Cheat sheets / Crypto algorithms (32BRAIDS / DEERQ)

Crypto algorithms (32BRAIDS / DEERQ)

Hash, symmetric, and asymmetric algorithms on one colored page with key sizes, what's obsolete, and the two memory strings from class.

The two memory strings

Mnemonic	Spells out	Type
3 2 B R A I D S	3DES · 2(Two)fish · Blowfish · RC (RC4 stream / RC5 / RC6) · AES · IDEA · DES · Serpent	Symmetric — one shared key, fast, bulk data
D E E R Q	Diffie-Hellman · Elliptic Curve (ECC) · ElGamal · RSA · Quantum (QKD) — plus PKI, PGP, GPG built on them	Asymmetric — public/private pair, slow, keys & signatures
Hashes	MD5 · SHA-1 · SHA-2 · SHA-3 · RIPEMD · HMAC — and password hashes LM, NTLM, PBKDF2, bcrypt, scrypt, Argon2	One-way — integrity, password storage, signatures

How to read a question: "same key both ways / large file / VPN bulk traffic" → pick something from 32BRAIDS. "key exchange / certificate / signature / public key" → pick from DEERQ. "verify not modified / store password" → a hash.

Master table

Algorithm	Hash	Sym	Asym	Key / output size	Notes	Status
MD5	✔			128-bit digest	Message Digest 5 — collisions found	✖ obsolete
SHA-1	✔			160-bit digest	Many collision attacks; still seen in old certs	✖ obsolete
SHA-2 (SHA-256/384/512)	✔			256 / 384 / 512	The default today (TLS certs, file hashes)	✔ use
SHA-3	✔			224 / 256 / 384 / 512	Keccak, NIST 2015; different construction from SHA-2	✔ use
RIPEMD	✔			128 / 160 / 256 / 320	European alternative (Bitcoin uses RIPEMD-160)	ok
HMAC	✔			= underlying hash	Hash + shared key → integrity and authenticity (not non-repudiation)	✔ use
Poly1305	✔			128-bit tag	MAC paired with ChaCha20 (TLS 1.3 suite)	✔ use
LM (LANMAN)	✔			14 chars → 2 × 7 (DES)	Uppercases, splits in two 7-char halves — trivial to crack	✖ obsolete
NTLM	✔			128-bit (MD4)	Pass-the-hash target; prefer Kerberos	✖ legacy
PBKDF2	✔			configurable iterations	Key stretching with salt (RFC 8018)	✔ use
bcrypt / scrypt / Argon2	✔			configurable cost	Slow-by-design password hashes; Argon2 is the current best	✔ use
DES		✔		56-bit key, 64-bit block	Data Encryption Standard, 1977	✖ obsolete
3DES		✔		112/168-bit, 64-bit block	DES three times; slow; retired 2023	✖ deprecated
AES (Rijndael)		✔		128 / 192 / 256 key, 128-bit block	The standard; modes CBC, GCM (authenticated), CCMP/GCMP in Wi-Fi	✔ use
Blowfish		✔		32–448 key, 64-bit block	Schneier; basis of bcrypt	legacy
Twofish		✔		128 / 192 / 256, 128-bit block	AES finalist, strong but slower	ok
RC4		✔		40–2048 key, stream	Ron's Code — WEP, TKIP/WPA, old SSL; biased keystream	✖ obsolete
RC5 / RC6		✔		up to 2048 / 128–256, block	RC6 was an AES finalist	rare
IDEA		✔		128 key, 64-bit block	Used in early PGP	legacy
Serpent		✔		128 / 192 / 256, 128-bit block	AES finalist, very conservative design	ok
ChaCha20 / Salsa20		✔		256 key, stream	Modern stream cipher; TLS 1.3, WireGuard	✔ use
Diffie-Hellman (DH / DHE / ECDHE)			✔	1024–4096 (DH), 256 (ECDHE)	Key exchange only; ephemeral (DHE/ECDHE) = forward secrecy; used by IPsec IKE and TLS	✔ use (ephemeral)
RSA			✔	2048–4096	Rivest-Shamir-Adleman; two primes; encryption + signatures; slow	✔ use (≥2048)
DSA			✔	1024–3072	Digital Signature Algorithm (ElGamal-based) — signatures only	legacy
ECC / ECDSA			✔	256 ≈ RSA 3072	Small keys, fast — mobile/IoT; ECDSA signs	✔ use
ElGamal			✔	1024+	DH-based encryption; used in GPG	ok
PGP / GPG		✔	✔	hybrid	Generates a symmetric session key, encrypts it with the receiver's public key; web of trust	✔ use
Quantum (QKD)			✔	random	Quantum key distribution detects eavesdropping; post-quantum algorithms (ML-KEM/Kyber) are replacing RSA/ECC long-term	emerging

Stream vs. block ciphers

	Stream	Block
Works on	One bit/byte at a time	Fixed blocks (64/128 bits)
Examples	RC4, ChaCha20/Salsa20	AES, DES/3DES, Blowfish, Twofish, IDEA, Serpent
Good for	Real-time media, wireless (class: "WEP → TKIP → video → online gaming")	Files, disks, databases
Modes	keystream XOR	ECB (never), CBC, CTR, GCM (authenticated)

Quick classification drill

You see…	It is…
AES-256, "same key", "bulk encryption", BitLocker	Symmetric (32BRAIDS)
"certificate", "public key", "key exchange", "sign"	Asymmetric (DEERQ)
"fingerprint", "checksum", "verify not altered", "store passwords"	Hash
"hash + secret key"	HMAC
"hash encrypted with private key"	Digital signature
"asymmetric to share a symmetric key"	Hybrid (TLS, PGP)