Key types supported by language
Stay organized with collections
Save and categorize content based on your preferences.
The following tables list the key types each primitive
supports, classified by language.
AEAD
Implementation |
Java |
C++ (BoringSSL) |
C++ (OpenSSL) |
Objective-C |
Go |
Python |
AES-GCM |
yes1 |
yes |
yes |
yes |
yes |
yes |
AES-GCM-SIV |
yes2 |
yes |
no |
no |
yes |
yes |
AES-CTR-HMAC |
yes |
yes |
yes |
yes |
yes |
yes |
AES-EAX |
yes |
yes |
yes |
yes |
no |
yes |
KMS Envelope |
yes |
yes |
yes |
no |
yes |
yes |
CHACHA20-POLY1305 |
yes |
no |
no |
no |
yes |
no |
XCHACHA20-POLY1305 |
yes |
yes |
no |
yes |
yes |
yes |
Streaming AEAD
Implementation |
Java |
C++ (BoringSSL) |
C++ (OpenSSL) |
Objective-C |
Go |
Python |
AES-GCM-HKDF-STREAMING |
yes |
yes |
yes |
no |
yes |
yes |
AES-CTR-HMAC-STREAMING |
yes |
yes |
yes |
no |
yes |
yes |
Deterministic AEAD
Implementation |
Java |
C++ (BoringSSL) |
C++ (OpenSSL) |
Objective-C |
Go |
Python |
AES-SIV |
yes |
yes |
yes |
yes |
yes |
yes |
MAC
Implementation |
Java |
C++ (BoringSSL) |
C++ (OpenSSL) |
Objective-C |
Go |
Python |
HMAC-SHA2 |
yes |
yes |
yes |
yes |
yes |
yes |
AES-CMAC |
yes |
yes |
yes |
yes |
yes |
yes |
PRF
Implementation |
Java |
C++ (BoringSSL) |
C++ (OpenSSL) |
Objective-C |
Go |
Python |
HKDF-SHA2 |
yes |
yes |
yes |
no |
yes |
yes |
HMAC-SHA2 |
yes |
yes |
yes |
no |
yes |
yes |
AES-CMAC |
yes |
yes |
yes |
no |
yes |
yes |
Signature
Implementation |
Java |
C++ (BoringSSL) |
C++ (OpenSSL) |
Objective-C |
Go |
Python |
ECDSA over NIST curves |
yes |
yes |
yes |
yes |
yes |
yes |
Ed25519 |
yes |
yes |
yes |
yes |
yes |
yes |
RSA-SSA-PKCS1 |
yes |
yes |
yes |
yes |
yes |
yes |
RSA-SSA-PSS |
yes |
yes |
yes |
yes |
yes |
yes |
Hybrid Encryption
Implementation |
Java |
C++ (BoringSSL) |
C++ (OpenSSL) |
Objective-C |
Go |
Python |
HPKE |
yes |
yes |
no |
no |
yes |
yes |
ECIES with AEAD and HKDF |
yes3 |
yes |
yes |
yes |
yes |
yes |
ECIES with DeterministicAEAD and HKDF |
yes4 |
yes |
yes |
no |
yes |
yes |
JWT MAC
Implementation |
Java |
C++ (BoringSSL) |
C++ (OpenSSL) |
Objective-C |
Go |
Python |
JWT HMAC-SHA2 |
yes |
yes |
yes |
no |
yes |
yes |
JWT Signature
Implementation |
Java |
C++ (BoringSSL) |
C++ (OpenSSL) |
Objective-C |
Go |
Python |
JWT ECDSA over NIST curves |
yes |
yes |
yes |
no |
yes |
yes |
JWT RSA-SSA-PKCS1 |
yes |
yes |
yes |
no |
yes |
yes |
JWT RSA-SSA-PSS |
yes |
yes |
yes |
no |
yes |
yes |
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2024-11-14 UTC.
[null,null,["Last updated 2024-11-14 UTC."],[[["\u003cp\u003eThe tables provide a comprehensive overview of the cryptographic primitives supported by Tink across various programming languages, including Java, C++, Objective-C, Go, and Python.\u003c/p\u003e\n"],["\u003cp\u003eSupport for specific primitives can vary depending on the chosen language and underlying cryptographic library (e.g., BoringSSL, OpenSSL).\u003c/p\u003e\n"],["\u003cp\u003eTink offers a wide range of cryptographic capabilities, encompassing AEAD, Streaming AEAD, Deterministic AEAD, MAC, PRF, Signatures, Hybrid Encryption, and JWT support.\u003c/p\u003e\n"],["\u003cp\u003eWhile most primitives are widely supported, some exceptions exist, such as limited AES-GCM functionality on older Android versions and the need for Conscrypt for AES-GCM-SIV in Java.\u003c/p\u003e\n"],["\u003cp\u003eDevelopers should consult the tables to ensure their target language and platform support the required cryptographic primitives for their specific use case.\u003c/p\u003e\n"]]],["The content outlines the supported cryptographic primitives across different programming languages, including Java, C++, Objective-C, Go, and Python. Key actions involve identifying language support for AEAD (AES-GCM, AES-GCM-SIV, etc.), Streaming AEAD, Deterministic AEAD, MAC (HMAC-SHA2, AES-CMAC), PRF, Signature (ECDSA, Ed25519, RSA), Hybrid Encryption, JWT MAC, and JWT Signature. Each table indicates whether a specific implementation is supported (\"yes\") or not (\"no\") within each language's Tink library.\n"],null,["# Key types supported by language\n\nThe following tables list the key types each [primitive](/tink/primitives-by-language)\nsupports, classified by language.\n\nAEAD\n----\n\n| Implementation | Java | C++ (BoringSSL) | C++ (OpenSSL) | Objective-C | Go | Python |\n|--------------------|----------------|-----------------|---------------|-------------|--------|--------|\n| AES-GCM | yes^[1](#fn1)^ | yes | yes | yes | yes | yes |\n| AES-GCM-SIV | yes^[2](#fn2)^ | yes | **no** | **no** | yes | yes |\n| AES-CTR-HMAC | yes | yes | yes | yes | yes | yes |\n| AES-EAX | yes | yes | yes | yes | **no** | yes |\n| KMS Envelope | yes | yes | yes | **no** | yes | yes |\n| CHACHA20-POLY1305 | yes | **no** | **no** | **no** | yes | **no** |\n| XCHACHA20-POLY1305 | yes | yes | **no** | yes | yes | yes |\n\nStreaming AEAD\n--------------\n\n| Implementation | Java | C++ (BoringSSL) | C++ (OpenSSL) | Objective-C | Go | Python |\n|------------------------|------|-----------------|---------------|-------------|-----|--------|\n| AES-GCM-HKDF-STREAMING | yes | yes | yes | **no** | yes | yes |\n| AES-CTR-HMAC-STREAMING | yes | yes | yes | **no** | yes | yes |\n\nDeterministic AEAD\n------------------\n\n| Implementation | Java | C++ (BoringSSL) | C++ (OpenSSL) | Objective-C | Go | Python |\n|----------------|------|-----------------|---------------|-------------|-----|--------|\n| AES-SIV | yes | yes | yes | yes | yes | yes |\n\nMAC\n---\n\n| Implementation | Java | C++ (BoringSSL) | C++ (OpenSSL) | Objective-C | Go | Python |\n|----------------|------|-----------------|---------------|-------------|-----|--------|\n| HMAC-SHA2 | yes | yes | yes | yes | yes | yes |\n| AES-CMAC | yes | yes | yes | yes | yes | yes |\n\nPRF\n---\n\n| Implementation | Java | C++ (BoringSSL) | C++ (OpenSSL) | Objective-C | Go | Python |\n|----------------|------|-----------------|---------------|-------------|-----|--------|\n| HKDF-SHA2 | yes | yes | yes | **no** | yes | yes |\n| HMAC-SHA2 | yes | yes | yes | **no** | yes | yes |\n| AES-CMAC | yes | yes | yes | **no** | yes | yes |\n\nSignature\n---------\n\n| Implementation | Java | C++ (BoringSSL) | C++ (OpenSSL) | Objective-C | Go | Python |\n|------------------------|------|-----------------|---------------|-------------|-----|--------|\n| ECDSA over NIST curves | yes | yes | yes | yes | yes | yes |\n| Ed25519 | yes | yes | yes | yes | yes | yes |\n| RSA-SSA-PKCS1 | yes | yes | yes | yes | yes | yes |\n| RSA-SSA-PSS | yes | yes | yes | yes | yes | yes |\n\nHybrid Encryption\n-----------------\n\n| Implementation | Java | C++ (BoringSSL) | C++ (OpenSSL) | Objective-C | Go | Python |\n|---------------------------------------|----------------|-----------------|---------------|-------------|-----|--------|\n| HPKE | yes | yes | **no** | **no** | yes | yes |\n| ECIES with AEAD and HKDF | yes^[3](#fn3)^ | yes | yes | yes | yes | yes |\n| ECIES with DeterministicAEAD and HKDF | yes^[4](#fn4)^ | yes | yes | **no** | yes | yes |\n\nJWT MAC\n-------\n\n| Implementation | Java | C++ (BoringSSL) | C++ (OpenSSL) | Objective-C | Go | Python |\n|----------------|------|-----------------|---------------|-------------|-----|--------|\n| JWT HMAC-SHA2 | yes | yes | yes | **no** | yes | yes |\n\nJWT Signature\n-------------\n\n| Implementation | Java | C++ (BoringSSL) | C++ (OpenSSL) | Objective-C | Go | Python |\n|----------------------------|------|-----------------|---------------|-------------|-----|--------|\n| JWT ECDSA over NIST curves | yes | yes | yes | **no** | yes | yes |\n| JWT RSA-SSA-PKCS1 | yes | yes | yes | **no** | yes | yes |\n| JWT RSA-SSA-PSS | yes | yes | yes | **no** | yes | yes |\n\n*** ** * ** ***\n\n1. AES-GCM does not work [properly](/tink/issues/aes_gcm_android_19) on Android \\\u003c=19. [↩](#fnref1)\n\n2. Requires Conscrypt to be installed as a JCE security provider. [↩](#fnref2)\n\n3. Requires a NIST curve. [↩](#fnref3)\n\n4. Requires a NIST curve. [↩](#fnref4)"]]