Appendix A: Glossary

This glossary is a lookup table. Every entry gives a one-sentence definition and a back-reference to the chapter where the term is introduced or covered in depth. Alias forms point to the canonical term. When a scheme has a construction name (Kyber) and a standard name (ML-KEM), the canonical entry is the standard name and the construction name points at it.

Acronyms used across the book that are not cryptographic (NIST, IACR, NCSC, RFC, FIPS) carry a definition here because their meaning governs a lot of the book’s structure.

A

Account model. Ethereum’s transaction model where each account holds a balance and a nonce, and signatures authenticate state-update transactions; contrasts with Bitcoin’s UTXO model. Introduced in Chapter 36.
ACVP (Automated Cryptography Validation Protocol). NIST’s framework for validating cryptographic implementations against published test vectors. The book’s flagship implementations are tested against ACVP vectors byte-for-byte. Introduced in Chapter 11.
ADRS (Address). The 32-byte domain separator in SLH-DSA that encodes the position of every hash call within the hypertree. Introduced in Chapter 16.
AEAD (Authenticated Encryption with Associated Data). A symmetric mode that provides both confidentiality and integrity for a message while binding unencrypted associated data to the ciphertext; TLS 1.3 uses AES-GCM, AES-CCM, or ChaCha20-Poly1305. Introduced in Chapter 1, referenced in Chapter 5.
AES (Advanced Encryption Standard). The symmetric block cipher standardized in FIPS 197. Grover’s algorithm halves its effective key length in the quantum adversary model; AES-256 is considered quantum-safe, AES-128 is not. Introduced in Chapter 1.
AIR (Algebraic Intermediate Representation). The constraint language STARKs compile programs to: a set of polynomial constraints over a trace table. Introduced in Chapter 30, developed in Chapter 33.
ALPN (Application-Layer Protocol Negotiation). The TLS extension that lets client and server pick an application protocol during the handshake. Relevant to PQ migration because mid-handshake negotiation constrains the wire format. Not explicitly discussed in this edition; included here for practitioners reading Part V alongside ALPN-aware TLS documentation.
ASIC (Application-Specific Integrated Circuit). Custom silicon built for one computation; matters in cryptanalysis because lattice sieving has been a persistent ASIC target. Introduced in Chapter 12.

B

BDD (Bounded Distance Decoding). The lattice problem of finding the lattice point closest to a target that is guaranteed to lie within a specified distance from the lattice. The LWE problem reduces to BDD and then to uSVP via the Kannan embedding. Introduced in Chapter 8.
Bitcoin. The first cryptocurrency, launched in 2009; transactions sign with ECDSA over secp256k1, and Taproot adds Schnorr over the same curve. Introduced in Chapter 36.
BKZ (Block Korkine-Zolotarev). A lattice-basis reduction algorithm parameterized by a block size; BKZ-β is the state of the art for attacking lattice-based schemes and sets the cost curve used in NIST’s security categories. Introduced in Chapter 12.
Blockchain. A distributed append-only ledger where transactions are grouped into cryptographically linked blocks. Introduced in Chapter 35.
BLS12-381. A pairing-friendly elliptic curve used by Zcash, Ethereum staking, and many pairing-based SNARKs; Shor’s algorithm breaks the underlying discrete-log assumption. Introduced in Chapter 38.
BLS signature. The Boneh-Lynn-Shacham signature scheme based on pairings; aggregates trivially across attestations, and Shor’s algorithm breaks the underlying assumption. Introduced in Chapter 38.

C

CBC (Cipher Block Chaining). A block-cipher mode of operation used as a foil for modern authenticated modes; not a construction the book builds. Referenced in Chapter 5.
CBD (Centered Binomial Distribution). The discrete error distribution ML-KEM samples from, with support $\{-\eta, \ldots, \eta\}$ and parameters fixed per security level. Introduced in Chapter 9.
CBOM (Cryptographic Bill of Materials). A machine-readable inventory of every cryptographic primitive, key, protocol, and dependency in a system. The CycloneDX 1.6 schema defines the format used in Chapter 24’s hands-on example. Introduced in Chapter 24.
CCA (Chosen-Ciphertext Attack). The adversarial model in which the attacker can query a decryption oracle. See IND-CCA2. Introduced in Chapter 5.
CCA2. See IND-CCA2.
Centered binomial distribution. See CBD.
Classic McEliece. The 1978 code-based KEM by Robert McEliece, updated and submitted to NIST’s PQC process; public keys are hundreds of kilobytes. Introduced in Chapter 19.
CNFL (Collect Now, Forge Later). The adversarial strategy of recording signatures today and forging them after a quantum computer arrives; the signature-side counterpart to HNDL. Introduced in Chapter 1.
CNSA 2.0 (Commercial National Security Algorithm Suite 2.0). The NSA’s 2022 suite of algorithms approved for U.S. national security systems; mandates ML-KEM, ML-DSA, and SLH-DSA on specific migration timelines. Introduced in Chapter 1.
Consensus signature. The signature that authenticates a validator’s vote on a block at the chain’s heartbeat in a proof-of-stake system. Introduced in Chapter 38.
Core-SVP. A cost model for lattice attacks that charges each SVP oracle call at block size $\beta$ as $2^{0.292\beta}$ classically and $2^{0.265\beta}$ quantumly; the model NIST uses to set ML-KEM parameters. Introduced in Chapter 12.
CPA (Chosen-Plaintext Attack). The adversarial model in which the attacker can query an encryption oracle. See IND-CPA. Introduced in Chapter 5.
CRQC (Cryptographically Relevant Quantum Computer). A fault-tolerant quantum computer large enough to run Shor’s algorithm against deployed parameters such as RSA-2048 or a 256-bit elliptic curve. The $Z$ term of the Mosca inequality is the time until one exists. Introduced in Chapter 1.
CRS (Common Reference String). A public string that prover and verifier share before a zero-knowledge protocol runs; STARKs avoid it, Groth16 needs a trusted one. Introduced in Chapter 30.
CSR (Certificate Signing Request). The X.509 structure a subject sends to a certificate authority to request a signed certificate. Not explicitly discussed in this edition; included here for practitioners working with CA infrastructure alongside Chapter 28.
CVP (Closest Vector Problem). Given a lattice and a target vector, find the lattice point closest to the target. NP-hard in general. Introduced in Chapter 3.

D

DEM (Data Encapsulation Mechanism). The symmetric half of a KEM-DEM hybrid encryption scheme: the KEM establishes a key, the DEM encrypts the message under it. Introduced in Chapter 5.
DH (Diffie-Hellman). The 1976 key-agreement protocol over a cyclic group. Shor breaks it in polynomial time. Introduced in Chapter 4.
DHKEM. The generic construction turning a Diffie-Hellman group into a KEM; RFC 9180 specifies instantiations. Introduced in Chapter 26.
Dilithium. The construction name for the signature scheme standardized as ML-DSA in FIPS 204. Referenced in Chapter 32 as a Fiat-Shamir-with-aborts signature.
Discrete logarithm. Given a group element $g$ and $h = g^x$ , recover the exponent $x$ . Classically hard in the groups deployed today; Shor solves it in polynomial time. See ECDLP for the elliptic-curve case. Introduced in Chapter 1; Chapter 4 builds ECDSA on the elliptic-curve case and sketches Shor’s reduction.
DLWE (Decisional LWE). The decision version of LWE: distinguish LWE samples from uniform. Introduced in Chapter 8.

E

ECDH (Elliptic Curve Diffie-Hellman). Key agreement over an elliptic-curve group; Shor breaks it. Introduced in Chapter 1.
ECDLP (Elliptic Curve Discrete Logarithm Problem). Given $Q = dG$ , recover the scalar $d$ . Shor solves it in polynomial time on a fault-tolerant quantum computer. Introduced in Chapter 1.
ECDSA (Elliptic Curve Digital Signature Algorithm). The signature scheme based on ECDLP used by most public blockchains and many TLS servers; Shor breaks it. Introduced in Chapter 1; constructed and walked in Chapter 4.
Ed25519. The EdDSA signature scheme instantiated on Curve25519; Shor breaks it. Referenced in Chapters 1, 25, 26, 28, and 29.
EdDSA. The Edwards-curve signature family; Shor breaks it. Referenced in Chapter 1.
Ethereum. The smart-contract platform launched in 2015; transactions sign with ECDSA over secp256k1, and post-merge consensus signatures use BLS over BLS12-381. Introduced in Chapter 36.
EUF-CMA (Existential Unforgeability under Chosen-Message Attack). The standard unforgeability game for signatures: the adversary signs messages of its choice and must produce a signature on a new message. Introduced in Chapter 6.

F

Fiat-Shamir transform. The compiler that turns a public-coin interactive proof into a non-interactive one by deriving the verifier’s coins from a hash of the transcript. Introduced in Chapter 30, analyzed in the QROM in Chapter 32.
Finality. The state at which a block cannot be reversed by chain reorganization; Chapter 35 uses the window between mempool broadcast and finality as the CNFL exposure surface for pending transactions. Referenced in Chapter 35.
FIPS (Federal Information Processing Standard). NIST publication series carrying U.S. federal cryptographic requirements. FIPS 203 standardizes ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA. Introduced in Chapter 1.
FO transform (Fujisaki-Okamoto transform). The generic compiler that lifts an IND-CPA public-key encryption scheme to an IND-CCA2 KEM. ML-KEM instantiates the $U^{\not\perp}$ variant (implicit rejection), where a tampered ciphertext returns a pseudorandom key derived from a rejection seed rather than the $\perp$ symbol. Introduced in Chapter 5, applied in Chapter 11 and Chapter 20.
FORS (Forest Of Random Subsets). The few-time signature primitive inside SLH-DSA: a forest of Merkle trees, each signing one chunk of the message digest. Introduced in Chapter 15.
Forward secrecy. The property that compromising a long-term key does not expose past sessions, because session keys come from an ephemeral key exchange. It does not survive a quantum attacker when the ephemeral group is Shor-reducible. Introduced in Chapter 1.
FRI (Fast Reed-Solomon Interactive Oracle Proof). The low-degree testing protocol that anchors STARKs. Introduced in Chapter 31, developed in Chapter 33.
Fundamental parallelepiped. The half-open parallelepiped $\{Bx : 0 \leq x_i < 1\}$ of a lattice basis $B$ ; its volume equals the lattice determinant. Introduced in Chapter 7.

G

GapSVP. The decision version of SVP: decide whether the shortest vector is at most 1 or at least $\gamma$ , given a promise. Introduced in Chapter 3.
Gas. Ethereum’s unit of computation cost. Introduced in Chapter 36.
GCD (Greatest Common Divisor). The classical algorithm used to complete the Shor attack on RSA after quantum period finding returns a candidate period. Introduced in Chapter 1, walked in Chapter 4.
Goppa code. The algebraic code family Classic McEliece uses; efficient decoding via Patterson’s algorithm is the trapdoor. Introduced in Chapter 19.
Groth16. The pairing-based zk-SNARK with the smallest proofs in use; Shor breaks its pairing assumption. Referenced in Chapter 34 as the baseline for pairing-based ZK under a quantum threat model.
Grover’s algorithm. The quantum unstructured-search algorithm with quadratic speedup. Halves symmetric key strength in the quantum model: AES-128 → 64 bits, SHA-256 preimage → 128 bits. Introduced in Chapter 1.
GSA (Geometric Series Assumption). The heuristic from Schnorr 2003 that the Gram-Schmidt norms of a BKZ-reduced basis form a geometric sequence with ratio $\delta(\beta)^{-2}$ ; used to derive the primal-attack success condition in lattice cryptanalysis. Introduced in Chapter 12.

H

Hard fork. A consensus-rule change that requires every node to upgrade; the path Bitcoin and Ethereum must take to swap signature algorithms because the verifier-set logic is fixed at the protocol layer. Introduced in Chapter 40.
HKDF (HMAC-based Key Derivation Function). The RFC 5869 key-derivation function combining an HMAC-Extract step with an HMAC-Expand step; the hybrid combiner in Chapter 26 feeds component secrets through HKDF-SHA256. Introduced in Chapter 5, applied in Chapter 26.
HNDL (Harvest Now, Decrypt Later). The adversarial strategy of recording TLS traffic today and decrypting it once a quantum computer exists. The reason PQ key exchange is urgent. Introduced in Chapter 1.
HQC (Hamming Quasi-Cyclic). The code-based KEM selected by NIST in March 2025 as a second KEM standard distinct from ML-KEM; built from quasi-cyclic codes over the binary Hamming metric. The FIPS document number is pending at the time of writing. Introduced in Chapter 20.
HSM (Hardware Security Module). Tamper-resistant hardware that generates, stores, and uses long-term keys; PQ migration is constrained by how quickly HSM vendors ship firmware supporting the new algorithms. Introduced in Chapter 28.
Hybrid signature. A signature that concatenates (or composites) a classical signature and a post-quantum signature, verifying if both verify. Introduced in Chapter 26, applied in Chapter 28.
Hybrid key exchange. A key agreement combining a classical component (X25519) and a post-quantum component (ML-KEM) in parallel, with the session key derived from both. The deployed form is X25519MLKEM768; see its own entry. Introduced in Chapter 26.
Hypertree. The multi-layer Merkle tree inside SLH-DSA: WOTS+ leaves at each layer, and each layer’s root is signed by the next. Introduced in Chapter 16.

I

IACR (International Association for Cryptologic Research). The professional body that runs CRYPTO, EUROCRYPT, ASIACRYPT, TCC, and publishes ePrint. Reference target across the book. Introduced in Chapter 1.
IND-CCA2 (Indistinguishability under Adaptive Chosen-Ciphertext Attack). The standard encryption security game: adversary has a decryption oracle (except on the challenge ciphertext) and must distinguish encryptions of two chosen messages. The target notion for every KEM in the book. Introduced in Chapter 5.
IND-CPA (Indistinguishability under Chosen-Plaintext Attack). The weaker encryption game with no decryption oracle. ML-KEM’s underlying K-PKE is IND-CPA; the FO transform lifts it to IND-CCA2. Introduced in Chapter 10.
IOP (Interactive Oracle Proof). The proof-system framework underlying STARKs: the prover sends oracle messages and the verifier reads positions. Introduced in Chapter 30.
Isogeny. A non-zero morphism between elliptic curves preserving the group law; the foundation of isogeny-based cryptography. Introduced in Chapter 3, developed in Chapter 21.
ISD (Information Set Decoding). The best classical family of attacks on syndrome decoding; the exponent that sets HQC’s parameter sizes. Introduced in Chapter 19.

K

Kannan embedding. The lattice construction that encodes a BDD or unique-SVP problem inside a larger lattice so that a solution to SVP on the embedding recovers the BDD target; used by the primal attack on LWE. Introduced in Chapter 12.
KDF (Key Derivation Function). A function stretching a short secret (like a shared KEM value) into longer cryptographic material. Introduced in Chapter 11.
KEM (Key Encapsulation Mechanism). A public-key primitive with three algorithms (KeyGen, Encap, Decap) where Encap samples the shared secret rather than taking it as input. ML-KEM and HQC are the two post-quantum KEMs the book builds from scratch. Introduced in Chapter 5.
KEX (Key Exchange). The general term for a protocol where two parties derive a shared secret. Diffie-Hellman is a KEX; a KEM is a KEX with a specific API. Introduced in Chapter 5.
KZG (Kate-Zaverucha-Goldberg). The pairing-based polynomial commitment scheme underlying Plonk. Shor breaks the pairing-discrete-log assumption it relies on. Introduced in Chapter 31.
Kyber. The working name during NIST’s PQC process for the lattice-based KEM standardized as ML-KEM in FIPS 203. Introduced in Chapter 11.

L

Lamport signature. The 1979 one-time signature: reveal half of $2n$ preimages under a hash function to sign an $n$ -bit message. The foundation every hash-based signature inherits. Introduced in Chapter 13.
Lattice. The integer-combination set $L(B) = \{B x : x \in \mathbb{Z}^n\}$ for a basis matrix $B$ . Introduced in Chapter 7.
LDE (Low-Degree Extension). Encoding a short polynomial or trace as its evaluation on a larger domain, producing a Reed-Solomon codeword STARKs can test with FRI. Introduced in Chapter 33.
LLL (Lenstra-Lenstra-Lovász). The polynomial-time lattice reduction algorithm from 1982; outputs a basis with the first vector bounded by an exponential factor times the shortest vector. Introduced in Chapter 12.
LMS (Leighton-Micali Signature). The stateful hash-based signature scheme standardized by NIST in SP 800-208. Referenced in Chapter 14.
LWE (Learning With Errors). The hardness assumption underneath ML-KEM and ML-DSA: given $(A, As + e)$ with small error $e$ , recover $s$ . Introduced in Chapter 8.

M

MAYO. A multivariate signature candidate from NIST’s additional signatures track, not yet standardized. Introduced in Chapter 23.
Merkle-Damgård. The iterative hash construction underlying MD5, SHA-1, and SHA-2. Susceptible to length-extension; SHA-3 uses the sponge construction instead. Not explicitly discussed in this edition; the SHA-2 and SHA-3 hash primitives are used across Parts II and III without naming the underlying construction.
Merkle tree. The binary hash tree that compresses many leaves into a single root; the substrate of every hash-based signature and every STARK. Introduced in Chapter 13.
ML-DSA (Module-Lattice Digital Signature Algorithm). The lattice-based signature scheme standardized in FIPS 204; key generation rests on Module-LWE, unforgeability on Module-SIS. The standardized form of Dilithium. Introduced in Chapter 1; treated as a signature family in Chapter 6.
ML-KEM (Module-Lattice Key-Encapsulation Mechanism). The lattice-based KEM standardized in FIPS 203; built from Module-LWE via an IND-CPA K-PKE core lifted to IND-CCA2 through the FO transform. The standardized form of Kyber. Introduced in Chapter 11.
MLWE (Module-LWE). The structured LWE variant over a polynomial module of rank $k$ ; the pseudorandomness assumption underneath ML-KEM and ML-DSA’s key generation. Introduced in Chapter 9.
Module-Lattice. A lattice structured as a module of rank $k$ over a polynomial ring; see MLWE for the hardness assumption it carries. Introduced in Chapter 9.
Mosca inequality. The back-of-envelope inequality $X + Y > Z$ determining whether HNDL is already a live threat: $X$ is data shelf life, $Y$ is migration time, $Z$ is time to quantum. Introduced in Chapter 1.

N

NCSC (National Cyber Security Centre). The UK national cybersecurity authority whose 2025 timelines (2028 discovery, 2031 scope, 2035 complete) anchor the book’s deployment chapters. Introduced in Chapter 1.
NIST (National Institute of Standards and Technology). The U.S. standards body that runs the PQC standardization process and publishes FIPS and SP documents. Introduced in Chapter 1.
NTT (Number-Theoretic Transform). The finite-field analogue of the FFT; multiplies polynomials in $\mathbb{Z}_q[x]/(x^n+1)$ in $O(n \log n)$ when $q$ has a primitive $2n$ -th root of unity. Introduced in Chapter 9.

O

OAEP (Optimal Asymmetric Encryption Padding). The padding scheme turning textbook RSA into IND-CCA2 encryption in the random oracle model. Introduced in Chapter 5.
OCSP (Online Certificate Status Protocol). The protocol for checking whether an X.509 certificate is revoked. PQ migration touches it because OCSP responses are themselves signed. Referenced in Chapter 28.
On-chain verifier. A smart-contract function on Ethereum L1 that checks a cryptographic proof of correct execution of an off-chain rollup state transition; post-quantum migration upgrades this contract. Introduced in Chapter 39.
OTS (One-Time Signature). A signature scheme that remains secure only when used once under a given key. Lamport, Winternitz, and WOTS+ are OTS schemes. Introduced in Chapter 13.
OW-CPA (One-Wayness under Chosen-Plaintext Attack). A weaker security notion than IND-CPA: the adversary cannot recover the full plaintext. Relevant because the FO transform’s tight reductions target OW-CPA inputs. Introduced in Chapter 12.

P

P-256 (also NIST P-256, secp256r1, prime256v1). The NIST prime elliptic curve over a 256-bit prime; used for ECDH key exchange and ECDSA signatures across TLS and WebPKI. Broken by Shor. Referenced in Chapters 1, 24, 25, 27, and 28.
PKE (Public-Key Encryption). The primitive where a public key encrypts and a private key decrypts, with the sender choosing the plaintext. Distinct from KEM. Introduced in Chapter 5.
PKI (Public Key Infrastructure). The system of certificate authorities, registration authorities, and trust stores that binds public keys to identities. Introduced in Chapter 28.
PLONK. A SNARK construction with a universal setup; breaks under Shor because it uses pairings. Referenced in Chapter 30.
PQC (Post-Quantum Cryptography). Cryptography whose hardness assumptions resist known polynomial-time quantum algorithms (Shor, Grover, and their variants). The families NIST has standardized or is considering are lattice (ML-KEM, ML-DSA), hash (SLH-DSA), code (HQC, Classic McEliece), isogeny (SQIsign), and multivariate (MAYO, SNOVA, UOV). The subject of the book.
PQ-ZK. Post-quantum zero-knowledge: ZK proof systems whose soundness survives quantum attackers. Part VI’s subject.
PRF (Pseudorandom Function). A keyed function indistinguishable from random by any efficient adversary. Used inside ML-KEM and SLH-DSA for derandomization. Introduced in Chapter 11.

Q

QFT (Quantum Fourier Transform). The quantum circuit at the heart of Shor’s algorithm; its classical simulation is exponential in the qubit count. Introduced in Chapter 1.
QROM (Quantum Random Oracle Model). The security model where random-oracle queries may be quantum superpositions, so the classical ROM is a strict special case. Introduced in Chapter 30, analyzed in depth in Chapter 32.

R

R1CS (Rank-1 Constraint System). The bilinear-constraint arithmetization used by pairing-based SNARKs such as Groth16; each constraint has the form $(A \mathbf{w}) \cdot (B \mathbf{w}) = (C \mathbf{w})$ for witness $\mathbf{w}$ . Introduced in Chapter 30, referenced in Chapter 34.
Reed-Solomon code. The evaluation code $\{(f(\omega_0), \ldots, f(\omega_{N-1})) : \deg f \leq L - 1\}$ . STARKs encode traces as Reed-Solomon codewords and use FRI to test low-degree membership. Introduced in Chapter 33.
Regev encryption. The 2005 lattice PKE that showed LWE implies public-key encryption; the direct ancestor of ML-KEM’s K-PKE core. Introduced in Chapter 10.
RFC (Request for Comments). The IETF’s standards track; the document type that governs internet protocol interoperability. Referenced across Part V.
RLWE (Ring-LWE). LWE over a polynomial quotient ring; the intermediate structure between Module-LWE and flat LWE. Introduced in Chapter 9.
ROM (Random Oracle Model). The proof heuristic that models hash functions as truly random. Introduced in Chapter 6.
Root-Hermite factor. The geometric quality $\delta$ satisfying $\|b_1\| \approx \delta^{d-1} \cdot \det(L)^{1/d}$ for a reduced basis of a $d$ -dimensional lattice; its block-size dependence $\delta(\beta)$ comes from the Chen-Nguyen 2011 closed form and drives core-SVP cost estimates. Introduced in Chapter 12.

S

Schnorr signature. The three-move sigma protocol for discrete log plus Fiat-Shamir; Shor breaks it. The template for every sigma-protocol-based signature in Part VI. Introduced in Chapter 1.
SBOM (Software Bill of Materials). The more general cousin of CBOM; inventories of every software component. Referenced in Chapter 24.
secp256k1. The specific elliptic curve $y^2 = x^3 + 7$ over $\mathbb{F}_p$ with $p = 2^{256} - 2^{32} - 977$ ; the curve Bitcoin uses. Broken by Shor. Referenced in Chapter 4.
Sigma protocol. A three-move (commitment, challenge, response) public-coin interactive proof; the template Fiat-Shamir compiles to signatures. Used in Chapter 22’s SQIsign walkthrough; formally introduced in Chapter 32.
SHA-3. The FIPS 202 hash family, built on the Keccak sponge construction. Used throughout ML-KEM, ML-DSA, and SLH-DSA. Referenced in Chapter 11 and Chapter 16.
SHAKE. The extendable-output function family derived from SHA-3 (SHAKE128, SHAKE256). Used as an XOF inside ML-KEM and SLH-DSA. Introduced in Chapter 11.
Shor’s algorithm. The 1994 quantum algorithm factoring integers and computing discrete logarithms in polynomial time. Introduced in Chapter 1.
SIDH (Supersingular Isogeny Diffie-Hellman). The isogeny-based key exchange broken in 2022 by the Castryck-Decru attack. Referenced in Chapter 3 and Chapter 21.
SIS (Short Integer Solution). The lattice hardness assumption dual to LWE, used in lattice signatures. Referenced in Chapter 12.
SLH-DSA (Stateless Hash-Based Digital Signature Algorithm). The stateless hash-based signature scheme standardized in FIPS 205; the standardized form of SPHINCS+. Introduced in Chapter 16.
SNARK (Succinct Non-Interactive Argument of Knowledge). A proof system with short proofs and fast verification. Most SNARKs in deployment use pairings (Shor-broken); STARKs are post-quantum. Introduced in Chapter 30.
SNOVA. A multivariate signature candidate from NIST’s additional signatures track. Introduced in Chapter 23.
SPHINCS+. The construction name for the stateless hash-based signature scheme standardized as SLH-DSA in FIPS 205. See SLH-DSA; covered in Chapter 16 under the standardized name.
SQIsign. The isogeny-based signature scheme surviving the Castryck-Decru attack; submitted to NIST’s additional signatures round. Introduced in Chapter 22.
STARK (Scalable Transparent Argument of Knowledge). A proof system with polylogarithmic verifier time, no trusted setup, and hash-based soundness. Built on FRI. Introduced in Chapter 33, applied in Chapter 34.
SVP (Shortest Vector Problem). Given a lattice, find the nonzero vector of minimal Euclidean norm. The canonical lattice hardness problem. Introduced in Chapter 3.
Syndrome. The product $s = H r^T$ of the parity-check matrix $H$ and a received word $r$ (under the column convention used in Chapter 18 and Appendix B); zero for codewords, nonzero for errors. Introduced in Chapter 18.
Syndrome decoding. The problem of recovering a low-weight error from its syndrome. NP-hard in the worst case; the hardness assumption underneath HQC and Classic McEliece. Introduced in Chapter 18.

T

TLS (Transport Layer Security). The protocol securing HTTPS. It was the first widely deployed transport for the post-quantum hybrid key exchange X25519MLKEM768; see that entry for the wire format. Introduced in Chapter 27.
Tweakable hash. A hash variant taking an additional tweak input, used in SLH-DSA to prevent multi-target attacks. Introduced in Chapter 16.

U

UOV (Unbalanced Oil and Vinegar). A multivariate signature construction from 1999; the basis for MAYO and SNOVA. Introduced in Chapter 23.
uSVP (Unique Shortest Vector Problem). A promise version of SVP where the shortest vector is much shorter than all others. The problem LWE reduces to via the BDD-to-uSVP embedding. Introduced in Chapter 12.
UTXO (Unspent Transaction Output). Bitcoin’s transaction model where each unit of value is an immutable output, and ownership transitions via a signature on a spending transaction. Introduced in Chapter 36.

W

Wallet. The software or hardware that holds private keys and produces transaction signatures. Introduced in Chapter 37.
WOTS+ (Winternitz One-Time Signature Plus). The hash-chain one-time signature with improved multi-target security; used inside XMSS and SLH-DSA. Introduced in Chapter 14.

X

X25519. The Diffie-Hellman key exchange on Curve25519. Broken by Shor; used as the classical half of X25519MLKEM768. Referenced in Chapters 1, 24, 26, 27, and 29.
X25519MLKEM768. The deployed hybrid KEM combining X25519 and ML-KEM-768. Introduced in Chapter 26.
X.509. The certificate format underlying most PKIs. Introduced in Chapter 28.
XMSS (eXtended Merkle Signature Scheme). The stateful hash-based signature scheme standardized in RFC 8391 and NIST SP 800-208. Introduced in Chapter 14.
XOF (Extendable-Output Function). A hash-function variant producing arbitrary-length output; SHAKE128 and SHAKE256 are the standard XOFs. Used inside ML-KEM and SLH-DSA. Introduced in Chapter 11.

Z

Zcash. The privacy-focused cryptocurrency using pairing-based SNARKs today; a Chapter 34 case study of a system that will need PQ reproofing. Introduced in Chapter 34.
ZK (Zero-Knowledge). A proof system where the verifier learns nothing beyond the truth of the statement. Part VI is the book’s treatment of post-quantum ZK. Introduced in Chapter 30.
ZKsync. The Ethereum Layer-2 rollup using STARK-style proofs. Introduced in Chapter 34.