About this book

This book pairs an analysis of the PQC migration with from-scratch implementations from four post-quantum families: lattice-based, hash-based, code-based, and isogeny-based. The ML-KEM, ML-DSA, and SLH-DSA builds are checked against the official NIST vectors; the code-based and isogeny-based builds are pedagogical toys whose chapters document how they differ from the schemes they model. Multivariate signatures get a worked toy rather than a from-scratch implementation. Every claim is cited or derived in-text. Every code block meant to run standalone is tested. The book is the canonical post-quantum cryptography text at Encryptorium. The code is MIT-licensed and the prose is licensed under CC BY-SA 4.0.

Who this book is for

Security engineers, protocol designers, and cryptography practitioners who need to reason about post-quantum schemes well enough to implement, deploy, or attack them. The reader should be able to write Python and follow textbook-style proofs. Beyond that, the requirements are listed on the Prerequisites page. The book builds the rest from first principles.

Motivated learners who satisfy the prerequisites can also work through it.

Who this book is not for

Readers who want a non-technical overview of the PQC migration will not find one here. For that audience, the Encryptorium site at encryptorium.com publishes the Post-Quantum Readiness Assessment framework and a public blog series.

Readers without a solid grounding in classical algorithms, basic linear algebra, comfort with Python 3, or exposure to deployed cryptography such as TLS and AES will need to brush up first. Pointers to specific resources are on the Prerequisites page.

Reader promise

By the end of this book, you will have implemented one member of each of four post-quantum families from scratch: lattice-based, hash-based, code-based, and isogeny-based. Three of the book’s from-scratch implementations are checked against the official NIST test vectors: ML-KEM in Chapter 11, ML-DSA in Chapter 12, and SLH-DSA in Chapter 17. Each is reached in stages: Regev encryption in Chapter 10, Lamport signatures and Merkle trees in Chapter 14, WOTS+ and XMSS in Chapter 15, and FORS and the hypertree in Chapter 16. The code-based and isogeny-based builds are pedagogical toys: McEliece in Chapter 20, HQC in Chapter 21, SIDH in Chapter 22, and SQIsign in Chapter 23. Each of those chapters states how its code differs from the scheme it models. Multivariate signatures get a survey chapter with a worked toy UOV, not a standalone implementation. You will know why each scheme exists, what its assumptions are, which attacks it resists, and how to plan the migration of a real system to post-quantum cryptography. You will be prepared to analyze which layers of a zero-knowledge system must change to retain post-quantum security.

How the book is organized

The book consists of seven Parts and four appendices. Each Part progresses from intuition to construction to attacks to tradeoffs.

Part I: Foundations. Quantum threat modeling against classical public-key crypto, mathematical preliminaries (modular arithmetic, finite fields, polynomial rings, basic linear algebra), the hard problems underlying the later cryptographic constructions, and the KEM and signature interfaces. Part I builds the algebra used by Parts II, IV, and VI. Part III’s hash-based signatures rest on a different toolbox, which Chapter 14 introduces on its own terms.

Part II: Lattice-based cryptography. The LWE problem, Ring-LWE, Module-LWE, Regev encryption from scratch, and ML-KEM (FIPS 203) implemented from scratch, reproducing the NIST ACVP key generation, encapsulation, and decapsulation vectors byte for byte across all three parameter sets. ML-DSA (FIPS 204), the module-lattice signature standard, is built from scratch in Chapter 12, reproducing the NIST ACVP key generation, signing, and verification vectors for all three parameter sets. The cryptanalysis chapter covers BKZ, primal attacks, and dual attacks.

Part III: Hash-based signatures. Lamport one-time signatures, Merkle trees, XMSS, Winternitz, FORS, and SLH-DSA (FIPS 205) implemented from scratch. The SLH-DSA build reproduces the NIST ACVP key generation vectors byte for byte across all twelve parameter sets, and ACVP signatures byte for byte at the six fast sets. It accepts every valid ACVP signature-verification case at all twelve, and rejects the invalid cases, which the fixture supplies at the two 128s sets. The cryptanalysis chapter covers generic and structural attacks.

Part IV: Code-based and isogeny-based cryptography. Coding theory, a toy McEliece-style PKE contrasted against the Classic McEliece submission, and an HQC implementation from scratch (an IND-CPA pedagogical toy, with documented divergences from the current HQC specification of August 2025). The isogeny half builds a toy SIDH key exchange from scratch at $p = 431$ and then covers the 2022 Castryck-Decru attack that broke it, leaving SIKE unselected in NIST IR 8545. It ends with a SQIsign implementation from scratch, pedagogical-only at the same prime, with breadth-first search standing in for the quaternion-side machinery the real scheme uses to find connecting isogenies, and documented compliance gaps. A closing chapter covers the multivariate signature families (UOV, MAYO, and SNOVA).

Part V: Migration and deployment. CBOM-based cryptographic inventory, crypto agility, hybrid schemes, TLS 1.3 migration, PKI and code-signing, and the operational shape of running a PQ migration program.

Part VI: Post-quantum zero-knowledge. A four-layer decomposition of any ZK system, PQ-secure commitment schemes, Fiat-Shamir in the QROM, STARKs and FRI, and case studies on Zcash, ZKsync, and Starknet.

Part VII: Post-quantum blockchain. A quantum threat model for blockchains, Layer-1 signature migration on Bitcoin and Ethereum, wallet derivation and key rotation, consensus and staking signatures (BLS over BLS12-381), ZK rollups, and governance and hard forks with case studies. Part VII reuses the migration-program scaffolding from Part V (the agility framing in Chapter 26 and the four-phase program in Chapter 30) and applies it to blockchain systems.

The appendices are reference material:

• Appendix A is a glossary of the book’s scheme names, acronyms, and recurring technical terms. Most entries give a one-sentence definition and a back-reference to the chapter that introduces the term or covers it in depth; alias forms point to the canonical entry. It is a lookup table for the vocabulary the chapters build on, not an index of every term the text uses.
• Appendix B lists the reserved mathematical symbols of every Part, grouped by Part, with flags for symbols whose meaning shifts across Parts.
• Appendix C documents the contract for running the code: CPython 3.10+, the standard library where possible, NumPy 1.26+ for the lattice chapters, virtualenv setup, and the verification commands.
• Appendix D contains a worked solution for every compute and derivation exercise, and an editorial note on what a strong answer addresses for every open-ended one.

Every Python block a chapter prints and CI runs is also a file in the companion repository, under chapter-code/chNN/, generated from the chapter text and run by the same gate that checks the printed output. Nothing needs retyping to be run. The exception is a block tagged no-verify, a sketch not meant to run standalone: CI does not run it, so it is not shipped there either.

There is a second exercise track, which every chapter points at from the close of its own Exercises section. Every chapter with a code package ships that package twice in the companion repository: once complete under solutions/, and once under exercises/ with the functions the chapter teaches replaced by stubs. Each stub keeps its signature and states what it owes its caller, and the chapter’s test suite runs against either tree. Implementing a chapter yourself is PQC_IMPL=exercises pytest tests/chNN, which starts red and goes green as you fill the stubs in. Appendix C covers the setup.

The rigor bar

Three rules apply to every chapter, without exception.

• Every mathematical claim is either cited to a source listed in the bibliography or derived in-text. There is no hand-waving and no “it can be shown”.
• Every code block meant to run standalone is annotated with a # ==> expected-output marker and is verified to produce that output on the Appendix C environment: CPython 3.10 or newer, the standard library, plus NumPy 1.26 or newer for the lattice chapters. The verification gate is part of CI.
• Every flagship implementation is tested against the official NIST test vectors where applicable. ML-KEM (FIPS 203) reproduces the ACVP key generation, encapsulation, and decapsulation vectors byte for byte across all three parameter sets. ML-DSA (FIPS 204) reproduces the ACVP key generation, signing, and verification vectors byte for byte across all three parameter sets. SLH-DSA (FIPS 205) reproduces the ACVP key generation vectors across all twelve parameter sets, is checked against the ACVP signature-verification vectors at all twelve, and reproduces ACVP signatures byte for byte at the six fast sets. Signing at the six small-signature sets is too slow to run under CI and is covered by verification vectors only. The HQC and SQIsign chapters document how their pedagogical implementations differ from the schemes they model, and why.

The reader can therefore trust two things: every algorithm runs, and every claim is sourced. If a reader spots a violation of either, that is a bug. Report it to contact@encryptorium.com, or open an issue on the companion code repository.

How to read this book

Three paths through the book:

1. Linearly, from Chapter 1. This is the default and the order in which the book was written. Each chapter builds on the ones before it.
2. From a specific Part you care about. A reader with the algebra background Part II assumes can start at Chapter 7 (Lattices). A reader who wants only the migration material can start at Part V. Chapters name the earlier chapters they rely on where they first use them, so a reader picking up Part III directly knows which earlier sections to look up and skim.
3. As a reference. Use Appendix A’s glossary to find a term and the chapter that introduces it, then go to that chapter. Use Appendix B to look up a symbol.

If a passage feels dense, verify the math by hand or in a Python REPL. That is the intended mode.