Appendix A: Glossary

This glossary is a lookup table. Every entry gives a one-sentence definition and a back-reference. “Introduced in Chapter N” names the chapter where the term is first defined. Where a term is defined early and built later, the entry names both, because the definition and the construction are different destinations. A back-reference to an Appendix D page says so. Alias forms point to the canonical term. When a scheme has a construction name (Kyber) and a standard name (ML-KEM), the canonical entry is the standard name and the construction name points at it.

Acronyms used across the book that are not cryptographic (NIST, IACR, NCSC, RFC, FIPS) carry a definition here because their meaning governs a lot of the book’s structure.

A

Account model. Ethereum’s transaction model where each account holds a balance and a nonce, and signatures authenticate state-update transactions. It contrasts with Bitcoin’s UTXO model. Introduced in Chapter 36.
ACD (All Core Devs). Ethereum’s rough-consensus coordination forum, where cross-client teams surface a hard-fork proposal and agree what ships in an upgrade. Introduced in Chapter 41.
ACVP (Automated Cryptographic Validation Protocol). NIST’s framework for validating cryptographic implementations against published test vectors. The book’s flagship implementations are tested against ACVP vectors byte-for-byte. Introduced in Chapter 11.
ADRS (Address). The 32-byte domain separator in SLH-DSA that encodes the position of every hash call within the hypertree. Introduced in Chapter 3, built in Chapter 17.
AEAD (Authenticated Encryption with Associated Data). A symmetric mode that provides both confidentiality and integrity for a message while binding unencrypted associated data to the ciphertext. TLS 1.3 uses AES-GCM, AES-CCM, or ChaCha20-Poly1305. Introduced in Chapter 1, referenced in Chapter 5.
AES (Advanced Encryption Standard). The symmetric block cipher standardized in FIPS 197. Grover’s algorithm gives a quadratic key-search speedup in the idealized serial-query model, but the concrete attack cost is considerably higher, and NIST benchmarks Category 1 against AES-128 key search rather than treating AES-128 as broken. AES-256 keeps a 128-bit margin even at the idealized bound. Introduced in Chapter 1.
AIR (Algebraic Intermediate Representation). The constraint language STARKs compile programs to: a set of polynomial constraints over a trace table. Introduced in Chapter 31, developed in Chapter 34.
ALPN (Application-Layer Protocol Negotiation). The TLS extension that lets client and server pick an application protocol during the handshake. Relevant to PQ migration because mid-handshake negotiation constrains the wire format. The book does not build it. It appears in Part V, where Chapter 28 measures its contribution to a ClientHello’s size and Chapter 25’s solutions note that egress capture must record the negotiated group and cipher suite, because ALPN names the application protocol and not the cryptography.
ASIC (Application-Specific Integrated Circuit). Custom silicon built for one computation. Not discussed in this edition: Chapter 13’s cost models charge for large-memory access rather than for custom hardware, so its sieving estimates are memory-bound rather than silicon-bound.

B

BDD (Bounded Distance Decoding). The lattice problem of finding the lattice point closest to a target that is guaranteed to lie within a specified distance from the lattice. The LWE problem reduces to BDD and then to uSVP via the Kannan embedding. Introduced in Chapter 8.
BIP (Bitcoin Improvement Proposal). The design-document registry through which Bitcoin protocol changes and conventions are proposed. Individual proposals are numbered, from BIP-32 (HD wallet derivation) to BIP-360 (a Draft output type). First cited in Chapter 1. The proposal process itself is walked in Chapter 41.
Bitcoin. The first cryptocurrency, launched in 2009. Transactions sign with ECDSA over secp256k1, and Taproot adds Schnorr over the same curve. Introduced in Chapter 36.
BKZ (Block Korkine-Zolotarev). A lattice-basis reduction algorithm parameterized by a block size. BKZ-β is the state of the art for attacking lattice-based schemes. The block size drives concrete lattice-attack cost estimates, which a specified attack model then compares against NIST’s category benchmarks. Those benchmarks are reference-primitive costs defined independently of any lattice attack. Introduced in Chapter 3, developed in Chapter 13.
Blockchain. A distributed append-only ledger where transactions are grouped into cryptographically linked blocks. Introduced in Chapter 36.
BLS12-381. A pairing-friendly elliptic curve used by Zcash, Ethereum staking, and many pairing-based SNARKs. Shor’s algorithm breaks the underlying discrete-log assumption. Introduced in Chapter 31, developed as a consensus-signature curve in Chapter 39.
BLS signature. The Boneh-Lynn-Shacham signature scheme based on pairings. It aggregates trivially across attestations, and Shor’s algorithm breaks the underlying assumption. Not to be confused with the Barreto-Lynn-Scott curve family that gives BLS12-381 its name. Introduced in Chapter 36.

C

CBC (Cipher Block Chaining). A block-cipher mode of operation used as a foil for modern authenticated modes. It is not a construction the book builds. Referenced in Chapter 26.
CBD (Centered Binomial Distribution). The discrete error distribution ML-KEM samples from, with support $\{-\eta, \ldots, \eta\}$ and parameters fixed per security level. Introduced in Chapter 8. The sampler is built in Chapter 11.
CBOM (Cryptographic Bill of Materials). A machine-readable inventory of every cryptographic primitive, key, protocol, and dependency in a system. The CycloneDX 1.6 schema defines the format used in Chapter 25’s hands-on example. Introduced in Chapter 25.
CCA (Chosen-Ciphertext Attack). The adversarial model in which the attacker can query a decryption oracle. See IND-CCA2. Introduced in Chapter 5.
CCA2. See IND-CCA2.
Centered binomial distribution. See CBD.
Classic McEliece. The code-based KEM submitted to NIST’s PQC process, built in Niederreiter form on the hidden-Goppa-code idea of McEliece’s 1978 public-key encryption scheme. Public keys are hundreds of kilobytes. Introduced in Chapter 1, with its underlying McEliece-style public-key encryption scheme built in Chapter 20, which does not build the Niederreiter KEM wrapper.
CNFL (Collect Now, Forge Later). The proof-system analogue of HNDL: a Shor-vulnerable verifier stays in service past the quantum crossover, so a future quantum adversary produces proofs that pass legacy verification. The threat is the verifier still running, not the transcripts collected. Named in Chapter 1, developed in Chapter 34.
CNSA 2.0 (Commercial National Security Algorithm Suite 2.0). The NSA’s 2022 suite of algorithms approved for U.S. national security systems: ML-KEM-1024, ML-DSA-87, AES-256, SHA-384 or SHA-512, and the stateful LMS and XMSS for software and firmware signing. SLH-DSA is not part of it and is not approved for any NSS use. CNSSP 15 sets the compliance dates. Introduced in Chapter 1, applied in Chapters 25 and 29.
CNSSP 15 (Committee on National Security Systems Policy 15). The U.S. policy instrument that fixes the compliance dates for CNSA 2.0 on national security systems, including a 31 December 2031 milestone for mandatory use. Introduced in Chapter 1, used as a timeline anchor in Chapter 25.
Consensus signature. The signature that authenticates a validator’s vote on a block at the chain’s heartbeat in a proof-of-stake system. Introduced in Chapter 30, developed in Chapter 39.
Core-SVP. A deliberately coarse cost model for lattice attacks that charges one SVP oracle call at block size $\beta$ as $2^{0.292\beta}$ classically and $2^{0.265\beta}$ quantumly and ignores the polynomial number of calls BKZ makes. The conservative baseline the Kyber and Dilithium submissions report. The Kyber team’s final parameter choice rests on a refined gate-count model, reported beside it. Introduced in Chapter 13.
CPA (Chosen-Plaintext Attack). The adversarial model in which the attacker can query an encryption oracle. See IND-CPA. Introduced in Chapter 5.
CRQC (Cryptographically Relevant Quantum Computer). A fault-tolerant quantum computer large enough to run Shor’s algorithm against deployed parameters such as RSA-2048 or a 256-bit elliptic curve. The $Z$ term of the Mosca inequality is the time until one exists. Introduced in Chapter 1.
CRS (Common Reference String). A public string that prover and verifier share before a zero-knowledge protocol runs. STARKs avoid it, Groth16 needs a trusted one. Introduced in Chapter 33.
CSR (Certificate Signing Request). The X.509 structure a subject sends to a certificate authority to request a signed certificate. Not explicitly discussed in this edition, but included here for practitioners working with CA infrastructure alongside Chapter 29.
CSWP (Cybersecurity White Paper). NIST’s short-form publication series. CSWP 39 is the crypto-agility paper the book’s agility framing is synthesized from, alongside RFC 7696 and NIST IR 8547. Introduced in Chapter 26.
CVP (Closest Vector Problem). Given a lattice and a target vector, find the lattice point closest to the target. NP-hard in general. Introduced in Chapter 3.

D

DDH (Decisional Diffie-Hellman). The assumption that $g^{ab}$ is indistinguishable from a random group element given $g^a$ and $g^b$ . It is stronger than CDH, and it supports pseudorandomness of the raw group element. For a derived key it is one route, with a suitable key-derivation function. The other, which Chapter 5 takes, is CDH in the random-oracle model through HDH. Broken by Shor. Introduced in Chapter 5.
Decompose. The ML-DSA rounding operator that splits a coefficient into a high part and a low part around a window of size $2\gamma_2$ , so a signer can commit to just the high bits of its mask product. Introduced in Chapter 12.
DEM (Data Encapsulation Mechanism). The symmetric half of a KEM-DEM hybrid encryption scheme: the KEM establishes a key, the DEM encrypts the message under it. Introduced in Chapter 5.
DH (Diffie-Hellman). The 1976 key-agreement protocol over a cyclic group. Shor breaks it in polynomial time. Introduced in Chapter 1, built as a toy exchange in Chapter 5.
DHKEM. The generic construction turning a Diffie-Hellman group into a KEM. RFC 9180 specifies instantiations. Introduced in Chapter 27.
Dilithium. The construction name for the signature scheme standardized as ML-DSA in FIPS 204. Built from scratch as ML-DSA in Chapter 12, referenced in Chapter 33 as a Fiat-Shamir-with-aborts signature.
Discrete logarithm. Given a group element $g$ and $h = g^x$ , recover the exponent $x$ . Classically hard in the groups deployed today. Shor solves it in polynomial time. See ECDLP for the elliptic-curve case. Introduced in Chapter 1. Chapter 4 builds ECDSA on the elliptic-curve case and sketches Shor’s reduction.
DLWE (Decisional LWE). The decision version of LWE: distinguish LWE samples from uniform. Introduced in Chapter 8.

E

ECDH (Elliptic Curve Diffie-Hellman). Key agreement over an elliptic-curve group. Shor breaks it. Introduced in Chapter 1.
ECDLP (Elliptic Curve Discrete Logarithm Problem). Given $Q = dG$ , recover the scalar $d$ . Shor solves it in polynomial time on a fault-tolerant quantum computer. Introduced in Chapter 1.
ECDSA (Elliptic Curve Digital Signature Algorithm). The signature scheme based on ECDLP used by most public blockchains and many TLS servers. Shor breaks it. Introduced in Chapter 1, constructed and walked in Chapter 4.
Ed25519. The EdDSA signature scheme instantiated on edwards25519, the twisted Edwards curve birationally equivalent to Curve25519 (RFC 8032, RFC 7748). Shor breaks it. Referenced in Chapters 1, 26, 27, 29, and 30.
EdDSA. The Edwards-curve signature family. Shor breaks it. Referenced in Chapter 1.
Ethereum. The smart-contract platform launched in 2015. Transactions sign with ECDSA over secp256k1, and post-merge consensus signatures use BLS over BLS12-381. Introduced in Chapter 36.
EUF-CMA (Existential Unforgeability under Chosen-Message Attack). The standard unforgeability game for signatures: the adversary obtains signatures on messages of its choice from a signing oracle and must produce a valid signature on a message it never queried. Introduced in Chapter 6.

F

Fiat-Shamir transform. The compiler that turns a public-coin interactive proof into a non-interactive one by deriving the verifier’s coins from a hash of the transcript. Introduced in Chapter 12 as ML-DSA’s challenge derivation, generalized in Chapter 31, analyzed in the QROM in Chapter 33.
Fiat-Shamir with aborts. The lattice adaptation of the Fiat-Shamir transform in which the signer discards any response that would leak the secret and restarts with fresh randomness, so the published response distribution is independent of the secret. The signing method of ML-DSA. Introduced in Chapter 12.
Finality. The state at which a block cannot be reversed by chain reorganization. Chapter 36 uses the window between mempool broadcast and finality as the on-spend race window, during which a transaction that first reveals its public key is exposed to a fast-clock CRQC. Referenced in Chapter 36.
FIPS (Federal Information Processing Standard). NIST publication series carrying U.S. federal cryptographic requirements. The post-quantum standards are FIPS 203, 204 and 205, all published August 2024. FIPS 206 is in development and no draft has been released. FIPS 203 standardizes ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA. Introduced in Chapter 1.
FO transform (Fujisaki-Okamoto transform). A family of transforms that turns a suitable public-key encryption scheme into an IND-CCA2 KEM in a random-oracle model, under the variant’s own correctness and derandomization hypotheses. The bound depends on the variant and on whether the oracle is classical or quantum. ML-KEM instantiates the $U^{\not\perp}$ variant (implicit rejection), where a tampered ciphertext returns a pseudorandom key derived from a rejection seed rather than the $\perp$ symbol. Introduced in Chapter 5, applied in Chapter 11 and Chapter 21.
FN-DSA (Fast-Fourier lattice-based Digital Signature Algorithm). The NTRU-lattice signature scheme derived from Falcon, selected by NIST and in development as FIPS 206. This edition discusses it but does not build it. Part VII treats FN-DSA-512 as a consensus candidate in Chapter 39. Introduced in Chapter 1.
FORS (Forest Of Random Subsets). The few-time signature primitive inside SLH-DSA: a forest of Merkle trees, each signing one chunk of the message digest. Introduced in Chapter 14, built in Chapter 16.
Forward secrecy. The property that compromising a long-term key does not expose past sessions, because session keys come from an ephemeral key exchange. It does not survive a quantum attacker when the ephemeral group is Shor-reducible. Introduced in Chapter 1.
FRI (Fast Reed-Solomon Interactive Oracle Proofs of Proximity). The protocol that anchors STARKs by testing proximity to a bounded-degree Reed-Solomon code. Soundness is stated against codewords far from that code, and is not an exact-membership guarantee for every accepted oracle. Introduced in Chapter 30, explained in Chapter 31, developed in Chapter 34.
Fundamental parallelepiped. The half-open parallelepiped $\{Bx : 0 \leq x_i < 1\}$ of a lattice basis $B$ . Its volume equals the lattice determinant. Introduced in Chapter 7.

G

GapSVP. The decision version of SVP: decide whether the shortest vector is at most 1 or at least $\gamma$ , given a promise. Introduced in Chapter 3.
Gas. Ethereum’s unit of computation cost. Introduced in Chapter 37.
GCD (Greatest Common Divisor). The largest integer dividing both of two integers, computed by the Euclidean algorithm. Two gcd calls, $\gcd(x - 1, n)$ and $\gcd(x + 1, n)$ with $x = a^{r/2}$ , complete the Shor attack on RSA once quantum period finding returns a usable even order. Introduced in Chapter 2, walked in Chapter 4.
Goppa code. The algebraic code family Classic McEliece uses. Efficient decoding via Patterson’s algorithm is the trapdoor. Introduced in Chapter 19, applied in Chapter 20.
Groth16. The pairing-based zk-SNARK with the smallest proofs in use. Shor breaks its pairing assumption. Referenced in Chapter 35 as the baseline for pairing-based ZK under a quantum threat model.
Grover’s algorithm. The quantum unstructured-search algorithm with quadratic speedup: $O(\sqrt{N})$ queries against a classical $O(N)$ . The halved-bits shorthand (AES-128 → 64 bits, SHA-256 preimage → 128 bits) is the idealized serial-query bound, not the concrete attack cost, which circuit depth, error correction, and parallelization push considerably higher. Introduced in Chapter 1.
GSA (Geometric Series Assumption). The heuristic from Schnorr 2003 that the Gram-Schmidt norms of a BKZ-reduced basis form a geometric sequence with ratio $\delta(\beta)^{-2}$ . Used to derive the primal-attack success condition in lattice cryptanalysis. Introduced in Chapter 13.

H

Hard fork. A backward-incompatible consensus-rule change: upgraded nodes accept blocks the old rules reject, so a full node that follows and validates the upgraded chain needs the new rules. A node can decline and continue under the old ones. One of several migration paths for a blockchain signature change: Ethereum’s consensus-layer signatures need one, while Bitcoin’s BIP-360 is a soft-fork proposal and Ethereum account abstraction is a contract-level path. Introduced in Chapter 41.
Hint (ML-DSA). A one-bit-per-coefficient correction the signer attaches so a verifier holding only the truncated public key can recover the high bits of the recomputed commitment. Produced by MakeHint and applied by UseHint. Introduced in Chapter 12.
HKDF (HMAC-based Key Derivation Function). The RFC 5869 key-derivation function combining an HMAC-Extract step with an HMAC-Expand step. The hybrid combiner in Chapter 27 feeds component secrets through HKDF-SHA256. Introduced in Chapter 5, applied in Chapter 27.
HNDL (Harvest Now, Decrypt Later). The adversarial strategy of recording TLS traffic today and decrypting it once a quantum computer exists. The reason PQ key exchange is urgent. Introduced in Chapter 1.
HQC (Hamming Quasi-Cyclic). The code-based KEM selected by NIST in March 2025 as a second KEM standard distinct from ML-KEM. Built from quasi-cyclic codes over the binary Hamming metric. The FIPS document number is pending at the time of writing. Introduced in Chapter 1, with a toy of its IND-CPA public-key encryption core built in Chapter 21, which describes the salted Fujisaki-Okamoto wrapper rather than building it.
HSM (Hardware Security Module). Tamper-resistant hardware that generates, stores, and uses long-term keys. PQ migration is constrained by how quickly HSM vendors ship firmware supporting the new algorithms. Introduced in Chapter 26, applied in Chapter 29.
Hybrid signature. A signature that concatenates (or composites) a classical signature and a post-quantum signature, verifying if both verify. Introduced in Chapter 27, applied in Chapter 29.
Hybrid key exchange. A key agreement combining a classical component (X25519) and a post-quantum component (ML-KEM) in parallel, with the session key derived from both. The deployed form is X25519MLKEM768. See its own entry. Introduced in Chapter 1, built in Chapter 27.
Hypertree. The multi-layer Merkle tree inside SLH-DSA: WOTS+ leaves at each layer, and each layer’s root is signed by the next. Introduced in Chapter 14, developed in Chapter 16, built in Chapter 17.

I

IACR (International Association for Cryptologic Research). The professional body that runs CRYPTO, EUROCRYPT, ASIACRYPT, TCC, and publishes ePrint. Reference target across the book: it appears in the rendered reference list of every chapter that cites an ePrint preprint, rather than in any chapter’s prose.
IND-CCA2 (Indistinguishability under Adaptive Chosen-Ciphertext Attack). The standard encryption security game: for a PKE the adversary has a decryption oracle, barred on the challenge ciphertext, and must distinguish encryptions of two chosen messages. The KEM game is different and is the one the book targets. There the adversary gets the challenge ciphertext alongside either the real encapsulated key or an independent uniform key of the same length, with a decapsulation oracle barred on that ciphertext, and chooses no messages at all. Introduced in Chapter 5.
IND-CPA (Indistinguishability under Chosen-Plaintext Attack). The weaker encryption game with no decryption oracle. ML-KEM’s underlying K-PKE is IND-CPA. The FO transform lifts it to IND-CCA2. Introduced in Chapter 5, developed in Chapter 10.
IOP (Interactive Oracle Proof). The proof-system framework underlying STARKs: the prover sends oracle messages and the verifier reads positions. Introduced in Chapter 31.
IPD (Initial Public Draft). NIST’s first public revision of a document, issued for comment before a final publication. SP 800-230 and NIST IR 8547 are both cited at IPD status in this edition. Introduced in Chapter 1, used as a status label in Chapter 39.
Isogeny. A non-zero morphism between elliptic curves preserving the group law. The foundation of isogeny-based cryptography. Introduced in Chapter 3, developed in Chapter 22.
ISD (Information Set Decoding). The best classical family of attacks on syndrome decoding. The exponent that sets HQC’s parameter sizes. Introduced in Chapter 3, built in Chapter 19, applied in Chapter 20.

K

Kannan embedding. The lattice construction that encodes a BDD or unique-SVP problem inside a larger lattice so that a solution to SVP on the embedding recovers the BDD target. Used by the primal attack on LWE. Introduced in Chapter 13.
KAT (Known Answer Test). A fixed input paired with the output a conforming implementation must produce. The book’s flagship implementations are checked against NIST KATs; Chapter 21’s HQC toy and Chapter 23’s SQIsign toy deliberately are not. Introduced in Chapter 21.
KDF (Key Derivation Function). A function deriving one or more keys from input keying material and, where appropriate, a context string. It may extract and it may expand, and its output need not be longer than its input: Chapter 27’s hybrid combiner maps 64 bytes of concatenated secret to a 32-byte key. Introduced in Chapter 5.
KEM (Key Encapsulation Mechanism). A public-key primitive with three algorithms (KeyGen, Encap, Decap) where Encap samples the shared secret rather than taking it as input. ML-KEM is the post-quantum KEM the book builds from scratch. Chapter 21 builds an HQC-inspired IND-CPA PKE core and explains the salted HHK wrapper the real HQC KEM uses without implementing it. Introduced in Chapter 5.
KEX (Key Exchange). The general term for a protocol where two parties derive a shared secret. Diffie-Hellman is a KEX; a KEM is a KEX with a specific API. Introduced in Chapter 5.
KZG (Kate-Zaverucha-Goldberg). The pairing-based polynomial commitment scheme underlying Plonk. Shor breaks the pairing-discrete-log assumption it relies on. Introduced in Chapter 30, developed in Chapter 32.
Kyber. The working name during NIST’s PQC process for the lattice-based KEM standardized as ML-KEM in FIPS 203. Introduced in Chapter 9, built in Chapter 11.

L

Lamport signature. The 1979 one-time signature: reveal half of $2n$ preimages under a hash function to sign an $n$ -bit message. The foundation every hash-based signature inherits. Introduced in Chapter 14.
Lattice. The integer-combination set $L(B) = \{B x : x \in \mathbb{Z}^n\}$ for a basis matrix $B$ . Introduced in Chapter 3, developed in Chapter 7.
LDE (Low-Degree Extension). Encoding a short polynomial or trace as its evaluation on a larger domain, producing a Reed-Solomon codeword STARKs can test with FRI. Introduced in Chapter 34.
LLL (Lenstra-Lenstra-Lovász). The polynomial-time lattice reduction algorithm from 1982. It outputs a basis with the first vector bounded by an exponential factor times the shortest vector. Introduced in Chapter 13.
LMS (Leighton-Micali Signature). The stateful hash-based signature scheme standardized by NIST in SP 800-208. Referenced in Chapter 15.
LWE (Learning With Errors). The hardness assumption underneath ML-KEM, and underneath ML-DSA’s key recovery: given $(A, As + e)$ with small error $e$ , recover $s$ . ML-DSA’s unforgeability rests on SIS rather than on this. Introduced in Chapter 3, developed in Chapter 8.

M

MAYO. A multivariate signature candidate from NIST’s additional signatures track, not yet standardized. Introduced in Chapter 24.
Merkle-Damgård. The iterative hash construction underlying MD5, SHA-1, and SHA-2. Susceptible to length-extension. SHA-3 uses the sponge construction instead. Not explicitly discussed in this edition. The SHA-2 and SHA-3 hash primitives are used across Parts II and III without naming the underlying construction.
Merkle tree. The binary hash tree that compresses many leaves into a single root. It aggregates one-time public keys in the book’s many-time and stateless signature constructions, and binds the oracle tables in its hash-based STARK constructions. It is not a prerequisite for a one-time signature: Chapter 14 builds Lamport OTS before any tree, and WOTS+ stands alone as well. Introduced in Chapter 14.
ML-DSA (Module-Lattice-Based Digital Signature Algorithm). The lattice-based signature scheme standardized in FIPS 204. Key generation rests on Module-LWE. Unforgeability rests on SelfTargetMSIS, a variant of Module-SIS that is at least as hard as Module-SIS in the random-oracle model. The standardized form of Dilithium. Introduced in Chapter 1, treated as a signature family in Chapter 6, built from scratch in Chapter 12.
ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism). The lattice-based KEM standardized in FIPS 203. Built from Module-LWE via an IND-CPA K-PKE core lifted to IND-CCA2 through the FO transform. The standardized form of Kyber. Introduced in Chapter 1, built in Chapter 11.
MLWE (Module-LWE). The structured LWE variant over a polynomial module of rank $k$ . The pseudorandomness assumption underneath ML-KEM and ML-DSA’s key generation. Introduced in Chapter 3, developed in Chapter 9.
Module-Lattice. A lattice structured as a module of rank $k$ over a polynomial ring. See MLWE for the hardness assumption it carries. Introduced in Chapter 9.
Module-SIS (Module Short Integer Solution). The Short Integer Solution problem over a module lattice: find a short nonzero solution to a homogeneous linear system over $R_q$ . ML-DSA’s unforgeability rests on SelfTargetMSIS, the variant in which the challenge is fixed as a hash of the commitment rather than chosen by the adversary (Chapter 12), as its key secrecy rests on Module-LWE. Introduced in Chapter 12. The unstructured SIS problem it specializes is referenced in Chapter 13.
Mosca inequality. The back-of-envelope inequality $X + Y > Z$ determining whether HNDL is already a live threat: $X$ is data shelf life, $Y$ is migration time, $Z$ is time to quantum. Introduced in Chapter 1.
MTU (Maximum Transmission Unit). The largest network-layer packet a link carries without fragmentation, headers included, so the bytes available to an application are the MTU less the framing its transport adds. Appendix D’s Chapter 17 Exercise 3 stipulates a usable budget of about 1,400 bytes on a mobile link and turns a signature size into a packet count, which is how it prices SLH-DSA’s two parameter sets against each other. Introduced in Appendix D, Chapter 17.

N

NCSC (National Cyber Security Centre). The UK national cybersecurity authority whose 2025 timelines (2028 discovery and migration plan, 2031 highest-priority migrations done, 2035 complete) anchor the book’s deployment chapters. Introduced in Chapter 1.
NIST (National Institute of Standards and Technology). The U.S. standards body that runs the PQC standardization process and publishes FIPS and SP documents. Introduced in Chapter 1.
NTT (Number-Theoretic Transform). The finite-field analogue of the FFT. It multiplies polynomials in $\mathbb{Z}_q[x]/(x^n+1)$ in $O(n \log n)$ when $q$ has a primitive $2n$ -th root of unity. Introduced in Chapter 9.

O

OAEP (Optimal Asymmetric Encryption Padding). The padding scheme turning textbook RSA into IND-CCA2 encryption in the random oracle model. Introduced in Chapter 4, developed in Chapter 5.
OCSP (Online Certificate Status Protocol). The protocol for checking whether an X.509 certificate is revoked. PQ migration touches it because OCSP responses are themselves signed. Not discussed in this edition, but included here for practitioners working with certificate-authority infrastructure alongside Chapter 29.
OID (Object Identifier). The dotted-decimal name that ASN.1 and X.509 use to identify an algorithm or a parameter set. SLH-DSA’s pre-hash variant binds one into the signed message, and a PKI inventory keys on them. Introduced in Chapter 17, used in Chapters 26 and 29.
OMB (Office of Management and Budget). The U.S. executive office whose memoranda set migration schedules for civilian federal systems. M-26-15 carries the post-quantum schedule through 2035. Introduced in Chapter 1, used as a timeline anchor in Chapter 30.
On-chain verifier. A smart-contract function on Ethereum L1 that checks a cryptographic proof of correct execution of an off-chain rollup state transition. Post-quantum migration upgrades this contract. Introduced in Chapter 30, developed in Chapter 36. The upgrade itself is Chapter 40’s subject.
OTS (One-Time Signature). A signature scheme that remains secure only when used once under a given key. Lamport, Winternitz, and WOTS+ are OTS schemes. Introduced in Chapter 14.
OW-CPA (One-Wayness under Chosen-Plaintext Attack). A weaker security notion than IND-CPA: the adversary cannot recover the full plaintext. The Hofheinz-Hövelmanns-Kiltz theorem for ML-KEM’s FO transform starts from an OW-CPA K-PKE at a query-count loss. The tight FO reduction starts from IND-CPA instead (Appendix D, Chapter 5). Introduced in Chapter 11, restated in Chapter 13.

P

P-256 (also NIST P-256, secp256r1, prime256v1). The NIST prime elliptic curve over a 256-bit prime. Used for ECDH key exchange and ECDSA signatures across TLS and WebPKI. Broken by Shor. Referenced in Chapters 1, 25, 26, 28, and 29.
PCS (Polynomial Commitment Scheme). A commitment to a polynomial that supports proving an evaluation at a point without revealing the polynomial. The L2 layer of every proof system the book takes apart. Introduced in Chapter 32.
PKE (Public-Key Encryption). The primitive where a public key encrypts and a private key decrypts, with the sender choosing the plaintext. Distinct from KEM. Introduced in Chapter 5.
PKI (Public Key Infrastructure). The system of certificate authorities, registration authorities, and trust stores that binds public keys to identities. Introduced in Chapter 29.
PLONK. A SNARK construction with a universal setup. It breaks under Shor because it uses pairings. Referenced in Chapter 31.
Power2Round. The ML-DSA rounding operator that drops the low $d$ bits of a public-key coefficient, shrinking the public key. The discarded low part $\mathbf{t}_0$ stays with the signer and is never reconstructed during verification. The hint lets the verifier recover the high bits of the commitment without it. Introduced in Chapter 12.
PQC (Post-Quantum Cryptography). Cryptography whose hardness assumptions have no known polynomial-time quantum algorithm: Shor’s algorithm breaks factoring and discrete logarithm, and Grover’s quadratic search speedup is priced into parameter sizes rather than avoided. The families NIST has standardized or is considering are lattice (ML-KEM, ML-DSA, and FN-DSA in development as FIPS 206), hash (SLH-DSA), code (HQC), isogeny (SQIsign), and multivariate (MAYO, SNOVA, UOV). Classic McEliece was a fourth-round code-based candidate that NIST IR 8545 did not select. The subject of the book.
PQ-ZK. Post-quantum zero-knowledge: ZK proof systems whose soundness survives quantum attackers. Part VI’s subject.
PQRA (Post-Quantum Readiness Assessment). Encryptorium’s free seven-domain scoring rubric for prioritizing a cryptographic inventory. Chapter 30 uses it as the assessment backbone of the migration program. Introduced in Chapter 30.
PRF (Pseudorandom Function). A keyed function indistinguishable from random by any efficient adversary. Used inside ML-KEM and SLH-DSA for derandomization. Introduced in Chapter 11.

Q

QFT (Quantum Fourier Transform). The quantum circuit at the heart of Shor’s algorithm. Its classical simulation is exponential in the qubit count. Introduced in Chapter 4.
QROM (Quantum Random Oracle Model). The security model where random-oracle queries may be quantum superpositions, so the classical ROM is a strict special case. Introduced in Chapter 31, analyzed in depth in Chapter 33.

R

R1CS (Rank-1 Constraint System). The bilinear-constraint arithmetization used by pairing-based SNARKs such as Groth16. Each constraint has the form $(A \mathbf{w}) \cdot (B \mathbf{w}) = (C \mathbf{w})$ for witness $\mathbf{w}$ . Introduced in Chapter 31, referenced in Chapter 35.
Reed-Solomon code. The evaluation code $\{(f(\omega_0), \ldots, f(\omega_{N-1})) : \deg f \leq L - 1\}$ . STARKs encode traces as Reed-Solomon codewords and use FRI to test proximity to that bounded-degree code. Introduced in Chapter 21 as HQC’s outer code, developed in Chapter 34.
Regev encryption. The 2005 lattice PKE that showed LWE implies public-key encryption. The direct ancestor of ML-KEM’s K-PKE core. Introduced in Chapter 8, built in Chapter 10.
Rejection sampling. Drawing a candidate and discarding it unless it meets a bound, repeating until one passes. ML-DSA’s signer uses it to keep every published response inside a box whose distribution is independent of the secret. Introduced in Chapter 11, developed in Chapter 12.
RFC (Request for Comments). The archival publication series for internet technical specifications and related documents. An RFC’s status and stream are separate facts to check: RFC 5869 (HKDF) and RFC 8391 (XMSS) are both Informational rather than Standards Track, and both are load-bearing here. Referenced across Part V.
RLWE (Ring-LWE). LWE over a polynomial quotient ring, and the rank-one endpoint of Module-LWE. Module-LWE is the construction that interpolates, sitting between Ring-LWE and flat LWE in the algebraic structure it exposes. Introduced in Chapter 3, developed in Chapter 9.
ROM (Random Oracle Model). The proof heuristic that models hash functions as truly random. Introduced in Chapter 5.
Root-Hermite factor. The geometric quality $\delta$ satisfying $\|b_1\| \approx \delta^{d-1} \cdot \det(L)^{1/d}$ for a reduced basis of a $d$ -dimensional lattice. Its block-size dependence $\delta(\beta)$ comes from the Chen 2013 closed form and drives core-SVP cost estimates. Introduced in Chapter 13.

S

Schnorr signature. The three-move sigma protocol for discrete log plus Fiat-Shamir. Shor breaks it. The template for every sigma-protocol-based signature in Part VI. Introduced in Chapter 1. The sigma-protocol form is formally introduced in Chapter 33.
SBOM (Software Bill of Materials). The more general cousin of CBOM. An inventory of every software component. Referenced in Chapter 25.
secp256k1. The specific elliptic curve $y^2 = x^3 + 7$ over $\mathbb{F}_p$ with $p = 2^{256} - 2^{32} - 977$ . The curve Bitcoin uses. Broken by Shor. Referenced in Chapter 4.
Sigma protocol. A three-move (commitment, challenge, response) public-coin interactive proof. The template Fiat-Shamir compiles to signatures. Used in Chapter 23’s SQIsign walkthrough, formally introduced in Chapter 33.
SHA-3. The FIPS 202 hash family, built on the Keccak sponge construction. Used throughout ML-KEM, ML-DSA, and SLH-DSA. Referenced in Chapter 11 and Chapter 17.
SHAKE. The extendable-output function family derived from SHA-3 (SHAKE128, SHAKE256). Used as an XOF inside ML-KEM and SLH-DSA. Introduced in Chapter 11.
Shor’s algorithm. The 1994 quantum algorithm factoring integers and computing discrete logarithms in polynomial time. Introduced in Chapter 1.
SIDH (Supersingular Isogeny Diffie-Hellman). The isogeny-based key exchange broken in 2022 by the Castryck-Decru attack. Referenced in Chapter 3 and Chapter 22.
SIS (Short Integer Solution). The lattice hardness assumption dual to LWE, used in lattice signatures. Its module version Module-SIS is what a forking-lemma reduction extracts from any solver for SelfTargetMSIS, the variant ML-DSA’s unforgeability rests on, which is why SelfTargetMSIS is at least as hard as Module-SIS in the random-oracle model (Chapter 12). Referenced in Chapter 13.
SLH-DSA (Stateless Hash-Based Digital Signature Algorithm). The stateless hash-based signature scheme standardized in FIPS 205. The standardized form of SPHINCS+. Introduced in Chapter 1, built in Chapter 17.
SLIP (SatoshiLabs Improvement Proposal). The registry of wallet and derivation conventions maintained by SatoshiLabs alongside the BIPs. Referenced in Chapter 38.
SNARK (Succinct Non-Interactive Argument of Knowledge). A proof system with short proofs and fast verification. Most SNARKs in deployment use pairings (Shor-broken); hash-based STARKs have no known quantum break, subject to hash width and to the Fiat-Shamir analysis in the quantum random-oracle model (Chapter 33). Introduced in Chapter 31.
SNOVA. A multivariate signature candidate from NIST’s additional signatures track. Introduced in Chapter 24.
SPHINCS+. The construction name for the stateless hash-based signature scheme standardized as SLH-DSA in FIPS 205. See SLH-DSA, covered in Chapter 17 under the standardized name.
SQIsign. The isogeny-based signature scheme surviving the Castryck-Decru attack. Submitted to NIST’s additional signatures round. Introduced in Chapter 1, built in Chapter 23.
STARK (Scalable Transparent Argument of Knowledge). A proof system with polylogarithmic verifier time, no trusted setup, and hash-based soundness. Built on FRI. Its post-quantum standing is conditional on hash output width and on QROM accounting at deployment parameters, which is pending as of 2026. Introduced in Chapter 31, built in Chapter 34, applied in Chapter 35.
SVP (Shortest Vector Problem). Given a lattice, find the nonzero vector of minimal Euclidean norm. The canonical lattice hardness problem. Introduced in Chapter 3.
Syndrome. The product $s = H r^T$ of the parity-check matrix $H$ and a received word $r$ (under the column convention used in Chapter 19 and Appendix B). It depends only on the error pattern: zero exactly when the error is itself a codeword (the zero error included), a case no code can detect, and nonzero otherwise. Introduced in Chapter 3, developed in Chapter 19.
Syndrome decoding. The problem of recovering a low-weight error from its syndrome. NP-hard in the worst case. The hardness assumption underneath HQC and Classic McEliece. Introduced in Chapter 3, developed in Chapter 19.

T

TLS (Transport Layer Security). The protocol securing HTTPS. It was the first widely deployed transport for the post-quantum hybrid key exchange X25519MLKEM768. See that entry for the wire format. Introduced in Chapter 28.
TTL (Time To Live). The lifetime after which a cached or issued artifact expires. In Chapter 29’s JWKS rotation it is the token lifetime that decides when a retired key can leave the key set. Introduced in Chapter 29.
Tweakable hash. A hash variant taking an additional tweak input, used in SLH-DSA to prevent multi-target attacks. Introduced in Chapter 15, built in Chapter 17.

U

UOV (Unbalanced Oil and Vinegar). A multivariate signature construction from 1999. The basis for MAYO and SNOVA. Introduced in Chapter 24.
uSVP (Unique Shortest Vector Problem). A promise version of SVP where the shortest vector is much shorter than every lattice vector linearly independent of it. The problem LWE reduces to via the BDD-to-uSVP embedding. Introduced in Chapter 13.
UTXO (Unspent Transaction Output). Bitcoin’s transaction model where each unit of value is an immutable output, and ownership transitions via a signature on a spending transaction. Introduced in Chapter 36.

V

VEX (Vulnerability Exploitability eXchange). The CycloneDX companion format that records whether a known vulnerability is actually exploitable in a given product. A CBOM inventories primitives; VEX is the separate artifact that carries exploitability. Introduced in Chapter 25.

W

Wallet. The software or hardware that holds private keys and produces transaction signatures. Introduced in Chapter 38.
WOTS+ (Winternitz One-Time Signature Plus). The hash-chain one-time signature with improved multi-target security. Used inside XMSS and SLH-DSA. Introduced in Chapter 14, built in Chapter 15.

X

X25519. The Diffie-Hellman key exchange on Curve25519. Broken by Shor. Used as the classical half of X25519MLKEM768. Referenced in Chapters 1, 25, 27, 28, and 30.
X25519MLKEM768. The deployed hybrid KEM combining X25519 and ML-KEM-768. Introduced in Chapter 27.
X.509. The certificate format underlying most PKIs. Introduced in Chapter 29.
XMSS (eXtended Merkle Signature Scheme). The stateful hash-based signature scheme standardized in RFC 8391 and NIST SP 800-208. Introduced in Chapter 6, built in Chapter 15.
XOF (Extendable-Output Function). A hash-function variant producing arbitrary-length output. SHAKE128 and SHAKE256 are the standard XOFs. Used inside ML-KEM and SLH-DSA. Introduced in Chapter 11.

Z

Zcash. The privacy-focused cryptocurrency whose two active shielded pools run different proof systems: Sapling verifies pairing-based Groth16 proofs over BLS12-381, and Orchard verifies Halo 2 proofs whose inner-product argument rests on discrete log over Pallas and Vesta, with no pairing. Both fall to Shor. A Chapter 35 case study of a system that will need PQ reproofing. Introduced in Chapter 31.
ZK (Zero-Knowledge). A proof system where the verifier learns nothing beyond the truth of the statement. Part VI is the book’s treatment of post-quantum ZK. Introduced in Chapter 31.
ZKsync. The Ethereum Layer-2 rollup using STARK-style proofs. Introduced in Chapter 30, developed in Chapter 35.