The Encryptorium Book of Post-Quantum Cryptography

41 chapters7 parts4 appendices281 verified code blocks342 cited sources

Reader promise

By the end of this book, you will have implemented one member of each of four post-quantum families from scratch: lattice-based, hash-based, code-based, and isogeny-based. The lattice Part builds two, ML-KEM and ML-DSA. Those two and SLH-DSA are checked against the official NIST vectors. The code-based and isogeny-based builds are pedagogical toys, and each chapter states how its code differs from the scheme it models. Multivariate signatures get a chapter and a worked toy UOV, not a from-scratch implementation. You will know why each scheme exists, what its assumptions are, which attacks it resists, and how to plan the migration of a real system to post-quantum cryptography. You will be prepared to analyze which layers of a zero-knowledge system must change to retain post-quantum security.

For more on who this is for and the assumed background, see About this book and Prerequisites.

Contents

The book consists of seven Parts and four appendices. Each Part progresses from intuition to construction to attacks to tradeoffs.

All 41 chapters are published.

Part I: Foundations

1 The quantum threat › 2 Mathematical preliminaries › 3 Hard problems at a glance › 4 From classical to post-quantum › 5 KEMs vs key agreement vs public-key encryption › 6 Digital signatures reconsidered ›

Part II: Lattice-based cryptography

7 Lattices for programmers › 8 The LWE problem › 9 Ring-LWE and Module-LWE › 10 Regev encryption from scratch › 11 ML-KEM (FIPS 203) from scratch › 12 ML-DSA (FIPS 204) from scratch › 13 Lattice cryptanalysis ›

Part III: Hash-based signatures

14 One-time signatures from hash functions › 15 Many-time signatures › 16 FORS and the stateless hypertree › 17 SLH-DSA (FIPS 205) from scratch › 18 Hash-based signature cryptanalysis ›

Part IV: Code-based and isogeny-based cryptography

19 Coding theory for cryptographers › 20 McEliece: the original PQC › 21 HQC, a pedagogical implementation › 22 Isogenies for programmers › 23 SQIsign in a toy setting › 24 Multivariate signature schemes ›

Part V: Migration and deployment

25 Inventory first: CBOM › 26 Crypto agility › 27 Hybrid schemes in practice › 28 TLS 1.3 migration › 29 PKI and code signing › 30 Running a PQ migration program ›

Part VI: Post-quantum zero-knowledge

31 The four-layer decomposition › 32 PQ-secure commitment schemes › 33 Fiat-Shamir in the QROM › 34 STARKs and FRI revisited › 35 Case studies: Zcash, ZKsync, Starknet ›

Part VII: Post-quantum blockchain

36 Quantum threat model for blockchains › 37 Layer-1 signature migration: Bitcoin and Ethereum › 38 Wallets, addresses, and key rotation › 39 Consensus and staking signatures › 40 Quantum threats to ZK rollups › 41 Governance, hard forks, and migration case studies ›

Appendices

A Glossary › B Notation reference › C Environment setup › D Solutions ›

About the author

Written by Andreas Renz for Encryptorium. Grounded in published blog posts, the Post-Quantum Readiness Assessment framework, and the self-published technical report Post-Quantum Risk in Deployed Zero-Knowledge Architectures: A Layered Analysis (2026, not peer reviewed).