Which algorithm should you pick for each cryptographic mechanism if the choice must stay valid until about 2030?
AES (CBC or CTR) for encryption, PRESENT or ASCON for lightweight devices, AES-CMAC/GMAC for MACs, AES-CCM/GCM/GCM-SIV for combined encryption and MAC, HMAC with SHA-2/3, RSA 3072 or ECC 256+ for public-key work, and SHA-2/3 with 256+ bits for signature hashes.
| Mechanism | Recommended algorithm | Key size / remark |
|---|---|---|
| Symmetric encryption | AES in CBC or CTR mode | 256 bits if possible; 128 still OK |
| Legacy symmetric (e.g. ePassport, banking) | 3DES with 3 keys | Allowed until 2030 |
| Lightweight, in hardware | PRESENT | 128 bits (also exists with 80) |
| Lightweight, in software | ASCON | 128/256 bits; also works as a hash; chosen by NIST as its lightweight standard in 2023 |
| MAC from a block cipher | AES-CMAC, GMAC | 256 bits if possible |
| Combined encryption + MAC | AES in CCM, GCM, GCM-SIV | 256 bits if possible |
| HMAC | with SHA-2 or SHA-3 | at least 256 bits |
| Public-key encryption / signature | RSA (or DSA for signatures) | 3072 bits since 2023 |
| Public-key encryption / signature | ECC | at least 256, possibly 384 or 512 bits |
| Hash for signatures | SHA-2, SHA-3 | at least 256 bits (384, 512) |
How to remember it: AES does almost everything symmetric (encrypt, MAC, authenticated encryption), SHA-2/3 does everything hash-based, and the asymmetric side is RSA 3072 or ECC 256. PRESENT and ASCON fill the niche of very constrained devices, in hardware and software respectively. The table follows the German BSI guideline TR-02102 wherever that guideline covers the mechanism.
Go deeper:
Ascon (cipher) (Wikipedia) — the lightweight authenticated cipher and hash selected by NIST.