1Classical Public-Key Security1Hardness Is Not a Single Assumption: What the Problems Behind RSA and Diffie-Hellman Really PromiseWatch2RSA Padding Oracles: From a Validity Bit to Lost SecrecyWatch3Weak Keys at Scale: Entropy Failures and Structured PrimesWatch4Chosen Public Keys: Subgroups, Invalid Curves and Acceptance RulesWatch5Beyond Nonce Reuse: Partial Leakage and the Limits of Deterministic SigningWatch6RSA Timing and CRT Faults: What Each Defence Actually CoversWatch
2Quantum Threat Quantified1Shor's Algorithm, Structurally: Period-Finding and the Quantum Fourier TransformWatch2Grover and the Symmetric World: Why the Speedup Only Halves SecurityWatch3From Logical to Physical Qubits: The Surface-Code Cost of a Real RSA BreakWatch4Resource Estimates and Timelines: Reading the Numbers CriticallyWatch5Mosca's Inequality: Turning Data Shelf-Life into a Migration PriorityWatch
3Lattice Foundations1Lattices and Their Hard Problems: SVP, CVP, and the Geometry of SecurityWatch2Learning With Errors: The Distribution, the Decision-Search Equivalence, and Regev's ReductionWatch3Ring-LWE and Module-LWE: Buying Efficiency with Algebraic StructureWatch4Parameters and the Security Estimate: Core-SVP, BKZ Block Size, and NIST LevelsWatch5Where the Assumptions Could Fail: Algebraic and Dual Attacks on Structured LatticesWatch
4ML-KEM End to End1From LWE to a Public-Key Scheme: Compression, Rounding, and a Secret Hidden in NoiseWatch2KEMs and IND-CCA, Defined: What a Key-Encapsulation Mechanism Must SurviveWatch3The Fujisaki-Okamoto Transform: From Passive to Active Security by Re-EncryptionWatch4Decapsulation Failures and Their Consequences: Failure-Boosting AttacksWatch5Implementation Realities: The NTT, Constant-Time Decapsulation, and the Parameter SetsWatch
5ML-KEM in Practice1What IND-CCA Does Not Promise: KEM Binding, Re-Encapsulation and the Shared Secret ML-KEM Hands YouWatch2Keys You Did Not Generate: Malicious Binding, the FIPS 203 Checks and the Seed-Versus-Expanded DecisionWatch3What a Formally Verified ML-KEM Actually Proves: Specifications, Models and the Gaps Between ThemWatch4ML-KEM Inside HPKE, X-Wing and SSH: What Each Construction Assumes of the KEMWatch
6Post-Quantum Signatures1What a Signature Must Guarantee: EUF-CMA and the Two Roads to ItWatch2ML-DSA: Fiat-Shamir with Aborts and the Transcript That Leaks NothingWatch3SLH-DSA: Signing from Hashing Alone, and the Hypertree That Buys StatelessnessWatch4Stateful Hash-Based Signatures: XMSS, LMS, and the Rule That Must Never BreakWatch5Choosing a Signature: A Decision Framework over Assumptions, Size, and Operational RiskWatch
7ML-DSA in Depth1What the ML-DSA Proof Actually Rests On: MLWE, SelfTargetMSIS and the Quantum Random OracleWatch2Strong Unforgeability and the Hint: Why a Byte-Exact Signature Matters for Logs, Tokens and LedgersWatch3Deterministic or Hedged: What the rnd Input Changes When an Attacker Can Fault the SignerWatch4Pure, Pre-Hash or External Mu: Splitting an ML-DSA Signature Across a Hardware BoundaryWatch5ML-DSA in Certificates and Tokens: Key Formats, Composites and What the RFCs Leave to YouWatch
8SLH-DSA in Depth1Tweakable Hashes and Multi-Target Attacks: What SLH-DSA's Addresses, Public Seed and Proof Actually BuyWatch2The Signature Budget: How FORS Turns Two-to-the-Sixty-Four into a Graceful Slope, and What s and f Really TradeWatch3SHA-2 versus SHAKE in SLH-DSA: The Category-Five Break, the SHA-512 Patch and the Single-Block TrickWatch4Fault Attacks on SLH-DSA: Tree Grafting, Why Verify-After-Sign Misses It, and the Countermeasures That HoldWatch5Choosing a Hash-Based Root in 2026: Full SLH-DSA, the Limited-Use Sets, or LMS and XMSSWatch
9Beyond Lattices1Why Assumption Diversity Matters: The Systemic Risk of a Single-Family BreakWatch2Code-Based Cryptography: Classic McEliece, Syndrome Decoding, and a Sixty-Year Track RecordWatch3HQC and BIKE: Quasi-Cyclic Codes, the Backup-KEM Decision, and Decoding-Failure Trade-offsWatch4Multivariate Cryptography: The MQ Problem, Why Rainbow Fell, and What Still StandsWatch5When to Reach for a Non-Lattice Scheme: A Decision Framework over Size, Maturity, and RiskWatch
10Symmetric Crypto Quantum Era1Grover Against Block Ciphers: The Quadratic Speedup, Double the Key Length, and the Parallelization CaveatsWatch2Hash Functions Under Quantum Search: Pre-image versus Collision, and Why Grover Does Not Halve Collision ResistanceWatch3AES-256 and SHA-384/512 as the Safe Floor: The Concrete Security Margins for the Top LevelsWatch4Authenticated Encryption and Key Commitment: AEAD Guarantees and the Commitment Gap for AgentsWatch5Where Symmetric Assumptions Are Load-Bearing: Hash-Based Signatures, KDFs, and the PQC Standards ThemselvesWatch
11PQC Implementation Security1The Side-Channel Threat Model for Post-Quantum CryptographyWatch2Timing and the Decapsulation Oracle: When Non-Constant-Time Handling Leaks the PlaintextWatch3Power and Electromagnetic Attacks on the NTT and the SamplerWatch4Masking and Countermeasures: Arithmetic-to-Boolean Shares and the Cost of Provable ResistanceWatch5Verifying Constant-Time: Tooling and Methodology to Demonstrate a Leak-Free ImplementationWatch
12Migrating to Post-Quantum1Hybrid Key Exchange, Done Right: Combining Classical and Post-Quantum So Either Can FailWatch2Post-Quantum in TLS 1.3: The X25519MLKEM768 Group and the MTU RealitiesWatch3Certificates and PKI Under Post-Quantum: Signature Bloat and Chain StrategiesWatch4Crypto-Agility as an Architecture Property: Escaping the Hard-Coded-Primitive TrapWatch5A Migration Methodology: Inventory, Shelf-Life Risk, Hybridize, and MeasureWatch
13Threat Modeling PQC Migration1Framing the Post-Quantum Threat Model: Assets, Adversaries, and BoundariesWatch2Harvest-Now-Decrypt-Later as the Anchor Threat: Building a Data-at-Risk InventoryWatch3Downgrade, Rollback, and Negotiation Attacks: The Adversary That Strips the PQCWatch4The Migration's Own Attack Surface: Combiners, Dual Stacks, and Key-Management GapsWatch5A Post-Quantum Threat-Modeling Playbook: Inventory, Attack Trees, Controls, and a CI GateWatch
14Zero-Knowledge Proofs1Interactive Proofs and Zero-Knowledge, Defined: Completeness, Soundness, and the SimulatorWatch2From Interactive to Non-Interactive: Fiat-Shamir, Commitments, and the Random-Oracle CaveatWatch3SNARKs: Succinct Arguments, the Arithmetic-Circuit Pipeline, and the Trusted-Setup QuestionWatch4STARKs and Transparency: Hash-Based, Post-Quantum-Plausible Proofs Without Trusted SetupWatch5Proving an ML Inference: zkML, the Committed-Input Guarantee, and the Honest CostWatch
15Homomorphic Encryption1Computing on Ciphertext: The FHE Promise, Noise Growth, and Why Bootstrapping Is the Central IdeaWatch2The Scheme Families: BGV/BFV Exact Integers versus CKKS Approximate RealsWatch3Bootstrapping and Its Cost: Refreshing Noise and the Parameter, Security, Performance TriangleWatch4Private Inference on Neural Networks: Approximating Non-Linearities Under FHEWatch5FHE versus TEEs versus MPC: An Honest Comparison for Confidential LLM ServingWatch
16Secure Multi-Party Computation1The MPC Guarantee, Defined: Computing Without Revealing Inputs, and the Adversary ModelsWatch2Secret Sharing and Threshold Cryptography: Shamir, Additive Shares, and Threshold DecryptionWatch3Garbled Circuits and GMW: Two Routes to General Multi-Party Computation and Their Trade-offsWatch4Private Set Intersection and Federated Primitives: The Workhorses of Privacy-Preserving JoinsWatch5MPC for Machine Learning: Federated Learning, Secure Aggregation, and the Confidential-Computing TrioWatch