up:: Foundations MOC

Primitive vs Algorithm vs Protocol

A cryptographic primitive is the raw construction that cryptographers analyze, such as the AES block cipher or the SHA-256 compression function, and on its own it transforms one fixed-size block and nothing more. A cryptographic algorithm or scheme is that primitive wrapped in a construction that handles real data, such as AES-GCM or HMAC-SHA-256, and this is the layer where modes, padding, initialization vectors and nonces live. A cryptographic protocol is the state machine that negotiates which scheme runs, with which peer, under which keys, such as TLS 1.3 or SSH. The three are routinely spoken of as one thing, and every serious failure in applied cryptography happens at a boundary between them.

The short version:

• A primitive is a mathematical object with a fixed input size. AES encrypts blocks of 128 bits and cannot encrypt a file.
• An algorithm or scheme is a primitive plus a construction that makes it usable, and the construction carries most of the security properties people attribute to the primitive.
• A protocol decides which scheme is used and how both sides got their keys, and it can negotiate a strong scheme down to a weak one.
• AES-ECB and AES-GCM are the same primitive with materially different security, which is why an inventory row that records only AES cannot answer whether a system is exposed.
• The quantum threat lands differently on each layer, so a claim made at one layer is not an answer at another.

An everyday analogy

A primitive is a lock cylinder sitting on a workbench, machined to tolerance and analyzed by people who break locks for a living. An algorithm is that cylinder installed in a door, with a frame, hinges and a strike plate, because the cylinder’s quality stops mattering if the frame splinters. A protocol is the procedure by which two people who have never met agree on which door to use and how each of them got a key. A locksmith can certify the cylinder and tell you nothing about whether the building is secure.

What is a cryptographic primitive?

A primitive is the lowest-level construction in a cryptographic system, defined over fixed-size inputs and studied as a mathematical object in its own right. AES is the worked example. FIPS 197 defines it as an algorithm “capable of using cryptographic keys of 128, 192, and 256 bits to encrypt and decrypt data in blocks of 128 bits,” and that block size is the whole point: AES as specified transforms 16 bytes into 16 bytes.

Source: NIST, “FIPS 197, Advanced Encryption Standard (AES),” csrc.nist.gov.

The same shape holds elsewhere. A hash function such as SHA-256 is specified in FIPS 180-4 over a message of bounded length and produces a fixed-size digest. The RSA trapdoor is a mathematical relation, separate from any of the padding schemes that make it usable. A primitive is what gets cryptanalyzed, which is why cryptanalytic results are almost always stated at this layer, and why they are so often misread as statements about a deployed system.

Source: NIST, “FIPS 180-4, Secure Hash Standard,” csrc.nist.gov.

What is a cryptographic algorithm or scheme?

A scheme is the primitive plus the construction that lets it process arbitrary data and deliver a stated security property. For a block cipher this is the mode of operation, standardized separately from the cipher itself. NIST SP 800-38A specifies the classical confidentiality modes, and SP 800-38D specifies Galois/Counter Mode, which supplies authenticated encryption rather than confidentiality alone.

Source: Morris Dworkin, NIST, “SP 800-38A, Recommendation for Block Cipher Modes of Operation,” csrc.nist.gov.

Source: Morris Dworkin, NIST, “SP 800-38D, Recommendation for Block Cipher Modes of Operation, Galois/Counter Mode (GCM) and GMAC,” csrc.nist.gov.

The construction is where the security properties actually get decided, and the standards say so plainly. Of Electronic Codebook mode, SP 800-38A states that “under a given key, any given plaintext block always gets encrypted to the same ciphertext block,” and adds that “if this property is undesirable in a particular application, the ECB mode should not be used.” Identical plaintext produces identical ciphertext, so structure in the data survives encryption. The cipher is unchanged and the deployment is broken.

The same layering governs everything else at this level. HMAC is a construction over a hash function that yields a message authentication code, and the construction is what makes the result safe to use as a MAC. RSA-OAEP is padding plus the RSA trapdoor. ML-KEM is a key encapsulation mechanism built over a lattice problem, with parameter sets that are part of the scheme rather than decoration.

What is a cryptographic protocol?

A protocol is the negotiation and the state machine. It establishes which scheme both parties will use, how they authenticate each other, how keys are derived, and what happens when the two sides support different things. RFC 8446 specifies TLS 1.3 this way: a handshake that negotiates parameters and authenticates the peer, and a record layer that carries protected data under the result.

Source: E. Rescorla, “The Transport Layer Security (TLS) Protocol Version 1.3,” RFC 8446 (obsoleted by RFC 9846, July 2026, which now carries the TLS 1.3 specification), August 2018, rfc-editor.org/rfc/rfc8446.

Two properties of this layer have no equivalent below it. The first is negotiation, which means the scheme in use is a runtime outcome rather than a build-time fact, and a system that supports a strong option will still use a weak one when the peer offers nothing better. The second is key establishment, which means the protocol decides where the keys came from. Forward secrecy is a protocol property, and no choice of cipher supplies it.

Primitive vs algorithm vs protocol at a glance

Dimension	Primitive	Algorithm or scheme	Protocol
Worked example	AES block cipher, SHA-256	AES-GCM, HMAC-SHA-256, RSA-OAEP, ML-KEM-768	TLS 1.3, SSH, IPsec
What it operates on	one fixed-size block, 128 bits for AES	a message or file of arbitrary length	a session between two parties
Where it is specified	FIPS 197, FIPS 180-4	NIST SP 800-38A and SP 800-38D, FIPS 198-1, FIPS 203	RFC 8446, obsoleted by RFC 9846, and its siblings
What it can do alone	transform one block	encrypt a message, sign a document	establish a session
Chosen at	design time	build time	runtime, by negotiation
Carries a mode or padding	no	yes, and this is where they live	inherits them from the scheme it negotiates
Who audits it	cryptanalysts	implementers and validators	protocol analysts and network reviewers
Typical failure	a cryptanalytic break, rare	a wrong mode, a reused nonce, weak padding	downgrade, weak peer, bad key establishment
How a scanner sees it	a call site in source code	a call site plus its parameters	a handshake on the wire
CycloneDX asset type	recorded as a property of the algorithm	algorithm	protocol

Source: CycloneDX, “Cryptography Bill of Materials (CBOM),” cyclonedx.org.

How do the three layers actually differ?

They differ on the question each one answers, and the questions are not interchangeable:

1. The primitive answers whether the mathematics holds. This is the layer where a break is a research result. It is also the layer that changes least often, which is why an organization can run the same primitive for 20 years and never think about it.
2. The scheme answers whether this deployment uses the mathematics correctly. Modes, nonces, padding and parameter sets live here, and so does the large majority of real-world cryptographic failure. A correct primitive in a wrong construction is a broken system with a clean algorithm name.
3. The protocol answers what actually happened on the wire. Because negotiation is a runtime event, the protocol layer is the only one where the same deployed system can be secure in one session and weak in the next, depending on the peer.

The practical consequence is that evidence gathered at one layer does not transfer to another. Reading source code tells you which schemes a system can use. Watching a handshake tells you which one it did use with one peer at one moment. Both are real evidence and neither is the whole inventory, which is why a network scanner and a code scanner routinely produce different answers about the same system without either being wrong.

Where do the three layers agree?

Three things are true across all of them, and readers who work hard on the distinction sometimes lose sight of them.

All three layers are standardized by name, so all three are inventoriable in principle, and a CBOM that records only one layer is an incomplete inventory rather than a different kind of inventory. All three depend on key material that is usually managed somewhere else entirely, which is why key management failures cut across the whole stack. And all three are subject to the same rule about deployment: a property holds only where it is actually turned on, so the weakest deployed endpoint sets the real security of the system regardless of which layer you are reasoning about.

Why does the distinction matter for a cryptographic inventory?

Because a row that names one layer gets read as an answer about the whole stack. “We use AES-256 at rest and TLS in transit” is a common summary of an estate’s cryptography, and it leaves every question a migration actually turns on unanswered: which mode, which key sizes for the asymmetric parts, which protocol versions, what the negotiation does when a peer offers less, and where the keys live.

This is why the CycloneDX CBOM specification models cryptographic assets by type, with algorithm, protocol, certificate and related key material as separate asset kinds, and records the primitive, mode and padding as properties beneath the algorithm rather than folding them into the name. The specification is worth reading as an argument about vocabulary as much as a data format: the shape of the schema is a claim that a single string cannot carry the information a migration needs.

Source: CycloneDX, “Cryptography Bill of Materials (CBOM),” cyclonedx.org.

How does the quantum threat hit each layer?

Differently at every level, which is the reason the distinction is load-bearing rather than pedantic:

1. The primitive layer takes a parameter change. Grover’s algorithm provides a quadratic speedup against unstructured search, which reduces the effective strength of a symmetric primitive rather than breaking it, and is answered by using larger keys.
2. The scheme layer takes the real damage. Shor’s algorithm breaks the public-key schemes built on factoring and discrete logarithms, which is why RSA and elliptic-curve key establishment and signatures are the quantum-vulnerable population and why the replacements are new schemes rather than new parameters.
3. The protocol layer is where migration is actually executed. Hybrid key exchange is a protocol-level construction, negotiated per connection, and it delivers a post-quantum property only against peers that support it.

A claim at one layer is therefore not an answer at another. “We support ML-KEM” describes a scheme the product can use. “We run TLS 1.3” describes a protocol version that permits classical key exchange as readily as hybrid. Neither sentence tells you what a given connection actually negotiated, and the harvest-now-decrypt-later exposure depends on exactly that.

Why do people confuse the three?

Mostly because the naming conventions of the field encourage it. “AES” is used to mean the primitive, the scheme and sometimes the product feature, and nothing in the word marks which one is meant. Standards bodies compound this by specifying the layers in separate documents that most practitioners never read side by side, so the cipher lives in FIPS 197 and the mode that determines its behavior lives in SP 800-38A.

Marketing does the rest. A control list is easier to publish than an inventory, and a control list is written at whichever layer sounds strongest. “AES-256 encryption at rest” is a true statement about a primitive and a key size that says nothing about the mode, the key management, or whether the same data is readable through an interface that never touches the storage layer.

Common misconceptions

• “AES is an encryption algorithm you can deploy.” AES as specified encrypts 128-bit blocks. Every deployment uses it inside a mode, and the mode determines whether the result is confidential, authenticated, or neither.
• “The algorithm name tells you the security property.” AES-ECB and AES-GCM share a primitive and a key size and deliver different properties, one of which preserves patterns in the plaintext by design.
• “TLS 1.3 means the connection is quantum-safe.” The version number permits hybrid key exchange and does not require it. What a connection used is a negotiation outcome.
• “A protocol is just a wrapper around the algorithms.” The protocol decides key establishment, peer authentication and downgrade behavior, none of which any scheme supplies on its own.
• “If the primitive is unbroken, the system is secure.” Most real failures happen in the construction and the deployment, which is why cryptanalytic breaks of standardized primitives are rare and cryptographic incidents are not.
• “An inventory of algorithms is a cryptographic inventory.” An inventory that records schemes without protocols, or protocols without the schemes they negotiate, leaves the migration unable to sequence itself.

Questions people ask

Is AES a primitive, an algorithm, or a protocol? AES is a primitive, specified in FIPS 197 as a block cipher over 128-bit blocks. What gets deployed is always AES inside a mode, such as AES-GCM, and that combination is the scheme.

What is the difference between a mode and a protocol? A mode is part of the scheme and determines how a primitive processes data longer than one block. A protocol governs a session between two parties and decides which scheme is used at all. GCM is a mode. TLS is a protocol.

Which layer should a CBOM record? All of them. The CycloneDX model treats algorithm, protocol, certificate and key material as distinct asset types, and records the primitive, mode and padding as properties of the algorithm, because a migration needs each of those separately.

Why do two scanners disagree about the same system? Usually because they read different layers. A network scanner observes what a handshake negotiated. A source-code scanner observes which schemes the code can call. Both answers can be accurate and different.

Does hybrid key exchange happen at the algorithm layer or the protocol layer? The protocol layer. Hybrid combines a classical and a post-quantum key exchange within the handshake, so whether it is used depends on what the peer offers, per connection.

Is a cipher suite a scheme or a protocol? A cipher suite is a protocol-level name for a bundle of schemes, which is part of why the vocabulary confuses people. The suite string is negotiated by the protocol and the algorithms it names are schemes.

Does the distinction change what I have to migrate? It changes how the work is scoped. Symmetric primitives take parameter changes, public-key schemes get replaced, and protocols get configuration and endpoint work. Treating those as one task is what produces a plan that cannot be sequenced.

Where does a certificate fit? A certificate is its own asset type. It binds an identity to a public key and carries a signature scheme inside it, so it sits between the scheme layer and the protocol layer and is inventoried separately from both.

---

Everything here is the map, given freely. When your team needs its own cryptography inventoried at every layer rather than summarized in a control list, that’s the work I do.

Last verified 2026-09-03 · Maintained by Addie LaMarr, LaMarr Labs.