Topic domain
Cryptography
Primitives, constructions, and the assumptions beneath them.
- Articles
- 80
- Clusters
- 8
- Foundational
- 24
- Intermediate
- 32
- Advanced
- 24
Block and stream cipher design.
- Why a Feistel Round Function Need Not Be Invertible
- The AES State Matrix: Byte Ordering, ShiftRows, and MixColumns
- Key Schedules: Why Subkeys Cannot Be Independent
- Constructing an S-Box: Field Inversion and Differential Uniformity
- Diffusion and Branch Numbers in Block Cipher Design
- ARX Ciphers: Carry Chains as the Only Nonlinearity
AEAD, nonces, and misuse resistance.
- What a Block Cipher Mode Adds to a Block Cipher
- How a Padding Check Becomes a Decryption Oracle
- Counter Block Layout and the Nonce Budget in CTR Mode
- Recovering the GCM Authentication Key from a Repeated Nonce
- GHASH and the Structure of a GCM Tag
- SIV and the Two-Pass Design of a Misuse-Resistant AEAD
RSA, Diffie-Hellman, and elliptic curves.
- Modular Exponentiation and the Cost of One Key Operation
- Discrete Logarithms and Why Group Order Decides Their Difficulty
- RSA Key Generation and the Prime Search
- RSA Padding and Why Textbook RSA Fails
- Ephemeral Diffie-Hellman and What Forward Secrecy Actually Buys
- Elliptic Curve Point Arithmetic and Validation
Collision resistance and Merkle structures.
- The Merkle-Damgård Construction and the Padding That Binds It
- Collision Resistance and the Birthday Bound
- Rate and Capacity in the Sponge Construction
- Length Extension and Prefix-Free Message Encoding
- Domain Separation in Merkle Tree Hashing
- Parallel Tree Hashing and the BLAKE3 Design
Authenticity and non-repudiation.
- The Verification Split: Why a MAC Cannot Settle a Dispute
- Why HMAC Hashes Twice and What Length Extension Has to Do With It
- CBC-MAC Ends at the Last Block, and That Is the Problem
- Poly1305 and the Arithmetic of a One-Time Key
- Salt, Hash, and MGF1: What RSA-PSS Adds to the Verification Step
- ECDSA Nonce Reuse and the Private Key It Leaks
Generation, rotation, and storage.
- Entropy Sources and the Path from Randomness to a Key
- Envelope Encryption and the Two-Level Key Hierarchy
- Password-Based Key Derivation and What Iteration Counts Buy
- Protecting Key Material in Memory and at Rest
- Key Rotation, Key Versions, and Why Re-Encryption Is Optional
- What an HSM Boundary Actually Guarantees
Composition, transcripts, and proofs.
- Transcript Hashing and Handshake Binding in TLS 1.3
- Domain Separation and Labelled Key Derivation
- Unambiguous Message Framing in Cryptographic Protocols
- Key Confirmation Ordering and What It Prevents
- Pre-Shared Key Binders and the Cost of Early Data
- Nonce Construction and the Reuse Limits of AEAD
Lattice and code-based schemes.
- How Shor's Algorithm Turns Factoring into Period Finding
- Why Learning With Errors Is Believed Hard in the Worst Case
- Why Decoding a Random Linear Code Is Hard Enough to Sign With
- Inside ML-KEM: Noise Growth from Keygen to Decapsulation
- The Fiat-Shamir with Aborts Loop in ML-DSA
- All-or-Nothing Transforms and the Extra Tightness in ML-KEM
All Cryptography articles
- Oct 12, 2026 Constructing an S-Box: Field Inversion and Differential Uniformity Why the AES substitution table is an inverse map in GF(2^8) followed by an affine transform, and how differential uniformity bounds the best characteristic.
- Sep 11, 2026 Password-Based Key Derivation and What Iteration Counts Buy How salts, memory hardness, and iteration counts change the cost of guessing a password-derived key, and where each parameter stops helping.
- Sep 8, 2026 Concurrent Composition and the Isolation Assumption Why a protocol proved secure alone can fail when run beside another, how session identifiers and key separation restore isolation, and where composition theorems stop applying.
- Aug 20, 2026 Ephemeral Diffie-Hellman and What Forward Secrecy Actually Buys Why a fresh exponent per handshake protects past sessions after a key compromise, what the extra exponentiations cost, and how identity binding prevents the exchange from being hijacked.
- Aug 20, 2026 Key Schedules: Why Subkeys Cannot Be Independent The key expansion that derives a round key from a short master key, the nonlinearity it must add, and the related-key and slide attacks that punish weak expansion.
- Aug 19, 2026 Modular Exponentiation and the Cost of One Key Operation How square-and-multiply collapses a huge exponent into a few thousand multiplications, why private exponents cost far more than public ones, and where constant-time code changes the algorithm.
- Jul 26, 2026 Sparse Merkle Trees and Proofs of Non-Membership How a tree whose leaves are addressed by their own hashes proves absence, and what the default-hash rule, index lookup, and proof size cost at real key widths.
- Jul 19, 2026 Channel Binding: Tying an Authenticated Session to Its Transport How a protocol proves that the credential exchange it just performed happened inside this specific TLS connection, and why an unbound exchange is open to a relay in the middle.
- Jul 12, 2026 Why Learning With Errors Is Believed Hard in the Worst Case How finding a close lattice point relates to recovering a secret from noisy linear equations, and why the reduction direction makes lattice schemes resistant to the structural attacks that break structured problems.
- Jul 2, 2026 Length Extension and Prefix-Free Message Encoding Why an iterated hash can be continued from its own digest, how the attack reconstructs unknown input from output alone, and which encodings close the hole.
- Jun 11, 2026 Ed25519 Cofactors, Canonical Encoding, and Strict Verification A twisted Edwards curve with a small cofactor and a single verification equation leaves several checks outside the signature standard, and different libraries have disagreed about them.
- Jun 4, 2026 Unambiguous Message Framing in Cryptographic Protocols Why a byte string must decode to exactly one message structure, how length prefixes and canonical encodings achieve it, and where parsing ambiguities become key-recovery attacks.
- Jun 2, 2026 The Merkle-Damgård Construction and the Padding That Binds It How a fixed-width compression function is iterated into a variable-length hash, why the padding encodes the message length, and which attacks the iteration rule leaves open.
- May 16, 2026 Tweakable Encryption with XTS and the Limits of Length-Preserving Disk Encryption How sector encryption binds ciphertext to its disk location without expanding it, why XTS carries no integrity and what that permits an attacker with write access, and how tweak and key layout are fixed by the standard.
- Apr 28, 2026 Differential and Linear Cryptanalysis as Trail Counting The two classical attacks reduce to finding high-probability differentials and high-bias linear approximations, and both are bounded by the same active S-box count.
- Apr 20, 2026 Designing a Key Service Interface That Cannot Be Misused Why a key store should expose operations rather than keys, which parameters belong in a request, and how context binding and audit change the trust model.
- Apr 19, 2026 Key Confirmation Ordering and What It Prevents Why a Finished message must come after the peer can no longer change the transcript, what an explicit key-confirmation exchange adds, and which attacks a misordered exchange leaves open.
- Apr 10, 2026 Why HMAC Hashes Twice and What Length Extension Has to Do With It The nested construction that turns a plain hash into a keyed MAC, the Merkle-Damgard weakness it neutralises, and why the two fixed inner and outer pads are load-bearing.
- Apr 1, 2026 Symbolic Protocol Verification and the Perfect Encryption Assumption How Dolev-Yao models reduce cryptography to term algebra, what tools such as ProVerif and Tamarin can and cannot find, and why a symbolic attack is always worth taking seriously.
- Mar 30, 2026 Domain Separation in Merkle Tree Hashing How a leaf node and an internal node can hash to the same value, why the standard repair costs one bit of digest, and which schemes still get the distinction wrong.
- Mar 3, 2026 Memory-Hard Functions and Password Hashing Costs Why a fast hash is the wrong primitive for storing passwords, how memory hardness changes the attacker cost model, and how iteration counts, salts, and parallelism parameters interact.
- Feb 13, 2026 Tweakable Block Ciphers and the Cost of Sector Independence How a public tweak makes one key behave like many, why the tweak must enter before the first round, and what XTS and Threefish give up to get it.
- Feb 12, 2026 The Verification Split: Why a MAC Cannot Settle a Dispute Symmetric tags and public-key signatures differ in who is able to check them, and that single difference determines what each can be used as evidence for.
- Feb 7, 2026 How Shor's Algorithm Turns Factoring into Period Finding Why quantum phase estimation on a modular exponentiation function recovers RSA private keys, and what the circuit cost reveals about which schemes need replacing and which do not.
- Jan 22, 2026 Nonce Construction and the Reuse Limits of AEAD Why an AEAD nonce must be unique per key, how counter, random, and XOR-based constructions differ in what they assume, and what a repeated nonce reveals.
- Jan 13, 2026 Transcript Hashing and Handshake Binding in TLS 1.3 How a running hash over handshake messages commits each flight to the ones before it, which secrets consume the digest, and what breaks when a message is left out of it.
- Jan 12, 2026 The Fiat-Shamir with Aborts Loop in ML-DSA How rejection sampling hides the signing nonce, why a signature leaks nothing but a transcript, and what the rejection rate costs in signing throughput.
- Dec 29, 2025 From Heuristic Hashes to the Random Oracle Model Why hash-based proofs are stated against an idealised function, what a reduction actually guarantees when the real hash is used instead, and where the modelling assumption fails.
- Dec 26, 2025 Diffusion and Branch Numbers in Block Cipher Design How the wide-trail strategy counts active S-boxes across rounds, why a branch number of five bounds a four-round characteristic, and where the bound stops applying.
- Dec 23, 2025 Pre-Shared Key Binders and the Cost of Early Data How a binder commits a client to a session ticket before the server has contributed anything, why 0-RTT cannot be replay-protected by the protocol, and what the truncation rules prevent.
- Dec 21, 2025 Merkle Trees as a Signature Scheme: One Key, Many One-Time Keys A hash-based signature is a one-time object, and a binary authentication tree is what turns a finite collection of them into a long-lived public key with logarithmic signatures.
- Dec 16, 2025 What the Ring Structure Costs: MOD-LWE Versus Plain LWE Why replacing a random matrix with polynomial multiplication shrinks keys and speeds arithmetic, and which cryptographic and cryptanalytic problems that structure introduces in exchange.
- Nov 24, 2025 Random Oracle Model Arguments and Their Limits What a proof in the random oracle model actually establishes, why a hash can be instantiated by a construction with an obvious weakness, and how to read a ROM proof without overclaiming.
- Oct 13, 2025 Hybrid Encryption and the Cost of Encrypting Long Messages Why a public-key operation wraps a symmetric key instead of the message, how RSA-KEM and ECIES derive that key, and what the encapsulation interface changes.
- Oct 13, 2025 Salt, Hash, and MGF1: What RSA-PSS Adds to the Verification Step Probabilistic signature padding turns a textbook RSA signature into one that resists chosen-message forgery, and moves work from the signer to the verifier.
- Oct 10, 2025 Why Decoding a Random Linear Code Is Hard Enough to Sign With How the syndrome decoding problem underpins code-based cryptography, what the Prange and Stern algorithms reveal about its cost, and how the Niederreiter form turns it into signatures.
- Oct 6, 2025 GHASH and the Structure of a GCM Tag Why the authenticator is a polynomial evaluation in a binary field rather than a chained MAC, how the length block prevents padding ambiguity, and what tag truncation costs in forgery probability.
- Sep 8, 2025 Key Destruction, Retired Keys, and Cryptographic Erasure Why deleting a key is not the same as destroying it, what media retain after overwrite, and how destroying a wrapping key deletes data it never touched.
- Sep 4, 2025 Why Larger Keys Do Not Answer the Quantum Threat Shor’s algorithm attacks the group structure rather than the key length, so every classical public-key family falls together; what a replacement primitive has to provide and where migration actually costs.
- Aug 12, 2025 What a Block Cipher Mode Adds to a Block Cipher How chaining turns a single-block permutation into a construction for arbitrary-length data, why the initialization vector must be unpredictable rather than merely unique, and what error propagation costs.
- Jul 25, 2025 Envelope Encryption and the Two-Level Key Hierarchy Why bulk data is encrypted under a per-object data key wrapped by a long-lived master key, and what the indirection buys and costs.
- Jul 7, 2025 Parallel Tree Hashing and the BLAKE3 Design How chunk trees, parent nodes, and a stack of subtree roots convert a sequential hash into a parallel one, and what the tree structure costs in digest size and complexity.
- Jun 7, 2025 Key Rotation, Key Versions, and Why Re-Encryption Is Optional How versioned keys and wrapped data keys let a system rotate without rewriting ciphertext, and when that shortcut stops being safe.
- May 19, 2025 Recovering the GCM Authentication Key from a Repeated Nonce Two messages encrypted under the same GCM nonce turn the tag difference into a polynomial in the hash subkey, whose roots yield the key and permit arbitrary forgery.
- May 14, 2025 Key Size Equivalence Across RSA, Diffie-Hellman, and Curves Why 2048-bit RSA, 2048-bit finite-field Diffie-Hellman, and 256-bit elliptic curves are treated as comparable, and where the equivalence table comes from.
- Apr 29, 2025 Domain Separation and Labelled Key Derivation Why one master secret must never produce two interchangeable keys, how labels are encoded into a KDF, and which label collisions still cause cross-protocol failures.
- Apr 4, 2025 Basis Reduction in Practice: LLL, BKZ and the Delta Parameter How the block size K in BKZ sets the security estimate for lattice schemes, why LLL is only the preprocessing step, and what a solver actually does with the reduced basis.
- Mar 22, 2025 Why a Feistel Round Function Need Not Be Invertible The two-branch construction that turns any function into a permutation, why decryption reuses the encryption circuit, and what the halved diffusion rate costs.
- Feb 8, 2025 Signature Nonces: The Single Secret That Breaks ECDSA How the per-signature nonce turns a signature equation into a solvable linear system when it repeats or leaks, and how deterministic derivation removes the randomness requirement.
- Jan 23, 2025 Constant-Time AES: Removing the Secret-Dependent Table Lookup Why a 256-byte S-box leaks key bits through cache behaviour, and how bit-slicing and vector permutes replace the lookup without changing the cipher.
- Jan 23, 2025 Hybrid Key Exchange with X25519 and ML-KEM-768 What happens to a TLS or SSH handshake when a lattice KEM is concatenated with an elliptic curve exchange, and which composition rules the transcript must obey.
- Jan 17, 2025 The Release of Unverified Plaintext Problem in AEAD APIs Why a decryption function that returns plaintext before the tag is checked reintroduces chosen-ciphertext attacks, and how streaming interfaces force the verification decision into the caller.
- Jan 13, 2025 Counter Block Layout and the Nonce Budget in CTR Mode How CTR turns a block cipher into a stream cipher, why the counter block must never repeat across messages under one key, and how the split between nonce and counter fixes the maximum message length.
- Dec 5, 2024 Threshold Secret Sharing and Why t of n Beats Two Copies Shamir sharing over a finite field, the arithmetic that makes any t shares sufficient, and the difference between hiding a key and requiring several parties to use it.
- Nov 3, 2024 Entropy Sources and the Path from Randomness to a Key Why a generated key is capped by the entropy behind it, how kernel pools and deterministic generators condition that entropy, and where the path breaks.
- Nov 2, 2024 CBC-MAC Ends at the Last Block, and That Is the Problem Chaining a block cipher over a message authenticates only the final block, so variable-length messages invite splicing attacks; CMAC adds two derived subkeys to close the hole.
- Nov 1, 2024 RSA Padding and Why Textbook RSA Fails Textbook RSA is multiplicative and deterministic, which makes it malleable and open to chosen-ciphertext attacks; how OAEP and PSS impose the structure that closes them.
- Oct 15, 2024 Rate and Capacity in the Sponge Construction How SHA-3 absorbs and squeezes through a fixed permutation, why capacity rather than digest width determines the security level, and what the rate costs in throughput.
- Aug 30, 2024 BLS Aggregation and the Rogue-Key Attack It Invites A pairing lets many signatures collapse into one, but the straightforward multisignature construction lets the last signer choose a key that frames the others.
- Aug 30, 2024 Elliptic Curve Point Arithmetic and Validation The group law on a short Weierstrass curve, why scalar multiplication uses a ladder rather than double-and-add, and which malformed points a peer can send.
- Jul 18, 2024 Key Commitment and Why an AEAD Can Decrypt Under Two Keys AEAD schemes are not committing by default, so a ciphertext forged to verify under two different keys splits the receiver into two views of the same message, with consequences for key rotation and message franking.
- Jul 15, 2024 ECDSA Nonce Reuse and the Private Key It Leaks A repeated signing nonce turns two signatures into a linear system that yields the private key, and biased nonces are nearly as bad because lattice reduction tolerates noise.
- Jun 19, 2024 What an HSM Boundary Actually Guarantees Which properties a hardware security module enforces, which it merely reports, and how key operations move across the boundary without exposing keys.
- May 27, 2024 LFSR Keystream Generators and the Linearity That Must Be Broken Why a shift register with linear feedback is a perfect pseudorandom generator and a useless cipher, and how combining several of them buys nonlinearity.
- May 15, 2024 How Differential Cryptanalysis Broke SHA-1 The modular-difference search, message-modification steps, and near-collision blocks that turn a 160-bit digest into two colliding PDFs, and why the margin was thinner than the bound implied.
- Mar 26, 2024 All-or-Nothing Transforms and the Extra Tightness in ML-KEM Why the Fujisaki-Okamoto transform alone leaves a small gap in decapsulation security, and how an all-or-nothing transform closes it for lattice schemes.
- Mar 21, 2024 Encrypt-and-MAC, MAC-then-Encrypt, Encrypt-then-MAC Three orderings of a cipher and a MAC, only one of which authenticates the ciphertext itself, and the attacks that distinguish them under chosen-ciphertext access.
- Feb 17, 2024 CCM: Combining a MAC and a Counter Inside One Mode How CCM derives a CTR nonce, a CBC-MAC IV, and a length-encoded authentication header to authenticate before encrypting, and what the two passes and the 16-byte block size cost.
- Jan 7, 2024 Collision Resistance and the Birthday Bound Why a hash needs roughly twice the output bits of the security level it claims, how the three resistance notions differ, and where the generic attacks stop applying.
- Dec 25, 2023 ARX Ciphers: Carry Chains as the Only Nonlinearity Why modular addition provides nonlinearity in add-rotate-xor designs, how carries propagate as a probabilistic process, and why diffusion is measured in bits.
- Oct 10, 2023 Constant-Time Arithmetic for Lattice Schemes Which operations in ML-KEM and ML-DSA leak through timing or cache behaviour, and how the standard techniques for secret-dependent branches and indexing apply to polynomial arithmetic.
- Oct 2, 2023 How a Padding Check Becomes a Decryption Oracle Byte-at-a-time plaintext recovery against CBC from a single bit of observable padding validity, the arithmetic that makes it work, and why constant-time unpadding does not close the hole.
- Aug 9, 2023 The AES State Matrix: Byte Ordering, ShiftRows, and MixColumns How sixteen key bytes map onto a four-by-four matrix, why the row shift moves different distances, and what MixColumns does to a column as a polynomial.
- Aug 2, 2023 Transporting a Key Versus Agreeing on One Key transport and key agreement solve the same problem with different assumptions about who holds what, and differ in what a compromise of one party yields.
- Jul 19, 2023 SIV and the Two-Pass Design of a Misuse-Resistant AEAD How deriving the nonce from the plaintext with a keyed hash removes the catastrophic failure of nonce reuse, at the cost of a second pass and the loss of streaming encryption.
- Feb 17, 2023 Poly1305 and the Arithmetic of a One-Time Key A 130-bit prime, a clamped scalar, and a carry structure that make a fast MAC provably secure only when each key is used exactly once.
- Nov 5, 2022 Protecting Key Material in Memory and at Rest What page locking, guard pages, and zeroization actually prevent, why memory safety languages change the calculus, and where stored keys leak.
- May 30, 2022 Inside ML-KEM: Noise Growth from Keygen to Decapsulation A concrete walk through KeyGen, Encaps and Decaps in FIPS 203, tracking the error term as powers of two so the compression parameters and failure bounds make sense.
- Apr 19, 2022 Discrete Logarithms and Why Group Order Decides Their Difficulty How Pohlig-Hellman reduces a discrete logarithm to its prime factors, why safe primes and Schnorr groups exist, and what small-subgroup confinement does to a protocol.
- Jan 9, 2022 RSA Key Generation and the Prime Search Generating two large primes, testing them for primality, deriving the private exponent, and why the resulting key has structure that must be checked rather than assumed.