Botan

"Botan (Japanese for peony) is a cryptography library written in C++11 and released under the permissive Simplified BSD license.

Botan's goal is to be the best option for cryptography in new C++ code by offering the tools necessary to implement a range of practical systems, such as TLS/DTLS, PKIX certificate handling, PKCS#11 and TPM hardware support, password hashing, and post quantum crypto schemes. In addition to the C++, botan has a C89 API specifically designed to be easy to call from other languages. A Python binding using ctypes calling the C89 API is included.

The features include:
 
Transport Layer Security (TLS) Protocol

• TLS v1.0, v1.1, and v1.2. The broken SSLv3 protocol is no longer supported.
• DTLS v1.0 and v1.2 are adaptations of TLS to datagram operation.
• Extensions include session tickets, SNI, ALPN, OCSP staple requests (client side only right now), encrypt-then-mac CBC, and extended master secret.
• Supports authentication using preshared keys (PSK) or passwords (SRP)
• Supports record encryption with ChaCha20Poly1305, AES/OCB, AES/GCM, AES/CCM, Camellia/GCM, and legacy CBC ciphersuites with AES, Camellia, SEED, or 3DES.
• Key exchange using Diffie-Hellman, ECDH, RSA, or CECPQ1

Public Key Infrastructure

• X.509v3 certificates and CRL creation and handling
• PKIX certificate path validation, including name constraints.
• OCSP request creation and response handling
• PKCS #10 certificate request generation and processing
• SQL database backed certificate store

Public Key Cryptography

• RSA signatures and encryption
• DH and ECDH key agreement
• Signature schemes ECDSA, DSA, ECGDSA, ECKCDSA, and GOST 34.10-2001
• Post-quantum signature scheme XMSS
• Post-quantum key agreement schemes McEliece and NewHope
• ElGamal encryption
• Padding schemes OAEP, PSS, PKCS #1 v1.5, X9.31

Ciphers, hashes, MACs, and checksums

• Authenticated cipher modes EAX, OCB, GCM, SIV, CCM, and ChaCha20Poly1305
• Cipher modes CTR, CBC, XTS, CFB, and OFB
• Block ciphers AES, Serpent, Blowfish, Twofish, Threefish-512, DES/3DES, Noekeon, IDEA, CAST-128, XTEA, SEED, KASUMI, GOST 28147, MISTY1, Lion, CAST-256
• Stream ciphers ChaCha20, Salsa20/XSalsa20, SHAKE-128, and RC4
• Hash functions SHA-1, SHA-2, SHA-3, RIPEMD-160, Skein-512, BLAKE2b, Tiger, Whirlpool, GOST 34.11, MD5, MD4
• Hash function combiners Parallel and Comb4P
• Authentication codes HMAC, CMAC, Poly1305, SipHash, GMAC, CBC-MAC, X9.19 DES-MAC
• Non-cryptographic checksums Adler32, CRC24, and CRC32

Other Useful Things

• Full C++ PKCS #11 API wrapper
• Interfaces for TPM v1.2 device access
• Simple compression API wrapping zlib, bzip2, and lzma libraries
• RNG wrappers for system RNG and hardware RNGs
• HMAC_DRBG and entropy collection system for userspace RNGs
• PBKDF2 password based key derivation
• Password hashing function bcrypt and passhash9 (custom PBKDF scheme)
• SRP-6a password authenticated key exchange
• Key derivation functions including HKDF, KDF2, SP 800-108, SP 800-56C
• Format preserving encryption scheme FE1
• Threshold secret sharing
• RFC 3394 AES key wrap

Recommended Algorithms

• For encryption of network traffic use TLS v1.2
• Packet encryption: AES-256/GCM, AES-256/OCB, Serpent/OCB, or ChaCha20Poly1305
• General hash function: BLAKE2b, SHA-2, SHA-3, or Skein-512
• Message authentication or PRF: HMAC with SHA-256
• Key derivation function: KDF2 or HKDF
• Public Key Encryption: RSA, 2048+ bit keys, with OAEP/SHA-256
• Public Key Signatures: RSA, 2048+ bit keys with PSS/SHA-512, or ECDSA using P-256/SHA-256 or P-521/SHA-512
• Key Agreement: ECDH using P-256 or X25519. If you are concerned about quantum computers, combine ECC with NewHope.

 https://github.com/randombit/botan

https://botan.randombit.net/

Installation Notes

 ./configure.py --prefix=/usr --libdir=/usr/lib64 --with-boost --with-openssl --with-sqlite3 --with-zlib --with-lzma