What is c2sp?

The Community Cryptography Specification Project (C2SP) is a hub for writing, updating, and maintaining documents that define how cryptography tools should work. Instead of relying on slow-moving standards bodies, it borrows the fast, flexible workflows of open-source software development to manage these technical documents. It provides a centralized home for specifications covering things like file encryption, hashing, random number generation, and digital signatures. At its core, the project treats specification documents like software code. Each specification lives as a Markdown file in a GitHub repository, complete with version tracking and designated maintainers who review and approve changes. Unlike traditional standards organizations that try to build agreement among many participants, each specification here is driven by a small group of maintainers who can make quick, opinionated decisions. If a fundamental disagreement arises, the spec can simply be forked. Versions are tracked using clear tags, so developers always know exactly which version of a rulebook they are reading. Security engineers, cryptographic library developers, and software architects use these specifications to build secure applications. For example, a developer building a backup tool might implement the "age" file encryption format, while another might use the BLAKE3 hashing specification to quickly verify file integrity. The project also includes a variety of specs for transparency logs, which help ensure public records like web certificates haven't been secretly tampered with. This gives developers a trusted, modern reference point when they need to integrate cryptography into their products. Beyond the specifications themselves, the project hosts three associated testing projects. These include Wycheproof, a library of tests to catch known security flaws in cryptographic code, CCTV, a collection of reusable test vectors, and x509-limbo, a test suite for validating digital web certificates. These tools help developers verify that their code actually behaves the way the specifications intend, catching vulnerabilities before they reach production.