Cryptographic Tools

All cipher calculators share the same conventions:

• Two-pane layout — Inputs on the left, an activity log on the right that records every operation with timestamps and inputs.
• Data Input Type — Most tools have an ASCII / Hexadecimal drop-down so you can paste data either way; the field label changes based on the selection.
• Hex keys — Keys are always entered as continuous hexadecimal (no spaces, no 0x prefix). Length is validated live.
• Encrypt / Decrypt buttons — Pair of explicit buttons rather than an Encrypt/Decrypt toggle.
• Copy buttons — Each output supports one-click copy to clipboard.

Inputs

Walk-through

1. Pick AES Type — AES-128, AES-192, or AES-256.
2. Pick Mode — Choose a cipher mode, or pick KCV to compute a key check value.
3. Pick Data Input Type — ASCII or Hexadecimal.
4. Enter Input Data — In KCV mode the input is ignored; otherwise this is the plaintext or ciphertext.
5. Enter Key (Hex) — A hex key whose length matches the AES type.
6. Enter IV — If the mode requires one, enter 32 hex chars in the Initial Vector (IV) (Hex) field.
7. Click Encrypt / Decrypt — Or Calculate KCV when the mode is KCV. The result is appended to the right-hand activity log with a byte count.

Example

AES Type:        AES-128
Mode:            CBC
Data Input Type: Hexadecimal
Key (Hex):       2B7E151628AED2A6ABF7158809CF4F3C
IV (Hex):        000102030405060708090A0B0C0D0E0F
Input Data:      6BC1BEE22E409F96E93D7E117393172A

Output:          7649ABAC8119B246CEE98E9B12E9197D

Inputs

Walk-through

1. Pick Algorithm — DES for single DES, 3DES for double or triple length keys.
2. Pick Mode — ECB or CBC for the typical case; CFB-8/CFB-64/OFB-8/OFB-64 for streaming variants.
3. Pick Padding — Pick the scheme expected by your host. ISO 9797-1 Method 1 or Method 2 are common in payments.
4. Pick Data Input Type — ASCII or Hexadecimal.
5. Enter Input Data in the matching format.
6. Enter Key (Hex) — The variant (DES, 2-key 3DES, 3-key 3DES) is inferred from the key length you provide.
7. Enter IV if a chaining mode is selected.
8. Click Encrypt / Decrypt — The result card displays the output in HEX, plus an ASCII view if the bytes are printable, with copy / clear actions.

Use Cases

• Encrypting / decrypting PIN blocks under a working key (TPK / PEK).
• Generating 3DES MACs by chaining ECB operations.
• Verifying ZPK / ZMK translations during HSM integration.

Tabs (5)

Each tab is a self-contained calculator for the named variant:

• FPE-FF1
• FPE-FF2 (VAES3)
• FPE-FF3
• FPE-FF3-1
• FPE-DFF[OFF-2]

Inputs (per tab)

Walk-through

1. Pick the FPE tab matching your spec — FPE-FF1 or FPE-FF3-1 for new work.
2. Pick Radix — 10 for numeric tokens such as PANs.
3. Pick Encryption Type — the AES variant for the underlying block cipher.
4. Pick Key Input Type and enter the Key.
5. (FF1 only) tick Use Tweak? if you have one, then enter it.
6. Enter Data — The string must contain only characters in the radix alphabet.
7. Click Encrypt or Decrypt — The output preserves the original length and alphabet.

Example: Tokenize a PAN (FPE-FF1)

Radix:           10
Encryption Type: AES-128
Key Input Type:  Hexadecimal
Key:             2B7E151628AED2A6ABF7158809CF4F3C
Use Tweak?:      on
Tweak:           39383736353433323130
Data:            0123456789012345

Output:          9095444784296454

Tabs (6)

• Keys — Generate or paste a key pair.
• Encrypt — Encrypt with PKCS1 or no padding.
• Decrypt — Decrypt ciphertext with the corresponding key.
• Sign — Produce a signature over a message or hash.
• Verify — Verify a signature against a hash.
• OAEP — Encode / decode with OAEP padding.

Keys Tab

• Key Length (bits) — 1024, 2048, 3072, 4096.
• Generate Keys button.
• Modulus, Public Exponent (e), Private Exponent (d) — All hex; you can also paste pre-existing components instead of generating.

Encrypt Tab

• Encoding Method — Public (encrypt with public key) or Private.
• Padding — PKCS1 or No Padding.
• Input Data Format — ASCII or Hex.
• Data to Encrypt.
• Button: Encrypt.

Decrypt Tab

• Decoding Method — Private or Public.
• Padding — PKCS1 or No Padding.
• Data to Decrypt (Hex).
• Button: Decrypt.

Sign / Verify Tabs

• Sign — Input Data Format (ASCII / Hex) and Data to Sign; click Sign.
• Verify — Hash (Hex) and Signature (Hex); click Verify.

OAEP Tab

• Method — Encode or Decode.
• Hash Function — SHA-1, SHA-224, SHA-256, SHA-384, SHA-512.
• Result Length (bits) — 1024, 2048, 4096.
• Data (Hex), Encoding Parameters (Label, Hex).
• Button label changes between Encode and Decode based on the selected method.

Tabs (3)

Generate

Construct an RSA key pair from CRT components (or generate a fresh one). Inputs:

• Private Exp. (d)
• Prime 1 (p)
• Prime 2 (q)
• Exponent 1 (dModP1)
• Exponent 2 (dModQ1)
• Coefficient (iqmp)
• Key Length (1-4096)

Buttons: Generate (d) from Components, Generate New Random Key.

Thales Key Block

Wrap or unwrap a key pair under a Key Block Protection Key. Inputs:

• DES KBPK, AES KBPK
• Public Key Header, Private Key Header
• Key Block Encryption — AES or DES.
• Input Format — ASCII or Hex.
• Public Key, Private Key

Buttons: Wrap Key Block, Unwrap Key Block.

Thales LMK Variant

Apply Thales LMK variants. Inputs:

• LMK Pair 34-35
• LMK Pair 36-37
• Authentication Data
• Modulus Encoding — DEC / DER variants.
• Public Key, Private Key

Button: Process LMK Variant.

Keys Tab

• ECC Curve Name — NIST P-256, NIST P-384, NIST P-521, plus the Brainpool curve variants.
• Private Key (Hex).
• Public Key (Hex).
• Public Key Form — Uncompressed or Compressed.

Buttons: Generate New Public Key, Is Point on Curve?, Generate Random Key Pair, Validate Current Key Pair.

Sign Tab

• Hash Type — SHA-1, SHA-256, SHA-384, SHA-512.
• Input Data Format — ASCII or Hex.
• Data to Sign.

Button: Sign Data. Output is the (r, s) pair in hex.

Verify Tab

• Hash (Hex).
• Signature (Hex).

Button: Verify Signature.

Mode availability depends on the calculator. AES exposes ECB / CBC / CFB / OFB / KCV. DES / 3DES exposes ECB, CBC, and the CFB-8 / CFB-64 / OFB-8 / OFB-64 byte/feedback variants.

Inputs

Walk-through

1. Pick Data Input Type — ASCII for text, Hexadecimal for raw bytes.
2. Pick Hash Type.
3. Enter Input Data.
4. Click Calculate Hash. The digest is written to the activity log alongside the input, so a run can be compared against a published vector.

The DES / 3DES calculator exposes the full set of padding schemes used across legacy and modern payment protocols. Pick the one your host expects: