Standards
Who actually writes the standards
Every algorithm and protocol in this catalog traces back to a specific document from a specific standards body. These pages cover the bodies themselves — how each one actually works, what it's published, and where to find the real reference.
Almost every algorithm in this catalog traces back to a NIST publication. Here's what NIST actually is, how it picks a winner, and the full list of what it's standardized.
22 minThe IETF: RFCs and the protocols the internet actually runsTLS, JWT, PKIX certificates, SSH — every protocol module on this site cites an RFC. Here's how the IETF actually produces them, and what "RFC" does and doesn't guarantee.
20 minISO/IEC: the paywalled standards behind ISMS certification and algorithm testingA federation of national standards bodies, not a single organization — and the source of both ISO/IEC 27001 certification and the international equivalent of NIST's own algorithm standards.
20 minOASIS: where the identity and PKI-token standards actually get writtenSAML, PKCS#11, and KMIP all live here — a member-driven consortium, not a government body, that ended up stewarding some of the most load-bearing identity and key-management specs in production today.
18 minEMVCo & PCI SSC: the industry bodies behind chip cards, CVVs, and complianceNeither a government agency nor an open consortium: EMVCo is owned outright by the card networks, and PCI SSC enforces compliance rather than publishing algorithms. Here's how chip, PIN, CVV, and 3DS specs actually get made — and why some of the math behind them is deliberately never published at all.
19 min