Table of Contents

Cryptographic Test Vectors

This folder contains test vectors for the hash, MAC and cipher algorithms in this package, from official sources.

Implementation Status

FIPS 180-4 (Secure Hash Standard)

Algorithm Hash Size Status Class
SHA-1 160 bits ✅ SHA1
SHA-224 224 bits ✅ SHA224
SHA-256 256 bits ✅ SHA256
SHA-384 384 bits ✅ SHA384
SHA-512 512 bits ✅ SHA512
SHA-512/224 224 bits ✅ SHA512_224
SHA-512/256 256 bits ✅ SHA512_256

FIPS 202 (SHA-3 Standard)

Algorithm Hash Size Status Class
SHA3-224 224 bits ✅ SHA3_224
SHA3-256 256 bits ✅ SHA3_256
SHA3-384 384 bits ✅ SHA3_384
SHA3-512 512 bits ✅ SHA3_512
SHAKE128 Variable ✅ Shake128
SHAKE256 Variable ✅ Shake256

NIST SP 800-185 (SHA-3 Derived Functions)

Algorithm Security Status Class
cSHAKE128 128 bits ✅ CShake128
cSHAKE256 256 bits ✅ CShake256
KMAC128 128 bits ✅ KMac128
KMAC256 256 bits ✅ KMac256
ParallelHash128 128 bits ✅ ParallelHash, IncrementalParallelHash
ParallelHash256 256 bits ✅ ParallelHash, IncrementalParallelHash
TupleHash128 128 bits ⬜ -
TupleHash256 256 bits ⬜ -

ParallelHash: one-shot via ParallelHash.ComputeHash128/ComputeHash256, streaming via IncrementalParallelHash. Test vectors: ParallelHash-vectors.md.

RFC 9861 (TurboSHAKE and KangarooTwelve)

Algorithm Security Status Class
TurboSHAKE128 128 bits ✅ TurboShake128
TurboSHAKE256 256 bits ✅ TurboShake256
KT128 128 bits ✅ KT128
KT256 256 bits ✅ KT256

Note: KT128 and KT256 (formerly KangarooTwelve and MarsupilamiFourteen) are defined in RFC 9861. They use reduced-round Keccak (12 rounds) for ~2× faster performance than SHAKE.

NIST SP 800-232 (Ascon Lightweight Cryptography)

Algorithm Hash Size Status Class
Ascon-Hash256 256 bits ✅ AsconHash256
Ascon-XOF128 Variable ✅ AsconXof128

Note: Ascon was selected as the NIST Lightweight Cryptography standard in 2023 and published as SP 800-232. See NIST-SP-800-232.md. It is designed for constrained environments (IoT, embedded systems).

Keccak (Original Algorithm)

Algorithm Hash Size Status Class
Keccak-256 256 bits ✅ Keccak256
Keccak-384 384 bits ✅ Keccak384
Keccak-512 512 bits ✅ Keccak512

Note: Keccak uses the original Keccak padding (0x01) as used in Ethereum. SHA-3 uses different padding (0x06). Use SHA3_256 for NIST SHA-3 compliance.

RFC 7693 (BLAKE2)

Algorithm Hash Size Features Status Class
BLAKE2b 1-64 bytes Hash, Keyed (MAC) ✅ Blake2b
BLAKE2s 1-32 bytes Hash, Keyed (MAC) ✅ Blake2s

BLAKE2 Features

Feature BLAKE2b BLAKE2s Description
Variable output ✅ ✅ Output size 1-64 bytes (b) or 1-32 bytes (s)
Keyed hashing (MAC) ✅ ✅ Built-in MAC mode with key up to 64/32 bytes
Salt ❌ ❌ Optional (not implemented)
Personalization ❌ ❌ Optional (not implemented)
Tree hashing ❌ ❌ Optional (not implemented)
Parallel variants ❌ ❌ BLAKE2bp/BLAKE2sp (not implemented)

Hardware acceleration: BLAKE2b uses an AVX2 kernel and BLAKE2s an SSSE3 one with an SSE2 fallback, both on .NET 8+, and both take AVX-512 VL rotates where the CPU offers them. A portable scalar kernel is always available.

BLAKE3

Algorithm Hash Size Features Status Class
BLAKE3 Variable Hash, Keyed, Derive Key ✅ Blake3

BLAKE3 Modes

Mode Status Factory Method Description
Hash ✅ Blake3.Create() Standard cryptographic hashing
Keyed Hash ✅ Blake3.CreateKeyed(key) MAC with 32-byte key
Derive Key ✅ Blake3.CreateDeriveKey(context) Key derivation from a context string and key material
XOF ✅ Blake3.Create(outputBytes) Extendable output (any length)

Hardware acceleration: on .NET 8+, AVX-512 hashes 16 chunks in parallel, AVX2 8, and SSSE3 and NEON 4 each, with narrower kernels for inputs too small to fill one, and a scalar fallback.

RIPEMD Family

Algorithm Hash Size Status Class
RIPEMD-160 160 bits ✅ Ripemd160

Note: RIPEMD-160 is widely used in cryptocurrency systems (Bitcoin address generation).

SM3 (Chinese National Standard)

Algorithm Hash Size Status Class
SM3 256 bits ✅ SM3

Standard: GB/T 32905-2016 (China), ISO/IEC 10118-3:2018

Whirlpool (ISO/IEC 10118-3)

Algorithm Hash Size Status Class
Whirlpool 512 bits ✅ Whirlpool

Standard: ISO/IEC 10118-3:2004, NESSIE recommended

Streebog / GOST R 34.11-2012 (Russian National Standard)

Algorithm Hash Size Status Class
Streebog-256 256 bits ✅ Streebog
Streebog-512 512 bits ✅ Streebog

Standard: GOST R 34.11-2012, RFC 6986

Kupyna / DSTU 7564:2014 (Ukrainian National Standard)

Algorithm Hash Size Status Class
Kupyna-256 256 bits ✅ Kupyna
Kupyna-384 384 bits ✅ Kupyna
Kupyna-512 512 bits ✅ Kupyna

Standard: DSTU 7564:2014 (Ukraine)

LSH / KS X 3262 (Korean National Standard)

Algorithm Hash Size Status Class
LSH-256-224 224 bits ✅ Lsh256
LSH-256-256 256 bits ✅ Lsh256
LSH-512-256 256 bits ✅ Lsh512
LSH-512-384 384 bits ✅ Lsh512
LSH-512-512 512 bits ✅ Lsh512

Standard: KS X 3262 (South Korea), approved by KCMVP

Legacy Algorithms

Algorithm Hash Size Status Class
MD5 128 bits ✅ (deprecated) MD5

Warning: MD5 is cryptographically broken and should NOT be used for security purposes. It is provided only for legacy compatibility and non-cryptographic uses.

MAC Algorithms

RFC 2104 / FIPS 198-1 (HMAC)

Algorithm Hash MAC Size Status Class
HMAC-SHA-256 SHA-256 32 bytes ✅ HmacSha256
HMAC-SHA-384 SHA-384 48 bytes ✅ HmacSha384
HMAC-SHA-512 SHA-512 64 bytes ✅ HmacSha512
HMAC-SHA3-256 SHA3-256 32 bytes ✅ HmacSha3_256
HMAC-SHA3-384 SHA3-384 48 bytes ✅ HmacSha3_384
HMAC-SHA3-512 SHA3-512 64 bytes ✅ HmacSha3_512
HMAC-SHA-1 SHA-1 20 bytes ✅ (legacy) HmacSha1
HMAC-MD5 MD5 16 bytes ✅ (legacy) HmacMd5

Note: The HmacCore base class works with any HashAlgorithm, so custom HMAC variants (HMAC-SM3, HMAC-Kupyna, etc.) can be created by subclassing.

SP 800-38B (AES-CMAC)

Algorithm Key Size MAC Size Status Class
AES-128-CMAC 128 bits 128 bits ✅ AesCmac
AES-192-CMAC 192 bits 128 bits ✅ AesCmac
AES-256-CMAC 256 bits 128 bits ✅ AesCmac

Hardware acceleration: AES-NI on .NET 8+. Note: .NET does not provide a portable CMAC implementation.

SP 800-38D (AES-GMAC)

Algorithm Key Size MAC Size Status Class
AES-128-GMAC 128 bits 128 bits ✅ AesGmac
AES-192-GMAC 192 bits 128 bits ✅ AesGmac
AES-256-GMAC 256 bits 128 bits ✅ AesGmac

Hardware acceleration: AES-NI + PCLMULQDQ on .NET 8+, VPCLMULQDQ on .NET 10+. Note: GMAC requires a unique nonce per invocation. .NET does not provide a standalone GMAC class.

Cipher Algorithms

FIPS 197 (Advanced Encryption Standard)

Algorithm Key Size Mode Status Class
AES-128 128 bits ECB/CBC/CTR/OFB/CFB/CTS ✅ Aes128
AES-192 192 bits ECB/CBC/CTR/OFB/CFB/CTS ✅ Aes192
AES-256 256 bits ECB/CBC/CTR/OFB/CFB/CTS ✅ Aes256

Hardware acceleration: AES-NI (AESENC/AESDEC) on .NET 8+. CBC decrypt uses 8-block interleaving. OFB, CFB and CTS are implemented for interoperability; new designs should use an AEAD mode (GCM, CCM) or CTR.

SP 800-38D (AES-GCM)

Algorithm Key Size Status Class
AES-128-GCM 128 bits ✅ AesGcm128
AES-192-GCM 192 bits ✅ AesGcm192
AES-256-GCM 256 bits ✅ AesGcm256

Hardware acceleration: AES-NI + PCLMULQDQ (.NET 8+), VPCLMULQDQ (.NET 10+). Uses 8-block stitched AES+GHASH pipeline with lagged carry-less multiplication and SymCrypt-style 2-CLMUL modular reduction.

RFC 3610 (AES-CCM)

Algorithm Key Size Status Class
AES-128-CCM 128 bits ✅ AesCcm128
AES-192-CCM 192 bits ✅ AesCcm192
AES-256-CCM 256 bits ✅ AesCcm256

Hardware acceleration: AES-NI on .NET 8+ for CTR and CBC-MAC block operations.

RFC 8439 (ChaCha20 / ChaCha20-Poly1305)

Algorithm Key Size Status Class
ChaCha20 256 bits ✅ ChaCha20
Poly1305 256 bits ✅ Poly1305Mac
ChaCha20-Poly1305 256 bits ✅ ChaCha20Poly1305

Hardware acceleration: SSSE3 (single-block) and AVX2 (dual-block) on .NET 8+. Poly1305 uses donna-64 (3×44-bit limbs) on .NET 8+, donna-32 (5×26-bit limbs) on older targets.

draft-irtf-cfrg-xchacha (XChaCha20-Poly1305)

Algorithm Key Size Nonce Size Status Class
XChaCha20-Poly1305 256 bits 192 bits ✅ XChaCha20Poly1305

Note: XChaCha20-Poly1305 extends ChaCha20-Poly1305 with a 24-byte nonce (vs 12-byte), making random nonce generation safe for a practically unlimited number of messages. There is no standalone XChaCha20 stream cipher — only the AEAD construction.

NIST SP 800-232 (Ascon-AEAD128)

Algorithm Key Size Nonce Size Status Class
Ascon-AEAD128 128 bits 128 bits ✅ AsconAead128

Regional Block Ciphers

Algorithm Key Size Block Size Mode Standard Status Class
SM4 128 bits 128 bits ECB/CBC/CTR/OFB/CFB/CTS GB/T 32907-2016 (China) ✅ Sm4
ARIA-128 128 bits 128 bits ECB/CBC/CTR/OFB/CFB/CTS RFC 5794 (Korea) ✅ Aria128
ARIA-192 192 bits 128 bits ECB/CBC/CTR/OFB/CFB/CTS RFC 5794 (Korea) ✅ Aria192
ARIA-256 256 bits 128 bits ECB/CBC/CTR/OFB/CFB/CTS RFC 5794 (Korea) ✅ Aria256
SEED 128 bits 128 bits ECB/CBC/CTR/OFB/CFB/CTS RFC 4269 (Korea) ✅ Seed
Camellia-128 128 bits 128 bits ECB/CBC/CTR/OFB/CFB/CTS RFC 3713 (Japan) ✅ Camellia128
Camellia-192 192 bits 128 bits ECB/CBC/CTR/OFB/CFB/CTS RFC 3713 (Japan) ✅ Camellia192
Camellia-256 256 bits 128 bits ECB/CBC/CTR/OFB/CFB/CTS RFC 3713 (Japan) ✅ Camellia256
Kuznyechik 256 bits 128 bits ECB/CBC/CTR/OFB/CFB/CTS GOST R 34.12-2015 (Russia) ✅ Kuznyechik
Kalyna-128/128 128 bits 128 bits ECB/CBC/CTR/OFB/CFB/CTS DSTU 7624:2014 (Ukraine) ✅ Kalyna128
Kalyna-128/256 256 bits 128 bits ECB/CBC/CTR/OFB/CFB/CTS DSTU 7624:2014 (Ukraine) ✅ Kalyna256
Kalyna-256/256, -256/512 256/512 bits 256 bits ECB/CBC/CTR/OFB/CFB/CTS DSTU 7624:2014 (Ukraine) ✅ Kalyna512

Modes: every block cipher here supports ECB (testing only), CBC and CTR, plus OFB, CFB and CTS (CBC-CS3) for interoperability. Kalyna's 512-bit block variant, and the GCM/CCM/XTS/MGM modes the regional standards define, are not implemented.

Key Derivation Functions

Algorithm Standard Status Class
HKDF RFC 5869 ✅ Hkdf
KBKDF NIST SP 800-108 ✅ Kbkdf
Concat KDF NIST SP 800-56A ✅ ConcatKdf
PBKDF2 RFC 8018 / NIST SP 800-132 ✅ Pbkdf2

Key Encapsulation Mechanisms (KEM)

FIPS 203 (Module-Lattice-Based Key-Encapsulation Mechanism)

Algorithm Security Category Status Class
ML-KEM-512 1 (~AES-128) ✅ MLKem512, MLKem
ML-KEM-768 3 (~AES-192) ✅ MLKem768, MLKem
ML-KEM-1024 5 (~AES-256) ✅ MLKem1024, MLKem

Note: Validated against official NIST ACVP vectors (key generation, encapsulation, decapsulation including implicit rejection, and the FIPS 203 §7.2/§7.3 key checks) and cross-checked against BouncyCastle and .NET 10 System.Security.Cryptography.MLKem. The MLKem key-holding class mirrors the .NET 10 API shape on all target frameworks.

Digital Signature Algorithms

FIPS 204 (Module-Lattice-Based Digital Signature Algorithm)

Algorithm Security Category Status Class
ML-DSA-44 2 ✅ MLDsa44, MLDsa
ML-DSA-65 3 ✅ MLDsa65, MLDsa
ML-DSA-87 5 ✅ MLDsa87, MLDsa
HashML-DSA (pre-hash) - ✅ MLDsa.SignPreHash/VerifyPreHash

Note: Validated against official NIST ACVP vectors (key generation, deterministic and hedged signing with byte-exact signatures, and verification including modified commitment/z/hint/message rejections) and cross-checked against BouncyCastle and .NET 10 System.Security.Cryptography.MLDsa. The MLDsa key-holding class mirrors the .NET 10 API shape on all target frameworks.

Digital Signature Algorithms

FIPS 205 (Stateless Hash-Based Digital Signature Algorithm)

Algorithm Security Category Status Class
SLH-DSA-{SHA2,SHAKE}-128{s,f} 1 ✅ SlhDsa + SlhDsaAlgorithm
SLH-DSA-{SHA2,SHAKE}-192{s,f} 3 ✅ SlhDsa + SlhDsaAlgorithm
SLH-DSA-{SHA2,SHAKE}-256{s,f} 5 ✅ SlhDsa + SlhDsaAlgorithm
HashSLH-DSA (pre-hash) - ✅ SlhDsa.SignPreHash/VerifyPreHash

Note: Validated against official NIST ACVP vectors (key generation for all 12 parameter sets, deterministic and hedged signing with byte-exact signatures, and verification including modified R/SIGFORS/SIGHT/message and wrong-length rejections) and cross-checked against BouncyCastle and .NET 10 System.Security.Cryptography.SlhDsa.

Sources

NIST (National Institute of Standards and Technology)

Official test vectors and examples with intermediate values are available from:

SHA-1 and SHA-2 Family (FIPS 180-4)

The official FIPS 180-4 specification is available from NIST:

  • NIST-FIPS-180-4.md - Local reference with algorithm details and test vectors
  • NIST FIPS 180-4 - Secure Hash Standard (SHS): SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256
SHA-1 (Legacy Only)
SHA-2 Family

SHA-3 and SHAKE (FIPS 202)

The official FIPS 202 specification is available from NIST:

  • NIST-FIPS-202.md - Local reference with algorithm details and test vectors
  • NIST FIPS 202 - SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions
Algorithm 0-bit 5-bit 30-bit 1600-bit 1605-bit 1630-bit
SHA3-224 Msg0 Msg5 Msg30 1600 1605 1630
SHA3-256 Msg0 Msg5 Msg30 1600 1605 1630
SHA3-384 Msg0 Msg5 Msg30 1600 1605 1630
SHA3-512 Msg0 Msg5 Msg30 1600 1605 1630

SHAKE XOF (FIPS 202)

Algorithm 0-bit 5-bit 30-bit 1600-bit 1605-bit 1630-bit
SHAKE128 Msg0 Msg5 Msg30 1600 1605 1630
SHAKE256 Msg0 Msg5 Msg30 1600 1605 1630

NIST SP 800-185 (SHA-3 Derived Functions)

Reference documentation for cSHAKE, KMAC, TupleHash, and ParallelHash:

HMAC (RFC 2104 / FIPS 198-1)

  • RFC-2104.md - Local reference with algorithm details
  • RFC 2104 - HMAC: Keyed-Hashing for Message Authentication
  • RFC 4231 - Test Vectors for HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
  • FIPS 198-1 - The Keyed-Hash Message Authentication Code (HMAC)

AES-CMAC (SP 800-38B / RFC 4493)

BLAKE2 (RFC 7693)

The official RFC 7693 specification is available from IETF:

  • RFC 7693 - The BLAKE2 Cryptographic Hash and Message Authentication Code (MAC)

Additional BLAKE2 resources:

BLAKE3

BLAKE3 test vectors are from the official BLAKE3 specification:

RIPEMD-160

SM3 (GB/T 32905-2016)

  • SM3-vectors.md - Test vectors
  • GB/T 32905-2016 (Chinese national standard)
  • ISO/IEC 10118-3:2018

Whirlpool

Streebog (GOST R 34.11-2012)

Kupyna (DSTU 7564:2014)

LSH (KS X 3262)

MD5 (RFC 1321)

MD5 is defined in RFC 1321:

AES (FIPS 197)

The official FIPS 197 specification is available from NIST:

AES-GCM (SP 800-38D)

  • NIST SP 800-38D - Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM)

AES-CCM (RFC 3610)

ChaCha20 / ChaCha20-Poly1305 (RFC 8439)

  • RFC 8439 - ChaCha20 and Poly1305 for IETF Protocols

XChaCha20-Poly1305 (draft-irtf-cfrg-xchacha)

ML-KEM (FIPS 203)

The official FIPS 203 specification and ACVP test vectors are available from NIST:

ML-DSA (FIPS 204)

The official FIPS 204 specification and ACVP test vectors are available from NIST:

SLH-DSA (FIPS 205)

The official FIPS 205 specification and ACVP test vectors are available from NIST:

File Organization

specs/
├── README.md              # This file
├── toc.yml                # DocFX table of contents
├── NIST-FIPS-180-4.md     # NIST FIPS 180-4 - SHA-1, SHA-2 reference
├── NIST-FIPS-197.md       # NIST FIPS 197 - AES reference
├── NIST-FIPS-202.md       # NIST FIPS 202 - SHA-3, SHAKE reference
├── NIST-SP-800-185.md     # NIST SP 800-185 - cSHAKE, KMAC reference
├── RFC-2104.md            # RFC 2104 - HMAC reference
├── NIST-SP-800-38B.md     # NIST SP 800-38B - CMAC, GMAC reference
├── NIST-SP-800-232.md     # NIST SP 800-232 - Ascon hash and XOF reference
├── SHA1-vectors.md        # SHA-1 test vectors (legacy)
├── SHA2-vectors.md        # SHA-2 family test vectors
├── SHA3-vectors.md        # SHA-3 family test vectors
├── SHAKE-vectors.md       # SHAKE128, SHAKE256 test vectors
├── Keccak-vectors.md      # Keccak-256, Keccak-384, Keccak-512 test vectors
├── KT-vectors.md          # KT128, KT256 (KangarooTwelve) test vectors
├── TurboSHAKE-vectors.md  # TurboSHAKE128, TurboSHAKE256 test vectors
├── BLAKE2-vectors.md      # BLAKE2b, BLAKE2s test vectors
├── BLAKE3-vectors.md      # BLAKE3 test vectors
├── RIPEMD-160-vectors.md  # RIPEMD-160 test vectors
├── SM3-vectors.md         # SM3 test vectors
├── Whirlpool-vectors.md   # Whirlpool test vectors
├── Streebog-vectors.md    # Streebog (GOST) test vectors
├── Kupyna-vectors.md      # Kupyna (DSTU 7564) test vectors
├── LSH-vectors.md         # LSH (KS X 3262) test vectors
├── MD5-vectors.md         # MD5 test vectors (legacy)
├── HMAC-vectors.md        # HMAC-SHA-256/384/512 test vectors (RFC 4231)
├── CMAC-vectors.md        # AES-CMAC test vectors (SP 800-38B)
├── ParallelHash-vectors.md # ParallelHash128/256 test vectors (SP 800-185)
├── AES-vectors.md         # AES ECB/GCM/CCM test vectors
├── ChaCha20-vectors.md    # ChaCha20, Poly1305, ChaCha20-Poly1305 test vectors
├── XChaCha20-vectors.md   # XChaCha20-Poly1305 test vectors
├── NIST-FIPS-203.md       # NIST FIPS 203 - ML-KEM reference
├── ML-KEM-vectors.md      # ML-KEM test vectors (NIST ACVP)
├── NIST-FIPS-204.md       # NIST FIPS 204 - ML-DSA reference
├── ML-DSA-vectors.md      # ML-DSA test vectors (NIST ACVP)
├── NIST-FIPS-205.md       # NIST FIPS 205 - SLH-DSA reference
└── SLH-DSA-vectors.md     # SLH-DSA test vectors (NIST ACVP)

Usage

These test vectors are used by the unit tests in tests/Security/Cryptography/ to verify the correctness of our implementations against known good values from official sources.

License

The test vectors themselves are derived from public standards and specifications. See individual specification documents for their respective terms.

Edit this page