Standard)

Algorithm	Hash Size	Status	Class
SHA-1	160 bits	✅ Implemented	SHA1
SHA-224	224 bits	✅ Implemented	SHA224
SHA-256	256 bits	✅ Implemented	SHA256
SHA-384	384 bits	✅ Implemented	SHA384
SHA-512	512 bits	✅ Implemented	SHA512
SHA-512/224	224 bits	✅ Implemented	SHA512_224
SHA-512/256	256 bits	✅ Implemented	SHA512_256

FIPS 202 (SHA-3 Standard)

Algorithm	Hash Size	Status	Class
SHA3-224	224 bits	✅ Implemented	SHA3_224
SHA3-256	256 bits	✅ Implemented	SHA3_256
SHA3-384	384 bits	✅ Implemented	SHA3_384
SHA3-512	512 bits	✅ Implemented	SHA3_512
SHAKE128	Variable	✅ Implemented	Shake128
SHAKE256	Variable	✅ Implemented	Shake256

NIST SP 800-185 (SHA-3 Derived Functions)

Algorithm	Security	Status	Class
cSHAKE128	128 bits	✅ Implemented	CShake128
cSHAKE256	256 bits	✅ Implemented	CShake256
KMAC128	128 bits	✅ Implemented	KMac128
KMAC256	256 bits	✅ Implemented	KMac256
ParallelHash128	128 bits	✅ Implemented	ParallelHash, IncrementalParallelHash
ParallelHash256	256 bits	✅ Implemented	ParallelHash, IncrementalParallelHash
TupleHash128	128 bits	⬜ Not implemented	-
TupleHash256	256 bits	⬜ Not implemented	-

ParallelHash: one-shot via ParallelHash.ComputeHash128/ComputeHash256, streaming via IncrementalParallelHash. Test vectors: ParallelHash-vectors.md.

RFC 9861 (TurboSHAKE and KangarooTwelve)

Algorithm	Security	Status	Class
TurboSHAKE128	128 bits	✅ Implemented	TurboShake128
TurboSHAKE256	256 bits	✅ Implemented	TurboShake256
KT128	128 bits	✅ Implemented	KT128
KT256	256 bits	✅ Implemented	KT256

Note: KT128 and KT256 (formerly KangarooTwelve and MarsupilamiFourteen) are defined in RFC 9861. They use reduced-round Keccak (12 rounds) for ~2× faster performance than SHAKE.

NIST SP 800-232 (Ascon Lightweight Cryptography)

Algorithm	Hash Size	Status	Class
Ascon-Hash256	256 bits	✅ Implemented	AsconHash256
Ascon-XOF128	Variable	✅ Implemented	AsconXof128

Note: Ascon was selected as the NIST Lightweight Cryptography standard in 2023 and published as SP 800-232. See NIST-SP-800-232.md. It is designed for constrained environments (IoT, embedded systems).

Keccak (Original Algorithm)

Algorithm	Hash Size	Status	Class
Keccak-256	256 bits	✅ Implemented	Keccak256
Keccak-384	384 bits	✅ Implemented	Keccak384
Keccak-512	512 bits	✅ Implemented	Keccak512

Note: Keccak uses the original Keccak padding (0x01) as used in Ethereum. SHA-3 uses different padding (0x06). Use SHA3_256 for NIST SHA-3 compliance.

RFC 7693 (BLAKE2)

Algorithm	Hash Size	Features	Status	Class
BLAKE2b	1-64 bytes	Hash, Keyed (MAC)	✅ Implemented	Blake2b
BLAKE2s	1-32 bytes	Hash, Keyed (MAC)	✅ Implemented	Blake2s

BLAKE2 Features

Feature	BLAKE2b	BLAKE2s	Description
Variable output	✅	✅	Output size 1-64 bytes (b) or 1-32 bytes (s)
Keyed hashing (MAC)	✅	✅	Built-in MAC mode with key up to 64/32 bytes
Salt	❌	❌	Optional (not implemented)
Personalization	❌	❌	Optional (not implemented)
Tree hashing	❌	❌	Optional (not implemented)
Parallel variants	❌	❌	BLAKE2bp/BLAKE2sp (not implemented)

BLAKE3

Algorithm	Hash Size	Features	Status	Class
BLAKE3	Variable	Hash, Keyed, Derive Key	✅ Implemented	Blake3

BLAKE3 Modes

Mode	Status	Factory Method	Description
Hash	✅	Blake3.Create()	Standard cryptographic hashing
Keyed Hash	✅	Blake3.CreateKeyed(key)	MAC with 32-byte key
Derive Key	✅	Blake3.CreateDeriveKey(context)	Key derivation from a context string and key material
XOF	✅	Blake3.Create(outputBytes)	Extendable output (any length)

RIPEMD Family

Algorithm	Hash Size	Status	Class
RIPEMD-160	160 bits	✅ Implemented	Ripemd160

Note: RIPEMD-160 is widely used in cryptocurrency systems (Bitcoin address generation).

SM3 (Chinese National Standard)

Algorithm	Hash Size	Status	Class
SM3	256 bits	✅ Implemented	SM3

Standard: GB/T 32905-2016 (China), ISO/IEC 10118-3:2018

Whirlpool (ISO/IEC 10118-3)

Algorithm	Hash Size	Status	Class
Whirlpool	512 bits	✅ Implemented	Whirlpool

Standard: ISO/IEC 10118-3:2004, NESSIE recommended

Streebog / GOST R 34.11-2012 (Russian National Standard)

Algorithm	Hash Size	Status	Class
Streebog-256	256 bits	✅ Implemented	Streebog
Streebog-512	512 bits	✅ Implemented	Streebog

Standard: GOST R 34.11-2012, RFC 6986

Kupyna / DSTU 7564:2014 (Ukrainian National Standard)

Algorithm	Hash Size	Status	Class
Kupyna-256	256 bits	✅ Implemented	Kupyna
Kupyna-384	384 bits	✅ Implemented	Kupyna
Kupyna-512	512 bits	✅ Implemented	Kupyna

Standard: DSTU 7564:2014 (Ukraine)

LSH / KS X 3262 (Korean National Standard)

Algorithm	Hash Size	Status	Class
LSH-256-224	224 bits	✅ Implemented	Lsh256
LSH-256-256	256 bits	✅ Implemented	Lsh256
LSH-512-256	256 bits	✅ Implemented	Lsh512
LSH-512-384	384 bits	✅ Implemented	Lsh512
LSH-512-512	512 bits	✅ Implemented	Lsh512

Standard: KS X 3262 (South Korea), approved by KCMVP

Legacy Algorithms

Algorithm	Hash Size	Status	Class
MD5	128 bits	✅ Implemented (deprecated)	MD5

Warning: MD5 is cryptographically broken and should NOT be used for security purposes. It is provided only for legacy compatibility and non-cryptographic uses.

---

MAC Algorithms

RFC 2104 / FIPS 198-1 (HMAC)

Algorithm	Hash	MAC Size	Status	Class
HMAC-SHA-256	SHA-256	32 bytes	✅ Implemented	HmacSha256
HMAC-SHA-384	SHA-384	48 bytes	✅ Implemented	HmacSha384
HMAC-SHA-512	SHA-512	64 bytes	✅ Implemented	HmacSha512
HMAC-SHA3-256	SHA3-256	32 bytes	✅ Implemented	HmacSha3_256
HMAC-SHA3-384	SHA3-384	48 bytes	✅ Implemented	HmacSha3_384
HMAC-SHA3-512	SHA3-512	64 bytes	✅ Implemented	HmacSha3_512
HMAC-SHA-1	SHA-1	20 bytes	✅ Implemented (legacy)	HmacSha1
HMAC-MD5	MD5	16 bytes	✅ Implemented (legacy)	HmacMd5

Note: The HmacCore base class works with any HashAlgorithm, so custom HMAC variants (HMAC-SM3, HMAC-Kupyna, etc.) can be created by subclassing.

SP 800-38B (AES-CMAC)

Algorithm	Key Size	MAC Size	Status	Class
AES-128-CMAC	128 bits	128 bits	✅ Implemented	AesCmac
AES-192-CMAC	192 bits	128 bits	✅ Implemented	AesCmac
AES-256-CMAC	256 bits	128 bits	✅ Implemented	AesCmac

Hardware acceleration: AES-NI on .NET 8+. Note: .NET does not provide a portable CMAC implementation.

SP 800-38D (AES-GMAC)

Algorithm	Key Size	MAC Size	Status	Class
AES-128-GMAC	128 bits	128 bits	✅ Implemented	AesGmac
AES-192-GMAC	192 bits	128 bits	✅ Implemented	AesGmac
AES-256-GMAC	256 bits	128 bits	✅ Implemented	AesGmac

Hardware acceleration: AES-NI + PCLMULQDQ on .NET 8+, VPCLMULQDQ on .NET 10+. Note: GMAC requires a unique nonce per invocation. .NET does not provide a standalone GMAC class.

---

Cipher Algorithms

FIPS 197 (Advanced Encryption Standard)

Algorithm	Key Size	Mode	Status	Class
AES-128	128 bits	ECB/CBC/CTR	✅ Implemented	Aes128
AES-192	192 bits	ECB/CBC/CTR	✅ Implemented	Aes192
AES-256	256 bits	ECB/CBC/CTR	✅ Implemented	Aes256

Hardware acceleration: AES-NI (AESENC/AESDEC) on .NET 8+. CBC decrypt uses 8-block interleaving. OFB, CFB, and CTS modes are defined for compatibility but marked [Obsolete] and not implemented — modern protocols use AEAD modes (GCM, CCM) or CTR instead.

SP 800-38D (AES-GCM)

Algorithm	Key Size	Status	Class
AES-128-GCM	128 bits	✅ Implemented	AesGcm128
AES-192-GCM	192 bits	✅ Implemented	AesGcm192
AES-256-GCM	256 bits	✅ Implemented	AesGcm256

Hardware acceleration: AES-NI + PCLMULQDQ (.NET 8+), VPCLMULQDQ (.NET 10+). Uses 8-block stitched AES+GHASH pipeline with lagged carry-less multiplication and SymCrypt-style 2-CLMUL modular reduction.

RFC 3610 (AES-CCM)

Algorithm	Key Size	Status	Class
AES-128-CCM	128 bits	✅ Implemented	AesCcm128
AES-192-CCM	192 bits	✅ Implemented	AesCcm192
AES-256-CCM	256 bits	✅ Implemented	AesCcm256

Hardware acceleration: AES-NI on .NET 8+ for CTR and CBC-MAC block operations.

RFC 8439 (ChaCha20 / ChaCha20-Poly1305)

Algorithm	Key Size	Status	Class
ChaCha20	256 bits	✅ Implemented	ChaCha20
Poly1305	256 bits	✅ Implemented	Poly1305Mac
ChaCha20-Poly1305	256 bits	✅ Implemented	ChaCha20Poly1305

Hardware acceleration: SSSE3 (single-block) and AVX2 (dual-block) on .NET 8+. Poly1305 uses donna-64 (3×44-bit limbs) on .NET 8+, donna-32 (5×26-bit limbs) on older targets.

draft-irtf-cfrg-xchacha (XChaCha20-Poly1305)

Algorithm	Key Size	Nonce Size	Status	Class
XChaCha20-Poly1305	256 bits	192 bits	✅ Implemented	XChaCha20Poly1305

Note: XChaCha20-Poly1305 extends ChaCha20-Poly1305 with a 24-byte nonce (vs 12-byte), making random nonce generation safe for a practically unlimited number of messages. There is no standalone XChaCha20 stream cipher — only the AEAD construction.

NIST SP 800-232 (Ascon-AEAD128)

Algorithm	Key Size	Nonce Size	Status	Class
Ascon-AEAD128	128 bits	128 bits	✅ Implemented	AsconAead128

Regional Block Ciphers

Algorithm	Key Size	Block Size	Mode	Standard	Status	Class
SM4	128 bits	128 bits	ECB/CBC/CTR	GB/T 32907-2016 (China)	✅ Implemented	Sm4
ARIA-128	128 bits	128 bits	ECB/CBC/CTR	RFC 5794 (Korea)	✅ Implemented	Aria128
ARIA-192	192 bits	128 bits	ECB/CBC/CTR	RFC 5794 (Korea)	✅ Implemented	Aria192
ARIA-256	256 bits	128 bits	ECB/CBC/CTR	RFC 5794 (Korea)	✅ Implemented	Aria256
SEED	128 bits	128 bits	ECB/CBC/CTR	RFC 4269 (Korea)	✅ Implemented	Seed
Camellia-128	128 bits	128 bits	ECB/CBC/CTR	RFC 3713 (Japan)	✅ Implemented	Camellia128
Camellia-192	192 bits	128 bits	ECB/CBC/CTR	RFC 3713 (Japan)	✅ Implemented	Camellia192
Camellia-256	256 bits	128 bits	ECB/CBC/CTR	RFC 3713 (Japan)	✅ Implemented	Camellia256
Kuznyechik	256 bits	128 bits	ECB/CBC/CTR	GOST R 34.12-2015 (Russia)	✅ Implemented	Kuznyechik
Kalyna-128/128	128 bits	128 bits	ECB/CBC/CTR	DSTU 7624:2014 (Ukraine)	✅ Implemented	Kalyna128
Kalyna-128/256	256 bits	128 bits	ECB/CBC/CTR	DSTU 7624:2014 (Ukraine)	✅ Implemented	Kalyna256
Kalyna-256/256, -256/512	256/512 bits	256 bits	ECB/CBC/CTR	DSTU 7624:2014 (Ukraine)	✅ Implemented	Kalyna512

Modes: every block cipher here supports ECB (testing only), CBC and CTR. CFB and OFB exist as [Obsolete] values on CipherMode and throw NotSupportedException; Kalyna's 512-bit block variant, and the GCM/CCM/XTS/MGM modes the regional standards define, are not implemented.

Key Derivation Functions

Algorithm	Standard	Status	Class
HKDF	RFC 5869	✅ Implemented	Hkdf
KBKDF	NIST SP 800-108	✅ Implemented	Kbkdf
Concat KDF	NIST SP 800-56A	✅ Implemented	ConcatKdf
PBKDF2	RFC 8018 / NIST SP 800-132	✅ Implemented	Pbkdf2

---

Key Encapsulation Mechanisms (KEM)

FIPS 203 (Module-Lattice-Based Key-Encapsulation Mechanism)

Algorithm	Security Category	Status	Class
ML-KEM-512	1 (~AES-128)	✅ Implemented	MLKem512, MLKem
ML-KEM-768	3 (~AES-192)	✅ Implemented	MLKem768, MLKem
ML-KEM-1024	5 (~AES-256)	✅ Implemented	MLKem1024, MLKem

Note: Validated against official NIST ACVP vectors (key generation, encapsulation, decapsulation including implicit rejection, and the FIPS 203 §7.2/§7.3 key checks) and cross-checked against BouncyCastle and .NET 10 System.Security.Cryptography.MLKem. The MLKem key-holding class mirrors the .NET 10 API shape on all target frameworks.

---

Digital Signature Algorithms

FIPS 204 (Module-Lattice-Based Digital Signature Algorithm)

Algorithm	Security Category	Status	Class
ML-DSA-44	2	✅ Implemented	MLDsa44, MLDsa
ML-DSA-65	3	✅ Implemented	MLDsa65, MLDsa
ML-DSA-87	5	✅ Implemented	MLDsa87, MLDsa
HashML-DSA (pre-hash)	-	✅ Implemented	MLDsa.SignPreHash/VerifyPreHash

Note: Validated against official NIST ACVP vectors (key generation, deterministic and hedged signing with byte-exact signatures, and verification including modified commitment/z/hint/message rejections) and cross-checked against BouncyCastle and .NET 10 System.Security.Cryptography.MLDsa. The MLDsa key-holding class mirrors the .NET 10 API shape on all target frameworks.

---

Digital Signature Algorithms

FIPS 205 (Stateless Hash-Based Digital Signature Algorithm)

Algorithm	Security Category	Status	Class
SLH-DSA-{SHA2,SHAKE}-128{s,f}	1	✅ Implemented	SlhDsa + SlhDsaAlgorithm
SLH-DSA-{SHA2,SHAKE}-192{s,f}	3	✅ Implemented	SlhDsa + SlhDsaAlgorithm
SLH-DSA-{SHA2,SHAKE}-256{s,f}	5	✅ Implemented	SlhDsa + SlhDsaAlgorithm
HashSLH-DSA (pre-hash)	-	✅ Implemented	SlhDsa.SignPreHash/VerifyPreHash

Note: Validated against official NIST ACVP vectors (key generation for all 12 parameter sets, deterministic and hedged signing with byte-exact signatures, and verification including modified R/SIGFORS/SIGHT/message and wrong-length rejections) and cross-checked against BouncyCastle and .NET 10 System.Security.Cryptography.SlhDsa.

---

Sources

NIST (National Institute of Standards and Technology)

Official test vectors and examples with intermediate values are available from:

• NIST Cryptographic Standards and Guidelines Example Values: csrc.nist.gov/…/example-values

SHA-1 and SHA-2 Family (FIPS 180-4)

The official FIPS 180-4 specification is available from NIST:

• NIST-FIPS-180-4.md - Local reference with algorithm details and test vectors
• NIST FIPS 180-4 - Secure Hash Standard (SHS): SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256

SHA-1 (Legacy Only)

• SHA-1 Examples

SHA-2 Family

• SHA-224 Examples
• SHA-256 Examples
• SHA-384 Examples
• SHA-512 Examples
• SHA-512/224 Examples
• SHA-512/256 Examples
• All SHA-2 Examples
• Additional SHA-2 Data

SHA-3 and SHAKE (FIPS 202)

The official FIPS 202 specification is available from NIST:

• NIST-FIPS-202.md - Local reference with algorithm details and test vectors
• NIST FIPS 202 - SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions

Algorithm	0-bit	5-bit	30-bit	1600-bit	1605-bit	1630-bit
SHA3-224	Msg0	Msg5	Msg30	1600	1605	1630
SHA3-256	Msg0	Msg5	Msg30	1600	1605	1630
SHA3-384	Msg0	Msg5	Msg30	1600	1605	1630
SHA3-512	Msg0	Msg5	Msg30	1600	1605	1630

SHAKE XOF (FIPS 202)

Algorithm	0-bit	5-bit	30-bit	1600-bit	1605-bit	1630-bit
SHAKE128	Msg0	Msg5	Msg30	1600	1605	1630
SHAKE256	Msg0	Msg5	Msg30	1600	1605	1630

• SHAKE Truncation Examples

NIST SP 800-185 (SHA-3 Derived Functions)

Reference documentation for cSHAKE, KMAC, TupleHash, and ParallelHash:

• NIST-SP-800-185.md - Local reference with test vectors
• NIST SP 800-185 PDF

HMAC (RFC 2104 / FIPS 198-1)

• RFC-2104.md - Local reference with algorithm details
• RFC 2104 - HMAC: Keyed-Hashing for Message Authentication
• RFC 4231 - Test Vectors for HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
• FIPS 198-1 - The Keyed-Hash Message Authentication Code (HMAC)

AES-CMAC (SP 800-38B / RFC 4493)

• NIST-SP-800-38B.md - Local reference with algorithm details and GMAC
• NIST SP 800-38B - CMAC Mode for Authentication
• RFC 4493 - The AES-CMAC Algorithm

BLAKE2 (RFC 7693)

The official RFC 7693 specification is available from IETF:

• RFC 7693 - The BLAKE2 Cryptographic Hash and Message Authentication Code (MAC)

Additional BLAKE2 resources:

• www.blake2.net
• github.com/BLAKE2/BLAKE2

BLAKE3

BLAKE3 test vectors are from the official BLAKE3 specification:

• github.com/BLAKE3-team/BLAKE3

RIPEMD-160

• RIPEMD-160-vectors.md - Test vectors
• Original specification

SM3 (GB/T 32905-2016)

• SM3-vectors.md - Test vectors
• GB/T 32905-2016 (Chinese national standard)
• ISO/IEC 10118-3:2018

Whirlpool

• Whirlpool-vectors.md - Test vectors
• ISO/IEC 10118-3:2004
• www.larc.usp.br/~pbarreto/WhirlpoolPage.html

Streebog (GOST R 34.11-2012)

• Streebog-vectors.md - Test vectors
• RFC 6986

Kupyna (DSTU 7564:2014)

• Kupyna-vectors.md - Test vectors
• IACR ePrint 2015/885
• Reference implementation

LSH (KS X 3262)

• KS X 3262 specification (Korean standard)
• Reference implementation

MD5 (RFC 1321)

MD5 is defined in RFC 1321:

• www.ietf.org/rfc/rfc1321.txt

AES (FIPS 197)

The official FIPS 197 specification is available from NIST:

• NIST-FIPS-197.md - Local reference with algorithm details and test vectors
• NIST FIPS 197 - Advanced Encryption Standard (AES)

AES-GCM (SP 800-38D)

• NIST SP 800-38D - Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM)

AES-CCM (RFC 3610)

• RFC 3610 - Counter with CBC-MAC (CCM)

ChaCha20 / ChaCha20-Poly1305 (RFC 8439)

• RFC 8439 - ChaCha20 and Poly1305 for IETF Protocols

XChaCha20-Poly1305 (draft-irtf-cfrg-xchacha)

• draft-irtf-cfrg-xchacha - XChaCha20 and XChaCha20-Poly1305

ML-KEM (FIPS 203)

The official FIPS 203 specification and ACVP test vectors are available from NIST:

• NIST-FIPS-203.md - Local reference with algorithm details
• ML-KEM-vectors.md - Test vector documentation (NIST ACVP)
• NIST FIPS 203 - Module-Lattice-Based Key-Encapsulation Mechanism Standard
• NIST ACVP-Server vectors - ML-KEM-keyGen-FIPS203 and ML-KEM-encapDecap-FIPS203

ML-DSA (FIPS 204)

The official FIPS 204 specification and ACVP test vectors are available from NIST:

• NIST-FIPS-204.md - Local reference with algorithm details
• ML-DSA-vectors.md - Test vector documentation (NIST ACVP)
• NIST FIPS 204 - Module-Lattice-Based Digital Signature Standard
• NIST ACVP-Server vectors - ML-DSA-keyGen/sigGen/sigVer-FIPS204

SLH-DSA (FIPS 205)

The official FIPS 205 specification and ACVP test vectors are available from NIST:

• NIST-FIPS-205.md - Local reference with algorithm details
• SLH-DSA-vectors.md - Test vector documentation (NIST ACVP)
• NIST FIPS 205 - Stateless Hash-Based Digital Signature Standard
• NIST ACVP-Server vectors - SLH-DSA-keyGen/sigGen/sigVer-FIPS205

File Organization

specs/
├── README.md              # This file
├── toc.yml                # DocFX table of contents
├── NIST-FIPS-180-4.md     # NIST FIPS 180-4 - SHA-1, SHA-2 reference
├── NIST-FIPS-197.md       # NIST FIPS 197 - AES reference
├── NIST-FIPS-202.md       # NIST FIPS 202 - SHA-3, SHAKE reference
├── NIST-SP-800-185.md     # NIST SP 800-185 - cSHAKE, KMAC reference
├── RFC-2104.md            # RFC 2104 - HMAC reference
├── NIST-SP-800-38B.md     # NIST SP 800-38B - CMAC, GMAC reference
├── NIST-SP-800-232.md     # NIST SP 800-232 - Ascon hash and XOF reference
├── SHA1-vectors.md        # SHA-1 test vectors (legacy)
├── SHA2-vectors.md        # SHA-2 family test vectors
├── SHA3-vectors.md        # SHA-3 family test vectors
├── SHAKE-vectors.md       # SHAKE128, SHAKE256 test vectors
├── Keccak-vectors.md      # Keccak-256, Keccak-384, Keccak-512 test vectors
├── KT-vectors.md          # KT128, KT256 (KangarooTwelve) test vectors
├── TurboSHAKE-vectors.md  # TurboSHAKE128, TurboSHAKE256 test vectors
├── BLAKE2-vectors.md      # BLAKE2b, BLAKE2s test vectors
├── BLAKE3-vectors.md      # BLAKE3 test vectors
├── RIPEMD-160-vectors.md  # RIPEMD-160 test vectors
├── SM3-vectors.md         # SM3 test vectors
├── Whirlpool-vectors.md   # Whirlpool test vectors
├── Streebog-vectors.md    # Streebog (GOST) test vectors
├── Kupyna-vectors.md      # Kupyna (DSTU 7564) test vectors
├── LSH-vectors.md         # LSH (KS X 3262) test vectors
├── MD5-vectors.md         # MD5 test vectors (legacy)
├── HMAC-vectors.md        # HMAC-SHA-256/384/512 test vectors (RFC 4231)
├── CMAC-vectors.md        # AES-CMAC test vectors (SP 800-38B)
├── ParallelHash-vectors.md # ParallelHash128/256 test vectors (SP 800-185)
├── AES-vectors.md         # AES ECB/GCM/CCM test vectors
├── ChaCha20-vectors.md    # ChaCha20, Poly1305, ChaCha20-Poly1305 test vectors
├── XChaCha20-vectors.md   # XChaCha20-Poly1305 test vectors
├── NIST-FIPS-203.md       # NIST FIPS 203 - ML-KEM reference
├── ML-KEM-vectors.md      # ML-KEM test vectors (NIST ACVP)
├── NIST-FIPS-204.md       # NIST FIPS 204 - ML-DSA reference
├── ML-DSA-vectors.md      # ML-DSA test vectors (NIST ACVP)
├── NIST-FIPS-205.md       # NIST FIPS 205 - SLH-DSA reference
└── SLH-DSA-vectors.md     # SLH-DSA test vectors (NIST ACVP)

Usage

These test vectors are used by the unit tests in tests/Security/Cryptography/ to verify the correctness of our implementations against known good values from official sources.

License

The test vectors themselves are derived from public standards and specifications. See individual specification documents for their respective terms.