Who actually writes the standards

Almost every algorithm in this catalog traces back to a NIST publication. Here's what NIST actually is, how it picks a winner, and the full list of what it's standardized.

TLS, JWT, PKIX certificates, SSH — every protocol module on this site cites an RFC. Here's how the IETF actually produces them, and what "RFC" does and doesn't guarantee.

A federation of national standards bodies, not a single organization — and the source of both ISO/IEC 27001 certification and the international equivalent of NIST's own algorithm standards.

SAML, PKCS#11, and KMIP all live here — a member-driven consortium, not a government body, that ended up stewarding some of the most load-bearing identity and key-management specs in production today.

Neither a government agency nor an open consortium: EMVCo is owned outright by the card networks, and PCI SSC enforces compliance rather than publishing algorithms. Here's how chip, PIN, CVV, and 3DS specs actually get made — and why some of the math behind them is deliberately never published at all.

FIPS 197 tells you what AES is. FIPS 140-3 tells you what a library, token, or HSM implementing it has to do before a lab will sign off on it: a defined boundary, self-tests, key handling, and physical protection graded from Level 1 to Level 4.

Where FIPS 140-3 tests every module against one fixed list, Common Criteria lets the vendor (or a protection profile) state the security claims, then grades how rigorously a lab checked them. Here's how to read 'EAL4+', and why it says less than it seems to.

FIPS 140-3 and Common Criteria certify products. eIDAS is EU law: it decides when an electronic signature counts as much as a handwritten one, who may issue the certificates behind it, and where the key has to live. ETSI's EN 319 series supplies the technical detail. Here's how the pieces fit, from QES and QSCDs to AdES formats and the new EUDI Wallet.