Encryption algorithms

csha --list-ciphers lists AES plus ten additional authenticated cipher options.
Use --cipher NAME when generating an encrypted image, environment map,
image-pair map, or Docker PNG. Decoding reads the stored algorithm automatically.

CLI name	Construction	Key bits	Nonce bytes
`aes`	Existing AES CBC, CTR, or GCM; Docker uses GCM	256	Existing format
`chacha20-poly1305`	IETF ChaCha20 with Poly1305	256	12
`xchacha20-poly1305`	XChaCha20 with Poly1305	256	24
`camellia-eax`	Camellia in EAX mode	256	16
`aria-eax`	ARIA in EAX mode	256	16
`twofish-eax`	Twofish in EAX mode	256	16
`serpent-eax`	Serpent in EAX mode	256	16
`cast256-eax`	CAST-256 in EAX mode	256	16
`rc6-eax`	RC6 in EAX mode	256	16
`mars-eax`	MARS in EAX mode	256	16
`sm4-eax`	SM4 in EAX mode	128	16

These are ten cipher choices, including two variants of the ChaCha family.
Implementations come from Crypto++ 8.9 or later and share the C++20
csha.encoder interface in src/crypto/encoder.ixx. EAX supplies authentication
for the block ciphers; all ten use 16-byte authentication tags. ChaCha20-Poly1305
is the default recommendation when choosing a non-AES option. The algorithms
have different performance, interoperability, and deployment histories; this
list is not a claim that each is interchangeable in external protocols.

# Encrypt text into PNG pixels, then recover it without specifying the cipher.
csha -M es -s 'hello' -p 'your secret phrase' \
  --cipher chacha20-poly1305 -o message.png
csha -M di -i message.png -p 'your secret phrase'

# A file or ZIP, including Base64 PNG URL output.
csha -M ef -f input.bin -p 'your secret phrase' \
  --cipher twofish-eax -o file.png --data-url-output file.url
csha -M ez -z input.zip -p 'your secret phrase' --cipher serpent-eax -o zip.png
csha -M dz -i zip.png -p 'your secret phrase' -Z recovered.zip

# Either user image can unlock the map; key wrapping uses the selected cipher too.
csha -M f -f input.bin --key-image first.png --key-image second.png \
  --cipher xchacha20-poly1305 -o pair.png
csha -M fd -i pair.png --key-image second.png -o recovered.bin

# Docker archives keep the existing streaming, verify-before-load workflow.
csha docker-image keygen --output app.docker-key
csha docker-image pack --image my-app:latest --cipher camellia-eax \
  --key-file app.docker-key --output app.png
csha docker-image run --input app.png --key-file app.docker-key

For password-based images, new ciphers use PBKDF2-HMAC-SHA256 with a fresh
16-byte salt and 600,000 iterations. They require a nonempty -p value. -A
is specific to AES, and the legacy DIRECT and FIXED key derivations are
rejected with a new cipher. Image-pair credentials and Docker keys already
provide key bytes, so those paths do not use a password KDF. SM4 uses 16 bytes
of the supplied or derived 32-byte material.

AES remains the default. Existing AES image, pair-map and Docker formats remain
readable, and default AES outputs retain their old formats. New cipher images
and pair maps use separate format markers; non-AES Docker PNGs use a version-2
header. Old binaries cannot decode the new formats. New pair maps hold up to
196,288 plaintext bytes; existing AES pair maps hold 196,432 bytes.

Cipher identity, envelope length, nonce and password-derivation parameters are
authenticated. Unknown IDs, unsupported parameters, wrong keys, and modified
payloads fail. The password envelope has a 64-byte header plus a 16-byte tag.
Image and ZIP processing remains in memory; Docker archives remain streamed.

Blob Streams continues to use its TLS 1.3 AES-GCM transport. The ten cipher
options here apply to stored data and do not replace TLS with a custom protocol.
These algorithms provide encryption, not language translation or a lossy JPEG
recovery scheme. Preserve PNG pixel values exactly.

Implementation references: Crypto++ authenticated cipher API,
Crypto++ EAX, and
RFC 8439.