About this book

This book pairs an analysis of the PQC migration with from-scratch implementations from four post-quantum families: lattice-based, hash-based, code-based, and isogeny-based. The ML-KEM and SLH-DSA builds are checked against the official NIST vectors; the code-based and isogeny-based builds are pedagogical toys whose chapters document how they differ from the schemes they model. Multivariate signatures get a worked toy rather than a from-scratch implementation. Every claim is cited or derived in-text. Every code block is tested. The book is the canonical post-quantum cryptography text at Encryptorium; the code is MIT-licensed and the prose is licensed under CC BY-SA 4.0.

Who this book is for

Security engineers, protocol designers, and cryptography practitioners who need to reason about post-quantum schemes well enough to implement, deploy, or attack them. The reader should be able to write Python and follow textbook-style proofs. Beyond that, the requirements are listed on the Prerequisites page; the book builds the rest from first principles.

Motivated learners who satisfy the prerequisites can also work through it.

Who this book is not for

Readers who want a non-technical overview of the PQC migration will not find one here. For that audience, the Encryptorium site at encryptorium.com publishes the Post-Quantum Readiness Assessment framework and a public blog series.

Readers without a solid grounding in classical algorithms, basic linear algebra, comfort with Python 3, or exposure to deployed cryptography such as TLS and AES will need to brush up first. Pointers to specific resources are on the Prerequisites page.

Reader promise

By the end of this book, you will have implemented one member of each of four post-quantum families from scratch: lattice-based, hash-based, code-based, and isogeny-based. Two of these implementations are checked against the official NIST test vectors: ML-KEM in Chapter 11 and SLH-DSA in Chapter 16. Each is reached in stages: Regev encryption in Chapter 10, Lamport signatures and Merkle trees in Chapter 13, WOTS+ and XMSS in Chapter 14, and FORS and the hypertree in Chapter 15. The code-based and isogeny-based builds are pedagogical toys: McEliece in Chapter 19, HQC in Chapter 20, SIDH in Chapter 21, and SQIsign in Chapter 22. Each of those chapters states how its code differs from the scheme it models. Multivariate signatures get a survey chapter with a worked toy UOV, not a standalone implementation. You will know why each scheme exists, what its assumptions are, which attacks it resists, and how to plan the migration of a real system to post-quantum cryptography. You will be prepared to analyze which layers of a zero-knowledge system must change to retain post-quantum security.

How the book is organized

The book consists of seven Parts and four appendices. Each Part progresses from intuition to construction to attacks to tradeoffs.

Part I: Foundations. Quantum threat modeling against classical public-key crypto, mathematical preliminaries (modular arithmetic, finite fields, polynomial rings, basic linear algebra), the hard problems underlying the later cryptographic constructions, and the KEM and signature interfaces. Part I builds the algebra used by Parts II through IV.

Part II: Lattice-based cryptography. The LWE problem, Ring-LWE, Module-LWE, Regev encryption from scratch, and ML-KEM (FIPS 203) implemented from scratch, reproducing the NIST ACVP key generation, encapsulation, and decapsulation vectors byte for byte across all three parameter sets. The cryptanalysis chapter covers BKZ, primal attacks, and dual attacks.

Part III: Hash-based signatures. Lamport one-time signatures, Merkle trees, XMSS, Winternitz, FORS, and SLH-DSA (FIPS 205) implemented from scratch. The SLH-DSA build reproduces the NIST ACVP key generation vectors byte for byte across all twelve parameter sets, with signing verified by deterministic sign-verify round-trips. The cryptanalysis chapter covers generic and structural attacks.

Part IV: Code-based and isogeny-based cryptography. Coding theory, a toy McEliece-style PKE contrasted against the Classic McEliece submission, and an HQC implementation from scratch (an IND-CPA pedagogical toy, with documented divergences from the current HQC specification of August 2025). The isogeny half builds a toy SIDH key exchange from scratch at $p = 431$ and then covers the 2022 Castryck-Decru attack that broke it, leaving SIKE unselected in NIST IR 8545. It ends with a SQIsign implementation from scratch, pedagogical-only at the same prime, with breadth-first search standing in for KLPT and documented compliance gaps. A closing chapter covers the multivariate signature families (UOV, MAYO, and SNOVA).

Part V: Migration and deployment. CBOM-based cryptographic inventory, crypto agility, hybrid schemes, TLS and SSH migration, PKI and code-signing, and the operational shape of running a PQ migration program.

Part VI: Post-quantum zero-knowledge. A four-layer decomposition of any ZK system, PQ-secure commitment schemes, Fiat-Shamir in the QROM, STARKs and FRI, and case studies on Zcash, ZKsync, and Starknet.

Part VII: Post-quantum blockchain. A quantum threat model for blockchains, Layer-1 signature migration on Bitcoin and Ethereum, wallet derivation and key rotation, consensus and staking signatures (BLS over BLS12-381), ZK rollups, and governance and hard forks with case studies. Part VII reuses the migration-program scaffolding from Part V (the agility framing in Chapter 25 and the four-phase program in Chapter 29) and applies it to blockchain systems.

The appendices are reference material:

• Appendix A is a glossary of the book’s scheme names, acronyms, and recurring technical terms. Most entries give a one-sentence definition and a back-reference to the chapter that introduces the term or covers it in depth; alias forms point to the canonical entry. It is a lookup table for the vocabulary the chapters build on, not an index of every term the text uses.
• Appendix B lists every reserved mathematical symbol, grouped by Part, with flags for symbols whose meaning shifts across Parts.
• Appendix C documents the contract for running the code: CPython 3.10+, the standard library where possible, NumPy 1.26+ for the lattice chapters, virtualenv setup, and the verification commands.
• Appendix D contains worked solutions to every exercise.

The rigor bar

Three rules apply to every chapter, without exception.

• Every mathematical claim is either cited to a source listed in the bibliography or derived in-text. There is no hand-waving and no “it can be shown”.
• Every code block is annotated with a # ==> expected-output marker and is verified to produce that output on the Appendix C environment: CPython 3.10 or newer, the standard library, plus NumPy 1.26 or newer for the lattice chapters. The verification gate is part of CI.
• Every flagship implementation is tested against the official NIST test vectors where applicable. ML-KEM (FIPS 203) reproduces the ACVP key generation, encapsulation, and decapsulation vectors byte for byte across all three parameter sets. SLH-DSA (FIPS 205) reproduces the ACVP key generation vectors across all twelve parameter sets, with signing verified by deterministic sign-verify round-trips rather than by vectors. The HQC and SQIsign chapters document how their pedagogical implementations differ from the schemes they model, and why.

The reader can therefore trust two things: every algorithm runs, and every claim is sourced. If a reader spots a violation of either, that is a bug. Report it to contact@encryptorium.com, or open an issue on the companion code repository.

How the book is released

The book ships one chapter at a time, one Part at a time. The full draft is complete; the editorial review and public release proceed chapter by chapter on a regular release schedule. Chapters that have shipped are stable; substantive edits to a shipped chapter are tracked in git history.

How to read this book

Three paths through the book:

1. Linearly, from Chapter 1. This is the default and the order in which the book was written. Each chapter builds on the ones before it.
2. From a specific Part you care about. A reader with the algebra background Part II assumes can start at Chapter 7 (Lattices). A reader who wants only the migration material can start at Part V. Chapters name the earlier chapters they rely on where they first use them, so a reader picking up Part III directly knows which earlier sections to look up and skim.
3. As a reference. Use Appendix A’s glossary to find a term and the chapter that introduces it, then go to that chapter. Use Appendix B to look up a symbol.

If a passage feels dense, verify the math by hand or in a Python REPL; that is the intended mode.