The old best practice was RSA (with OAEP padding), AES CBC (with PKCS 7 padding), HMAC-SHA-2 (for TLS, AES GCM is better than AES CBC + HMAC, but I don't know i

The old best practice was RSA (with OAEP padding), AES CBC (with PKCS 7 padding), HMAC-SHA-2 (for TLS, AES GCM is better than AES CBC + HMAC, but I don't know if it's true in general). The new best practice seems to be something based on Curve25519 with SALSA/XSALSA/CHACHA + POLY1305. CFRG has been trying for a year to come up with recommendation for TLS 1.3 on how to use 25519 and stronger curves in better primitives than ECDSA. ChaCha20+Poly1305 is getting more progress getting standardized, but still very slowly[0][1][2][3]. If you want to be sane then don't look into how sausages, laws and standards get made. 0 - https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-04 https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-0... 1 - https://tools.ietf.org/html/draft-nir-cfrg-chacha20-poly1305-06 https://tools.ietf.org/html/draft-nir-cfrg-chacha20-poly1305... 2 - https://tools.ietf.org/html/draft-irtf-cfrg-chacha20-poly1305-10 https://tools.ietf.org/html/draft-irtf-cfrg-chacha20-poly130... 3 - https://tools.ietf.org/html/draft-mavrogiannopoulos-chacha-tls-03 https://tools.ietf.org/html/draft-mavrogiannopoulos-chacha-t...