Appendix A: Glossary

This glossary is a lookup table. Every entry gives a one-sentence definition and a back-reference. “Introduced in Chapter N” names the chapter where the term is first defined. A term the prerequisites page assumes, such as TLS or gas, is dated to its first use in a chapter instead. Where a term is defined early and built later, the entry names both, because the definition and the construction are different destinations. A back-reference to an Appendix D page says so. Alias forms point to the canonical term. When a scheme has a construction name (Kyber) and a standard name (ML-KEM), the canonical entry is the standard name and the construction name points at it.

Acronyms used across the book that are not cryptographic (NIST, IACR, NCSC, RFC, FIPS) carry a definition here because their meaning governs a lot of the book’s structure.

A

Account abstraction. Letting an Ethereum account’s validity check be contract code rather than the protocol’s fixed ECDSA check over secp256k1, so that a wallet can verify another signature scheme, a post-quantum one among them. ERC-4337 provides it through smart-contract accounts, with no change to the protocol. Introduced in Chapter 36, developed in Chapter 37.
Account model. Ethereum’s transaction model where each account holds a balance and a nonce, and signatures authenticate state-update transactions. It contrasts with Bitcoin’s UTXO model. Introduced in Chapter 36.
ACD (All Core Devs). Ethereum’s rough-consensus coordination forum, where cross-client teams surface a hard-fork proposal and agree what ships in an upgrade. Introduced in Chapter 41.
ACVP (Automated Cryptographic Validation Protocol). NIST’s framework for validating cryptographic implementations against published test vectors. The book’s flagship implementations are tested against ACVP vectors byte-for-byte. Introduced in Chapter 11.
ADRS (Address). The 32-byte domain separator in SLH-DSA that encodes the position of every hash call within the hypertree. Introduced in Chapter 3, built in Chapter 17.
AEAD (Authenticated Encryption with Associated Data). A symmetric mode that provides both confidentiality and integrity for a message while binding unencrypted associated data to the ciphertext. TLS 1.3 uses AES-GCM, AES-CCM, or ChaCha20-Poly1305. Introduced in Chapter 1, referenced in Chapter 5.
AES (Advanced Encryption Standard). The symmetric block cipher standardized in FIPS 197. Grover’s algorithm gives a quadratic key-search speedup in the idealized serial-query model, but the concrete attack cost is considerably higher, and NIST benchmarks Category 1 against AES-128 key search rather than treating AES-128 as broken. AES-256 keeps a 128-bit margin even at the idealized bound. Introduced in Chapter 1.
AIR (Algebraic Intermediate Representation). The constraint language STARKs compile programs to: a set of polynomial constraints over a trace table. Introduced in Chapter 31, developed in Chapter 34.
ALPN (Application-Layer Protocol Negotiation). The TLS extension that lets client and server pick an application protocol during the handshake. Relevant to PQ migration because mid-handshake negotiation constrains the wire format. The book does not build it. It appears in Part V, where Chapter 28 measures its contribution to a ClientHello’s size and Chapter 25’s solutions note that egress capture must record the negotiated group and cipher suite, because ALPN names the application protocol and not the cryptography.
AND-mode verification. The rule that a hybrid signature is valid only when every component signature validates, so an attacker who can forge one component still cannot produce a valid hybrid. It protects the verifier that runs it, not a verifier handed one component on its own (see Non-separability). Introduced in Chapter 27.
ASIC (Application-Specific Integrated Circuit). Custom silicon built for one computation. Not discussed in this edition: Chapter 13’s cost models charge for large-memory access rather than for custom hardware, so its sieving estimates are memory-bound rather than silicon-bound.

B

BCS transformation (Ben-Sasson-Chiesa-Spooner). The compiler that turns an interactive oracle proof into a non-interactive argument: the prover commits to each oracle with a Merkle tree, and Fiat-Shamir hashing derives the verifier’s challenges. Chiesa, Manohar and Spooner show that it is secure in the QROM when the interactive proof is round-by-round sound. Introduced in Chapter 31, developed in Chapter 33.
BDD (Bounded Distance Decoding). The lattice problem of finding the lattice point closest to a target that is guaranteed to lie within a specified distance from the lattice. The LWE problem reduces to BDD and then to uSVP via the Kannan embedding. Introduced in Chapter 8.
BIP (Bitcoin Improvement Proposal). The design-document registry through which Bitcoin protocol changes and conventions are proposed. Individual proposals are numbered, from BIP-32 (HD wallet derivation) to BIP-360 (an output type whose status Chapter 37 records). First cited in Chapter 1. The proposal process itself is walked in Chapter 41.
Bitcoin. The first cryptocurrency, launched in 2009. Transactions sign with ECDSA over secp256k1, and Taproot adds Schnorr over the same curve. Introduced in Chapter 1, developed from Chapter 36 on.
BKZ (Block Korkine-Zolotarev). A lattice-basis reduction algorithm parameterized by a block size. BKZ-β is the reduction Chapter 13’s lattice-attack estimates model. The block size drives concrete lattice-attack cost estimates, which a specified attack model then compares against NIST’s category benchmarks. Those benchmarks are reference-primitive costs defined independently of any lattice attack. Introduced in Chapter 3, developed in Chapter 13.
Blockchain. A distributed append-only ledger where transactions are grouped into cryptographically linked blocks. Introduced in Chapter 1, developed from Chapter 36 on.
BLS12-381. A pairing-friendly elliptic curve used by Zcash, Ethereum staking, and many pairing-based SNARKs. Shor’s algorithm breaks the underlying discrete-log assumption. Introduced in Chapter 31, developed as a consensus-signature curve in Chapter 39.
BLS signature. The Boneh-Lynn-Shacham signature scheme based on pairings. It aggregates trivially across attestations, and Shor’s algorithm breaks the underlying assumption. Not to be confused with the Barreto-Lynn-Scott curve family that gives BLS12-381 its name. Introduced in Chapter 36, developed in Chapter 39.

C

Canonical embedding. The map sending an element of a number field such as $\mathbb{Q}(\zeta_{2n})$ to the vector of its images under the field’s complex embeddings. Ring-LWE’s original hardness reduction states its error widths and dual ideals in this geometry, not in the coefficient representation the book computes in. Named in Chapter 9, which relies on this definition.
CBC (Cipher Block Chaining). A block-cipher mode of operation used as a foil for modern authenticated modes. It is not a construction the book builds. Referenced in Chapter 26.
CBD (Centered Binomial Distribution). The discrete error distribution ML-KEM samples from, with support $\{-\eta, \ldots, \eta\}$ and parameters fixed per security level. Introduced in Chapter 8. The sampler is built in Chapter 11.
CBOM (Cryptographic Bill of Materials). A machine-readable inventory of every cryptographic primitive, key, protocol, and dependency in a system. The CycloneDX 1.6 schema defines the format used in Chapter 25’s hands-on example. Introduced in Chapter 25.
CCA (Chosen-Ciphertext Attack). The adversarial model in which the attacker can query a decryption oracle. See IND-CCA2. Introduced in Chapter 5.
CCA2. See IND-CCA2.
Centered binomial distribution. See CBD.
Certificate Transparency. Public, append-only logs of issued TLS server certificates that anyone can audit, so that a certificate authority’s misissuance can be noticed. A log returns a signed certificate timestamp (SCT) as its promise to include a certificate, and SCTs reach the client during the TLS handshake. Named in Chapter 29, which relies on this definition.
Churn limit. Ethereum’s cap on how fast validators enter and leave the active set. Under Electra it meters activations and exits in ETH against a per-epoch budget of at most 256 ETH, so it bounds their sustained rate rather than each epoch’s total. Named in Chapter 36, defined in Chapter 39.
Classic McEliece. The code-based KEM submitted to NIST’s PQC process, built in Niederreiter form on the hidden-Goppa-code idea of McEliece’s 1978 public-key encryption scheme. Public keys are hundreds of kilobytes. Introduced in Chapter 1, with its underlying McEliece-style public-key encryption scheme built in Chapter 20, which does not build the Niederreiter KEM wrapper.
CNFL (Collect Now, Forge Later). The proof-system analogue of HNDL: a Shor-vulnerable verifier stays in service past the quantum crossover, so a future quantum adversary produces proofs that pass legacy verification. The threat is the verifier still running, not the transcripts collected. Chapter 34 Section 5.7 also applies the term to FRI-based STARKs, which have no Shor route. There the exposure is conditional: it depends on the Merkle hash’s quantum collision margin and on QROM accounting of the Fiat-Shamir step at deployment parameters. Named ahead in Chapter 1, developed in Chapter 34, applied in Chapter 35.
CNSA 2.0 (Commercial National Security Algorithm Suite 2.0). The NSA’s 2022 suite of algorithms approved for U.S. national security systems: ML-KEM-1024, ML-DSA-87, AES-256, SHA-384 or SHA-512, and the stateful LMS and XMSS for software and firmware signing. SLH-DSA is not part of it and is not approved for any NSS use. CNSSP 15 sets the compliance dates. Introduced in Chapter 1, applied in Chapters 25 and 29.
CNSSP 15 (Committee on National Security Systems Policy 15). The U.S. policy instrument that fixes the compliance dates for CNSA 2.0 on national security systems, including a 31 December 2031 milestone for mandatory use. Introduced in Chapter 1, used as a timeline anchor in Chapters 29 and 30.
Composite signature. A hybrid signature specified as one algorithm, with one combined public key, one combined signature and one algorithm identifier. The composite Chapter 27 builds pairs ML-DSA-65 with Ed25519 and verifies in AND mode. See Hybrid signature. Introduced in Chapter 27, applied in Chapter 29.
Consensus signature. The signature that authenticates a validator’s vote on a block at the chain’s heartbeat in a proof-of-stake system. Named in Chapter 30, defined as a surface in Chapter 36, developed in Chapter 39.
Core-SVP. A deliberately coarse cost model for lattice attacks that charges one SVP oracle call at block size $\beta$ as $2^{0.292\beta}$ classically and $2^{0.265\beta}$ quantumly and ignores the polynomial number of calls BKZ makes. The conservative baseline the Kyber and Dilithium submissions report. The Kyber team’s final parameter choice rests on a refined gate-count model, reported beside it. Introduced in Chapter 13.
CPA (Chosen-Plaintext Attack). The adversarial model in which the attacker obtains encryptions of plaintexts of its choice. For public-key encryption the public key gives it that, so no oracle is needed. See IND-CPA. Introduced in Chapter 5.
CRQC (Cryptographically Relevant Quantum Computer). A fault-tolerant quantum computer large enough to run Shor’s algorithm against deployed parameters such as RSA-2048 or a 256-bit elliptic curve. The $Z$ term of the Mosca inequality is the time until one exists. Introduced in Chapter 1.
CRS (Common Reference String). A public string that prover and verifier share before a zero-knowledge protocol runs. STARKs avoid it, Groth16 needs a trusted one. Introduced in Chapter 33.
CSIDH. The isogeny-based key exchange on supersingular curves defined over $\mathbb{F}_p$ , in which a commutative class group acts on the curves. Its public key is a single curve and it publishes no torsion-point images, so the Castryck-Decru attack on SIDH does not apply. Introduced in Chapter 22.
CSR (Certificate Signing Request). The X.509 structure a subject sends to a certificate authority to request a signed certificate. Not explicitly discussed in this edition, but included here for practitioners working with CA infrastructure alongside Chapter 29.
CSWP (Cybersecurity White Paper). NIST’s short-form publication series. CSWP 39 is the crypto-agility paper the book’s agility framing is synthesized from, alongside RFC 7696 and NIST IR 8547. Introduced in Chapter 26.
CVP (Closest Vector Problem). Given a lattice and a target vector, find the lattice point closest to the target. NP-hard in general. Introduced in Chapter 3.

D

DDH (Decisional Diffie-Hellman). The assumption, for a cyclic group $G$ with generator $g$ and uniform exponents $a$ and $b$ , that $g^{ab}$ is indistinguishable from a uniform element of $G$ given $g^a$ and $g^b$ . Whether it holds depends on the group, which is why Chapter 5 states ElGamal’s security for a group where it holds. It is stronger than CDH, and it supports pseudorandomness of the raw group element. For a derived key it is one route, with a suitable key-derivation function. The other, which Chapter 5 takes, is CDH in the random-oracle model through hash Diffie-Hellman. Broken by Shor. Named in Chapter 5, which relies on this definition.
Decisional second-preimage resistance. A multi-target property of a tweakable hash function: the adversary must say whether one of its target inputs has a second preimage under that target’s tweak, and its advantage is measured against the trivial strategy of always answering yes. Introduced in Chapter 18.
Decompose. The ML-DSA rounding operator that splits a coefficient into a high part and a low part around a window of size $2\gamma_2$ , so a signer can commit to just the high bits of its mask product. Introduced in Chapter 12.
DEEP-FRI. A variant of FRI in which, every folding round, the verifier also samples a point outside the evaluation domain, the prover states the folded polynomial’s value there, and the next round’s function is the fold quotiented by that point. Its soundness reaches the code’s list-decoding radius. Its companion DEEP-ALI uses one out-of-domain point to turn an evaluation claim into a low-degree claim. Introduced in Chapter 32.
DEM (Data Encapsulation Mechanism). The symmetric half of a KEM-DEM hybrid encryption scheme: the KEM establishes a key, the DEM encrypts the message under it. Introduced in Chapter 5.
Deuring correspondence. The bijection, induced by $E \mapsto \mathrm{End}(E)$ , between supersingular $j$ -invariants taken up to Galois conjugacy and conjugacy classes of maximal orders in the quaternion algebra $B_{p,\infty}$ . Chapter 3 gives the name Deuring’s theorem to its forward statement, that each such endomorphism ring is a maximal order, and Chapter 22 gives it to the bijection, which it then calls Deuring’s correspondence. Named in Chapter 3, stated in Chapter 22, and stated in the form SQIsign needs in Chapter 23.
DH (Diffie-Hellman). The 1976 key-agreement protocol over a cyclic group. Shor breaks it in polynomial time. Introduced in Chapter 1, built as a toy exchange in Chapter 5.
DHKEM. The generic construction turning a Diffie-Hellman group into a KEM. RFC 9180 specifies instantiations. Introduced in Chapter 27.
Dilithium. The construction name for the signature scheme standardized as ML-DSA in FIPS 204. Built from scratch as ML-DSA in Chapter 12, referenced in Chapter 33 as a Fiat-Shamir-with-aborts signature.
Discrete logarithm. Given a group element $g$ and $h = g^x$ , recover the exponent $x$ . Assumed classically hard in the groups deployed for it. Shor solves it in polynomial time. See ECDLP for the elliptic-curve case. Introduced in Chapter 1. Chapter 4 builds ECDSA on the elliptic-curve case and sketches Shor’s reduction.
Distinct-function multi-target second-preimage resistance. The SPHINCS+ round-3 notion asked of $F$ , $H$ and $\text{T}_\ell$ : given random inputs to distinct, predefined members of a function family, an adversary cannot find a second preimage of any one of them under its own member. Named in Chapter 16, defined in Chapter 18.
DLWE (Decisional LWE). The decision version of LWE: distinguish LWE samples from uniform. Introduced in Chapter 8.
Downgrade attack. An attack that tampers with an unprotected negotiation so that two parties settle on a weaker algorithm or protocol version than both support. POODLE and FREAK are examples. RFC 7696 §2.4 recommends integrity protection for algorithm negotiation against it. Introduced in Chapter 26.
Dual PRF. A two-input function that looks pseudorandom when keyed by either of its inputs. Bindel et al.’s hybrid KEM combiner rests on it and models HKDF as one, and RFC 9954 relies on the same assumption. Introduced in Chapter 27.

E

ECDH (Elliptic Curve Diffie-Hellman). Key agreement over an elliptic-curve group. Shor breaks it. Introduced in Chapter 1.
ECDLP (Elliptic Curve Discrete Logarithm Problem). Given $Q = dG$ , recover the scalar $d$ . Shor solves it in polynomial time on a fault-tolerant quantum computer. Introduced in Chapter 1.
ECDSA (Elliptic Curve Digital Signature Algorithm). The signature scheme based on ECDLP used by most public blockchains and many TLS servers. Shor breaks it. Introduced in Chapter 1, constructed and walked in Chapter 4.
Ed25519. The EdDSA signature scheme instantiated on edwards25519, the twisted Edwards curve birationally equivalent to Curve25519 (RFC 8032, RFC 7748). Shor breaks it. Referenced in Chapters 1, 26, 27, 29, and 30.
EdDSA. The Edwards-curve signature family. Shor breaks it. Referenced in Chapter 1.
Endomorphism ring. The ring $\mathrm{End}(E)$ of isogenies from an elliptic curve $E$ to itself, together with the zero map, under addition and composition. For a supersingular curve over $\mathbb{F}_{p^2}$ it is a maximal order in the quaternion algebra $B_{p,\infty}$ , and recovering it is the hardness assumption SQIsign rests on. Named in Chapters 2 and 3, which rely on this definition. Chapter 22 states its structure and Chapter 23 computes with it.
ERC-4337 (Ethereum Request for Comments 4337). The Ethereum standard for account abstraction through smart-contract accounts. See Account abstraction.
Ethereum. The smart-contract platform launched in 2015. Transactions sign with ECDSA over secp256k1, and post-merge consensus signatures use BLS over BLS12-381. Introduced in Chapter 1, developed from Chapter 36 on.
EUF-CMA (Existential Unforgeability under Chosen-Message Attack). The standard unforgeability game for signatures: the adversary obtains signatures on messages of its choice from a signing oracle and must produce a valid signature on a message it never queried. Introduced in Chapter 6.

F

Fiat-Shamir transform. The compiler that turns a public-coin interactive proof into a non-interactive one by deriving the verifier’s coins from a hash of the transcript. Introduced in Chapter 12 as ML-DSA’s challenge derivation, generalized in Chapter 31, analyzed in the QROM in Chapter 33.
Fiat-Shamir with aborts. The lattice adaptation of the Fiat-Shamir transform in which the signer discards any response that would leak the secret and restarts with fresh randomness, so the published response distribution is independent of the secret. The signing method of ML-DSA. Introduced in Chapter 12.
Finality. The state at which a block cannot be reversed by chain reorganization. Chapter 36 names it, with the closing of the slashing window, as the point after which an old attestation loses consensus relevance. The ordinary on-spend race closes earlier, at first inclusion (Chapter 37), and displacing an included transaction needs a reorganization. Referenced in Chapter 36.
FIPS (Federal Information Processing Standard). NIST publication series carrying U.S. federal cryptographic requirements. The post-quantum standards are FIPS 203, 204 and 205, all published August 2024. As of 19 October 2026, FIPS 206 is in development and no draft has been released. FIPS 203 standardizes ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA. Introduced in Chapter 1.
FO transform (Fujisaki-Okamoto transform). A family of transforms that turns a suitable public-key encryption scheme into an IND-CCA2 KEM in a random-oracle model, under the variant’s own correctness and derandomization hypotheses. The bound depends on the variant and on whether the oracle is classical or quantum. ML-KEM uses a modified Fujisaki-Okamoto transform with implicit rejection, where a tampered ciphertext returns a pseudorandom key derived from a secret rejection seed and the ciphertext, rather than the $\perp$ symbol. In Hofheinz, Hövelmanns and Kiltz’s terms, the construction Chapter 5 teaches is $\mathrm{FO}^{\not\perp}$ , which composes their derandomizing re-encryption step with their implicit-rejection key derivation. Introduced in Chapter 5, applied in Chapter 11 and Chapter 21.
FN-DSA (Fast-Fourier lattice-based Digital Signature Algorithm). The NTRU-lattice signature scheme derived from Falcon, selected by NIST and, as of 19 October 2026, in development as FIPS 206. This edition discusses it but does not build it. Part VII treats FN-DSA-512 as a consensus candidate in Chapter 39. Introduced in Chapter 1.
FORS (Forest Of Random Subsets). The few-time signature primitive inside SLH-DSA: a forest of Merkle trees, each signing one chunk of the message digest. Introduced in Chapter 14, built in Chapter 16.
Forward secrecy. The property that compromising a long-term key does not expose past sessions, because session keys come from an ephemeral key exchange. It does not survive a quantum attacker when the ephemeral group is Shor-reducible. Introduced in Chapter 1.
FRI (Fast Reed-Solomon Interactive Oracle Proofs of Proximity). The protocol that anchors STARKs by testing proximity to a bounded-degree Reed-Solomon code. Soundness is stated against words far from that code, and is not an exact-membership guarantee for every accepted oracle. Introduced in Chapter 30, explained in Chapter 31, its folding and soundness built in Chapter 32, developed in Chapter 34.
FROST (Flexible Round-Optimized Schnorr Threshold signatures). Komlo and Goldberg’s threshold-Schnorr scheme over a discrete-log group: any $t$ of $n$ share-holders produce one Schnorr signature under their joint key. Shor breaks it, so it is not a post-quantum migration target. Introduced in Chapter 39.
Fundamental parallelepiped. The half-open parallelepiped $\{Bx : 0 \leq x_i < 1\}$ of a lattice basis $B$ . Its volume equals the lattice determinant. Introduced in Chapter 7.

G

GapSVP. The decision version of SVP: decide whether the shortest vector is at most 1 or at least $\gamma$ , given a promise. Introduced in Chapter 3.
Gas. Ethereum’s unit of computation cost. Introduced in Chapter 17, developed in Chapter 37.
GCD (Greatest Common Divisor). The largest integer dividing both of two integers, computed by the Euclidean algorithm. Two gcd calls, $\gcd(x - 1, n)$ and $\gcd(x + 1, n)$ with $x = a^{r/2}$ , complete the Shor attack on RSA once quantum period finding returns a usable even order. Introduced in Chapter 2, walked in Chapter 4.
Goppa code. The algebraic code family Classic McEliece uses. Efficient decoding via Patterson’s algorithm is the trapdoor. Introduced in Chapter 19, applied in Chapter 20.
Gram-Schmidt orthogonalization (GSO). The mutually orthogonal vectors obtained from a lattice basis, taken in order, by projecting each basis vector orthogonally to all the earlier ones. The first is the first basis vector, their lengths multiply to the lattice’s determinant, and they are in general not lattice vectors. LLL’s tests, the shape of BKZ’s output and the primal attack’s success condition are stated in their terms. Introduced in Chapter 13.
Grinding. A per-proof proof of work in a Fiat-Shamir transcript: before any query position is derived, the prover must find a nonce whose hash with the transcript state has at least $g$ trailing zero bits. Each query set then costs a classical forger about $2^g$ hash evaluations, and Chapter 34 Section 5.4 gives the quantum figure. Named in Chapter 31, defined in Chapter 34.
Groth16. The pairing-based zk-SNARK whose proof is three group elements. Shor breaks its pairing assumption. Introduced in Chapter 31, referenced in Chapter 35 as the baseline for pairing-based ZK under a quantum threat model.
Grover’s algorithm. The quantum unstructured-search algorithm with quadratic speedup: $O(\sqrt{N})$ queries against a classical $O(N)$ . The halved-bits shorthand (AES-128 → 64 bits, SHA-256 preimage → 128 bits) is the idealized serial-query bound, not the concrete attack cost, which circuit depth, error correction, and parallelization push considerably higher. Introduced in Chapter 1.
GSA (Geometric Series Assumption). The heuristic that the Gram-Schmidt lengths of a BKZ-reduced basis fall geometrically, each about $\delta(\beta)^{-2}$ times the one before. Used to derive the primal-attack success condition in lattice cryptanalysis. Introduced in Chapter 13.

H

Hard fork. A backward-incompatible consensus-rule change: upgraded nodes accept blocks the old rules reject, so a full node that follows and validates the upgraded chain needs the new rules. A node can decline and continue under the old ones. One of several migration paths for a blockchain signature change: Ethereum’s consensus-layer signatures need one, while Bitcoin’s BIP-360 is a soft-fork proposal and Ethereum account abstraction is a contract-level path. Introduced in Chapter 23, developed in Chapter 41.
Hardened derivation. BIP-32 child-key derivation whose input includes the parent private key, so that a child public key cannot be computed from the parent public key alone. Non-hardened derivation uses the parent public key instead, which lets a watch-only wallet derive child public keys. Introduced in Chapter 38.
HelloRetryRequest. The TLS 1.3 server message that asks the client to send a new key share for a different mutually supported group, at the cost of one more round trip. Introduced in Chapter 28.
Hint (ML-DSA). A one-bit-per-coefficient correction the signer attaches so a verifier holding only the truncated public key can recover the high bits of the recomputed commitment. Produced by MakeHint and applied by UseHint. Introduced in Chapter 12.
HKDF (HMAC-based Key Derivation Function). The RFC 5869 key-derivation function combining an HKDF-Extract step with an HKDF-Expand step, both built on HMAC. The hybrid combiner in Chapter 27 feeds component secrets through HKDF-SHA256. Introduced in Chapter 5, applied in Chapter 27.
HNDL (Harvest Now, Decrypt Later). The adversarial strategy of recording TLS traffic today and decrypting it once a quantum computer exists. The reason PQ key exchange is urgent. Introduced in Chapter 1.
Honest-verifier zero knowledge. Zero knowledge required only against a verifier that follows the protocol, drawing its challenge uniformly and independently of the commitment. Schnorr’s protocol has it in the perfect special form: a simulator handed any challenge produces transcripts distributed exactly as the real ones. Introduced in Chapter 31.
HQC (Hamming Quasi-Cyclic). The code-based KEM NIST selected in March 2025 for standardization as a backup to ML-KEM. Built from quasi-cyclic codes over the binary Hamming metric. No draft of the HQC standard had been published by 19 October 2026. Introduced in Chapter 1, with a toy of its IND-CPA public-key encryption core built in Chapter 21, which describes the salted Fujisaki-Okamoto wrapper rather than building it.
HSM (Hardware Security Module). Tamper-resistant hardware that generates, stores, and uses long-term keys. PQ migration is constrained by how quickly HSM vendors ship firmware supporting the new algorithms. Introduced in Chapter 26, applied in Chapter 29.
Hybrid signature. A signature that concatenates (or composites) a classical signature and a post-quantum signature, verifying if both verify. Introduced in Chapter 27, which builds one as a composite signature (see that entry), applied in Chapter 29.
Hybrid key exchange. A key agreement combining a classical component (X25519) and a post-quantum component (ML-KEM) in parallel, with the session key derived from both. The deployed form is X25519MLKEM768. See its own entry. Introduced in Chapter 1, built in Chapter 27.
Hypertree. The multi-layer Merkle tree inside SLH-DSA: WOTS+ leaves at each layer, and each layer’s root is signed by the next. Introduced in Chapter 14, developed in Chapter 16, built in Chapter 17.

I

IACR (International Association for Cryptologic Research). The professional body that runs CRYPTO, EUROCRYPT, ASIACRYPT, TCC, and publishes ePrint. Reference target across the book: it appears in the rendered reference list of every chapter that cites an ePrint preprint, rather than in any chapter’s prose.
IKEv2 (Internet Key Exchange Protocol Version 2). The protocol that sets up IPsec. RFC 9370 extends it with up to seven additional key exchanges, which is how IPsec carries a post-quantum KEM alongside a classical (EC)DH exchange. Introduced in Chapter 5, extended in Chapter 26.
IND-CCA2 (Indistinguishability under Adaptive Chosen-Ciphertext Attack). The standard encryption security game: for a PKE the adversary has a decryption oracle, barred on the challenge ciphertext, and must distinguish encryptions of two chosen messages. The KEM game is different and is the one the book targets. There the adversary gets the challenge ciphertext alongside either the real encapsulated key or an independent uniform key of the same length, with a decapsulation oracle barred on that ciphertext, and chooses no messages at all. Introduced in Chapter 5.
IND-CPA (Indistinguishability under Chosen-Plaintext Attack). The weaker encryption game with no decryption oracle. ML-KEM’s underlying K-PKE is IND-CPA. The FO transform lifts it to IND-CCA2. Used from Chapter 4 on, stated as a game in Chapter 5, developed in Chapter 10.
Interleaved target subset resilience. The property asked of SLH-DSA’s message hash $\text{H}_{msg}$ , which maps a message and its randomizer to a FORS instance and one index in each of that instance’s $k$ trees. After seeing the selections of many signed messages, an adversary cannot find a new message and randomizer that select an instance in which each of the $k$ indices was already selected by some earlier message. Introduced in Chapter 18.
IOP (Interactive Oracle Proof). The proof-system framework underlying STARKs: the prover sends oracle messages and the verifier reads positions. Introduced in Chapter 31.
IPD (Initial Public Draft). NIST’s first public revision of a document, issued for comment before a final publication. SP 800-230 and NIST IR 8547 are both cited at IPD status in this edition. Introduced in Chapter 1, used as a status label in Chapter 39.
Isogeny. A non-zero morphism between elliptic curves preserving the group law. The foundation of isogeny-based cryptography. Introduced in Chapter 3, developed in Chapter 22.
ISD (Information Set Decoding). The best classical family of attacks on syndrome decoding. The exponent that sets HQC’s parameter sizes. Introduced in Chapter 3, built in Chapter 19, applied in Chapter 20.

J

Johnson bound. For a Reed-Solomon code of rate $\rho$ , the relative Hamming radius $1 - \sqrt{\rho}$ , out to which the code is list-decodable and the proximity-gap theorem holds. It is larger than the unique-decoding radius $(1 - \rho)/2$ , and informal STARK writeups routinely conflate the two. Introduced in Chapter 32, developed in Chapter 34.
JWT (JSON Web Token). A compact token of three base64url-encoded parts separated by dots: a header whose alg member names the signing algorithm, a payload of claims, and a signature over the first two. RS256 in the header names an RSA signature with SHA-256 (RSASSA-PKCS1-v1_5). JOSE (JSON Object Signing and Encryption) is the family of standards that defines these formats. Used from Chapter 25 on, built as a JWT-like token in Chapter 26, with its signing input given in Chapter 29.

K

Kannan embedding. The lattice construction that encodes a BDD or unique-SVP problem inside a larger lattice so that a solution to SVP on the embedding recovers the BDD target. Used by the primal attack on LWE. Introduced in Chapter 13.
KAT (Known Answer Test). A fixed input paired with the output a conforming implementation must produce. The book’s flagship implementations are checked against NIST KATs; Chapter 21’s HQC toy and Chapter 23’s SQIsign toy deliberately are not. Introduced in Chapter 21.
KDF (Key Derivation Function). A function deriving one or more keys from input keying material and, where appropriate, a context string. It may extract and it may expand, and its output need not be longer than its input: Chapter 27’s hybrid combiner maps 64 bytes of concatenated secret to a 32-byte key. Introduced in Chapter 5.
KEM (Key Encapsulation Mechanism). A public-key primitive with three algorithms (KeyGen, Encap, Decap) where Encap samples the shared secret rather than taking it as input. ML-KEM is the post-quantum KEM the book builds from scratch. Chapter 21 builds an HQC-inspired IND-CPA PKE core and explains the salted HHK wrapper the real HQC KEM uses without implementing it. Introduced in Chapter 5.
KEX (Key Exchange). The general term for a protocol where two parties derive a shared secret. Diffie-Hellman is a KEX; a KEM is a KEX with a specific API. Introduced in Chapter 1.
KLPT (Kohel-Lauter-Petit-Tignol). The quaternion algorithm that, given a left ideal of a maximal order and a small prime $\ell$ , finds an equivalent left ideal whose norm is a power of $\ell$ . Under the Deuring correspondence the result is an isogeny of $\ell$ -power degree between the corresponding curves. Introduced in Chapter 23, which also describes what SQIsign’s Round 2 replaced it with.
KZG (Kate-Zaverucha-Goldberg). The pairing-based polynomial commitment scheme underlying Plonk. Shor breaks the pairing-discrete-log assumption it relies on. Introduced in Chapter 30, developed in Chapter 32.
Kyber. The working name during NIST’s PQC process for the lattice-based KEM standardized as ML-KEM in FIPS 203. Introduced in Chapter 9, built in Chapter 11.

L

Lamport signature. The 1979 one-time signature: reveal half of $2n$ preimages under a hash function to sign an $n$ -bit message. The foundation every hash-based signature inherits. Introduced in Chapter 14.
Lattice. The integer-combination set $L(B) = \{B x : x \in \mathbb{Z}^n\}$ for a basis matrix $B$ . Introduced in Chapter 3, developed in Chapter 7.
LDE (Low-Degree Extension). Encoding a short polynomial or trace as its evaluation on a larger domain, producing a Reed-Solomon codeword STARKs can test with FRI. Introduced in Chapter 34.
Leftover hash lemma. The result that a universal hash function applied to an input with enough min-entropy gives an output statistically close to uniform, even to someone who knows which function was used. Chapter 10 applies it to $r \mapsto [A \,\|\, u]^\top r$ with $r$ uniform in $\{0, 1\}^m$ , for uniform $A$ and $u$ , whose output is $\epsilon$ -close to uniform on $\mathbb{Z}_q^{n+1}$ when $m \geq (n + 1) \log_2 q + 2 \log_2 (1/\epsilon)$ . Introduced in Chapter 10.
LLL (Lenstra-Lenstra-Lovász). The polynomial-time lattice reduction algorithm from 1982. It outputs a basis with the first vector bounded by an exponential factor times the shortest vector. Introduced in Chapter 13.
LMS (Leighton-Micali Signature). The stateful hash-based signature scheme specified in RFC 8554 and approved by NIST in SP 800-208. Introduced in Chapter 6, referenced in Chapter 15, applied in Chapters 29 and 38.
LWE (Learning With Errors). The hardness assumption underneath ML-KEM, and underneath ML-DSA’s key recovery: given $(A, As + e)$ with small error $e$ , recover $s$ . ML-DSA’s unforgeability rests on this together with SelfTargetMSIS, a variant of Module-SIS (Chapter 12). Introduced in Chapter 3, developed in Chapter 8.

M

MAYO. A multivariate signature candidate from NIST’s additional signatures track, not standardized as of 19 October 2026. Introduced in Chapter 24.
Measure-and-reprogram. The quantum-random-oracle reduction technique of Don, Fehr, Majenz and Schaffner: the reduction measures one of the adversary’s queries, records the input, reprograms the oracle at that input, and continues from the measured input. It loses a factor quadratic in the number of queries, where the classical argument loses a linear one. Named in Chapter 31, defined in Chapter 33.
Mempool. A node’s pool of broadcast transactions not yet included in a block. A transaction that first reveals its public key there opens the on-spend race between broadcast and inclusion. Named in Chapter 36, which relies on this definition.
Merkle-Damgård. The iterative hash construction underlying MD5, SHA-1, and SHA-2. Susceptible to length-extension. SHA-3 uses the sponge construction instead. Not explicitly discussed in this edition. The SHA-2 and SHA-3 hash primitives are used across Parts II and III without naming the underlying construction.
Merkle tree. The binary hash tree that compresses many leaves into a single root. It aggregates one-time public keys in the book’s many-time and stateless signature constructions, and binds the oracle tables in its hash-based STARK constructions. It is not a prerequisite for a one-time signature: Chapter 14 builds Lamport OTS before any tree, and WOTS+ stands alone as well. Introduced in Chapter 14.
MinRank. The problem of finding coefficients $x_1, \ldots, x_K$ in a finite field, not all zero, such that $x_1 M_1 + \cdots + x_K M_K$ has rank at most $r$ for given matrices $M_1, \ldots, M_K$ . A MinRank attack on a multivariate scheme builds such matrices from the public map and looks for a member of low rank. Introduced in Chapter 24.
ML-DSA (Module-Lattice-Based Digital Signature Algorithm). The lattice-based signature scheme standardized in FIPS 204. Its security rests on Module-LWE and SelfTargetMSIS together (FIPS 204 §3.2). Its key equation is a Module-LWE sample, and SelfTargetMSIS is a variant of Module-SIS that is at least as hard as Module-SIS in the random-oracle model. The standardized form of Dilithium. Introduced in Chapter 1, treated as a signature family in Chapter 6, built from scratch in Chapter 12.
ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism). The lattice-based KEM standardized in FIPS 203. Built from Module-LWE via an IND-CPA K-PKE core lifted to IND-CCA2 through the FO transform. The standardized form of Kyber. Introduced in Chapter 1, built in Chapter 11.
MLWE (Module-LWE). The structured LWE variant over a polynomial module of rank $k$ . The pseudorandomness assumption underneath ML-KEM. ML-DSA’s unforgeability rests on it together with SelfTargetMSIS (Chapter 12). Introduced in Chapter 3, developed in Chapter 9.
Module-Lattice. A lattice structured as a module of rank $k$ over a polynomial ring. See MLWE for the hardness assumption it carries. Introduced in Chapter 9.
Module-SIS (Module Short Integer Solution). The Short Integer Solution problem over a module lattice: find a short nonzero solution to a homogeneous linear system over $R_q$ . ML-DSA’s unforgeability rests on SelfTargetMSIS, the variant in which the challenge is fixed as a hash of the commitment rather than chosen by the adversary (Chapter 12), together with Module-LWE, as FIPS 204 §3.2 states. Introduced in Chapter 12, beside the unstructured SIS problem it specializes.
Mosca inequality. The back-of-envelope inequality $X + Y > Z$ that says whether an asset under quantum-vulnerable cryptography is already exposed: $X$ is how long it must stay protected (a secret’s shelf life, or how long a trust decision must hold), $Y$ is migration time, and $Z$ is Mosca’s collapse time. That is the time until a quantum computer, or some other method, breaks the public-key cryptography deployed today. For the quantum threat, it is the time until a CRQC exists. Chapter 36 defines the positive part of $X + Y - Z$ , in years, as the exposure window, which Part VII also calls the Mosca window and the breach window. Introduced in Chapter 1.
MTI (Mandatory-to-Implement). The set of algorithms or suites RFC 7696 §2.2 requires every conforming implementation of a protocol to support, so that any two implementations share one. Optional algorithms extend it without fragmenting it, and changing it is how a standards body moves an ecosystem through a migration. Introduced in Chapter 26.
MTU (Maximum Transmission Unit). The largest network-layer packet a link carries without fragmentation, headers included, so the bytes available to an application are the MTU less the framing its transport adds. Appendix D’s Chapter 17 Exercise 3 stipulates a usable budget of about 1,400 bytes on a mobile link and turns a signature size into a packet count, which is how it prices SLH-DSA’s two parameter sets against each other. Introduced in Appendix D, Chapter 17.
Multisig. A $k$ -of- $n$ authorization in which $n$ independent public keys are registered and a transaction carries $k$ valid signatures, each checked against its own key. A threshold signature instead registers one joint key and verifies one signature. Named in Chapter 23, set against a threshold signature in Chapter 36.

N

NCSC (National Cyber Security Centre). The UK national cybersecurity authority whose 2025 timelines (2028 discovery and migration plan, 2031 highest-priority migrations done, 2035 complete) anchor the book’s deployment chapters. Introduced in Chapter 1.
NIST (National Institute of Standards and Technology). The U.S. standards body that runs the PQC standardization process and publishes FIPS and SP documents. Introduced in Chapter 1.
Non-separability. The property RFC 9955 asks of a hybrid signature against stripping, in two grades. Under weak non-separability, a component signature separated from the hybrid still verifies under a standalone verifier for its algorithm but leaves evidence of the separation. Under strong non-separability it fails verification. Introduced in Chapter 27.
NSA (National Security Agency). The U.S. agency that publishes CNSA 2.0 and its FAQ, whose dates for national security systems the book’s deployment chapters cite. Introduced in Chapter 1.
NTT (Number-Theoretic Transform). The finite-field analogue of the FFT. It multiplies polynomials in $\mathbb{Z}_q[x]/(x^n+1)$ in $O(n \log n)$ when $q$ has a primitive $2n$ -th root of unity. Introduced in Chapter 9.

O

OAEP (Optimal Asymmetric Encryption Padding). The padding scheme turning textbook RSA into IND-CCA2 encryption in the random oracle model. Introduced in Chapter 4, developed in Chapter 5.
OCSP (Online Certificate Status Protocol). The protocol for checking whether an X.509 certificate is revoked. PQ migration touches it because OCSP responses are themselves signed. Not discussed in this edition, but included here for practitioners working with certificate-authority infrastructure alongside Chapter 29.
OID (Object Identifier). The dotted-decimal name that ASN.1 and X.509 use to identify an algorithm or a parameter set. SLH-DSA’s pre-hash variant binds one into the signed message, and a PKI inventory keys on them. Introduced in Chapter 17, used in Chapters 26 and 29.
OMB (Office of Management and Budget). The office within the U.S. Executive Office of the President that Executive Order 14412 directs to issue post-quantum guidance for civilian federal agencies. The order sets two dates for that guidance, covering agencies’ High Value Assets and high-impact systems: 2030 for key establishment and 2031 for signatures. OMB Memorandum M-26-15 implements the order with a migration planned in five phases, the last of which should focus on completing the remaining systems by 2035. Introduced in Chapter 1, used as a timeline anchor in Chapter 30.
On-chain verifier. A smart-contract function on Ethereum L1 that checks a cryptographic proof of correct execution of an off-chain rollup state transition. Post-quantum migration upgrades this contract. Introduced in Chapter 30 as the rollup-exit verifier contract, developed in Chapter 36. The upgrade itself is Chapter 40’s subject.
OTS (One-Time Signature). A signature scheme that remains secure only when used once under a given key. Lamport, Winternitz, and WOTS+ are OTS schemes. Introduced in Chapter 14.
OW-CPA (One-Wayness under Chosen-Plaintext Attack). A weaker security notion than IND-CPA: given the public key and an encryption of a uniformly random message, the adversary cannot recover the whole message. Hofheinz, Hövelmanns and Kiltz’s analysis of the FO transform, which FIPS 203 cites for ML-KEM, gives two bounds. From an OW-CPA K-PKE the reduction loses a factor of the random-oracle query count, and from an IND-CPA one it is tight (Chapter 5’s theorem, and Appendix D, Chapter 5). Named in Chapter 11 and Chapter 13, which rely on this definition.

P

P-256 (also NIST P-256, secp256r1, prime256v1). The NIST prime elliptic curve over a 256-bit prime. Used for ECDH key exchange and ECDSA signatures across TLS and WebPKI. Broken by Shor. Referenced in Chapters 1, 25, 26, 28, and 29.
Patterson’s algorithm. The polynomial-time decoder for binary Goppa codes, which needs the Goppa polynomial $g(x)$ and the support $L$ . Knowing them is Classic McEliece’s trapdoor. Introduced in Chapter 19, built in Chapter 20.
PCS (Polynomial Commitment Scheme). A commitment to a polynomial that supports proving an evaluation at a point without revealing the polynomial. The L2 layer of every proof system the book takes apart. Introduced in Chapter 32.
PKE (Public-Key Encryption). The primitive where a public key encrypts and a private key decrypts, with the sender choosing the plaintext. Distinct from KEM. Introduced in Chapter 5.
PKI (Public Key Infrastructure). The system of certificate authorities, registration authorities, and trust stores that binds public keys to identities. Introduced in Chapter 29.
PLONK. A SNARK construction with a universal setup. It breaks under Shor because it uses pairings. Referenced in Chapter 31.
Power2Round. The ML-DSA rounding operator that drops the low $d$ bits of a public-key coefficient, shrinking the public key. The discarded low part $\mathbf{t}_0$ stays with the signer and is never reconstructed during verification. The hint lets the verifier recover the high bits of the commitment without it. Introduced in Chapter 12.
PQC (Post-Quantum Cryptography). Cryptography whose hardness assumptions have no known polynomial-time quantum algorithm: Shor’s algorithm breaks factoring and discrete logarithm, and Grover’s quadratic search speedup is priced into parameter sizes rather than avoided. As of 19 October 2026, NIST had standardized the lattice-based ML-KEM and ML-DSA and the hash-based SLH-DSA, and had approved the stateful hash-based LMS and XMSS in SP 800-208. It was developing the lattice-based FN-DSA as FIPS 206. It had selected the code-based HQC for standardization, and the third round of its Additional Digital Signatures process included the isogeny-based SQIsign and the multivariate UOV, MAYO, QR-UOV and SNOVA, among other schemes. Classic McEliece was a fourth-round code-based candidate that NIST IR 8545 did not select. The subject of the book.
PQ-ZK. Post-quantum zero-knowledge: ZK proof systems whose soundness survives quantum attackers. Part VI’s subject.
PQRA (Post-Quantum Readiness Assessment). Encryptorium’s free seven-domain rubric for scoring an organization’s readiness to migrate to post-quantum cryptography. Chapter 30 adapts it to prioritize the touchpoints of a cryptographic inventory and uses it as the assessment backbone of the migration program. Introduced in Chapter 30.
Prange’s algorithm. The 1962 baseline of information-set decoding: pick a random information set, solve the parity-check equations for an error supported on the other positions, and output it if it has the target weight, repeating until it does. It succeeds when the information set avoids every error position. Introduced in Chapter 19.
Precompile. A contract at a fixed address whose function the Ethereum Virtual Machine implements natively rather than in bytecode, at a gas price the protocol sets. Named in Chapter 26, discussed for ML-DSA verification in Chapter 37.
PRF (Pseudorandom Function). A keyed function indistinguishable from random by any efficient adversary. Used inside ML-KEM and SLH-DSA for derandomization. Introduced in Chapter 11.
Proof of possession. A signature that shows the registrant of a public key holds its secret key, checked when the key is registered. It blocks rogue-key attacks on same-message aggregate BLS verification, and Ethereum’s validator deposits carry one. Named in Chapter 39, which relies on this definition.
Proximity gap. The property of Reed-Solomon codes that FRI’s soundness rests on: a fold with a random challenge brings a word far from the code close to it only with small probability, the bad-challenge probability. Ben-Sasson, Carmon, Ishai, Kopparty and Saraf prove it out to the Johnson bound. Named in Chapter 31, stated in Chapter 32, with its regimes and error terms in Chapter 34 Section 5.1.

Q

QFT (Quantum Fourier Transform). The quantum circuit at the heart of Shor’s algorithm. Its classical simulation is exponential in the qubit count. Introduced in Chapter 4.
QROM (Quantum Random Oracle Model). The security model where random-oracle queries may be quantum superpositions, so the classical ROM is a strict special case. Introduced in Chapter 5, restated in Chapter 31, analyzed in depth in Chapter 33.

R

R1CS (Rank-1 Constraint System). The bilinear-constraint arithmetization used by pairing-based SNARKs such as Groth16. Each constraint has the form $(A \mathbf{w}) \cdot (B \mathbf{w}) = (C \mathbf{w})$ for witness $\mathbf{w}$ . Introduced in Chapter 31, referenced in Chapter 35.
Rainbow. A multi-layer Oil and Vinegar signature scheme submitted to round 3 of NIST’s standardization process. Beullens’s 2022 key-recovery attack exploited its layered structure, and NIST did not select it. The attack does not directly generalize to single-layer UOV. Introduced in Chapter 24.
Reed-Solomon code. The evaluation code $\{(f(x))_{x \in D} : \deg f \leq L - 1\}$ for an evaluation domain $D$ of size $N$ . STARKs encode traces as Reed-Solomon codewords and use FRI to test proximity to that bounded-degree code. Introduced in Chapter 21 as HQC’s outer code, developed in Chapter 34.
Regev encryption. The 2005 lattice PKE that showed LWE implies public-key encryption. The direct ancestor of ML-KEM’s K-PKE core. Introduced in Chapter 8, built in Chapter 10.
Rejection sampling. Drawing a candidate and discarding it unless it meets a bound, repeating until one passes. ML-DSA’s signer uses it to keep every published response inside a box whose distribution is independent of the secret. Introduced in Chapter 6, developed in Chapter 12.
Rewinding. The classical extraction technique: a reduction runs a prover to an accepting transcript, rewinds it to just after its commitment, and runs it again on a different challenge, so that special soundness turns the two transcripts into the witness. In the random-oracle model the reduction records the adversary’s queries and re-runs it from the decisive one. A quantum adversary’s queries cannot be recorded that way, which is the half the QROM analysis has to replace. Named in Chapter 31, defined in Chapter 33.
RFC (Request for Comments). The archival publication series for internet technical specifications and related documents. An RFC’s status and stream are separate facts to check: RFC 5869 (HKDF) and RFC 8391 (XMSS) are both Informational rather than Standards Track, and both are load-bearing here. Referenced across Part V.
RLWE (Ring-LWE). LWE over a polynomial quotient ring, and the rank-one endpoint of Module-LWE. Module-LWE is the construction that interpolates, sitting between Ring-LWE and flat LWE in the algebraic structure it exposes. Introduced in Chapter 3, developed in Chapter 9.
ROM (Random Oracle Model). The proof heuristic that models hash functions as truly random. Used from Chapter 3 on, defined in Chapter 5, developed in Chapter 33.
Root-Hermite factor. The geometric quality $\delta$ satisfying $\|b_1\| \approx \delta^{d-1} \cdot \det(L)^{1/d}$ for a reduced basis of a $d$ -dimensional lattice. Its block-size dependence $\delta(\beta)$ comes from the Chen 2013 closed form and drives core-SVP cost estimates. Introduced in Chapter 13.
Round-by-round soundness. A soundness notion for a multi-round interactive proof that bounds each round separately. For a false statement the protocol starts in a doomed state, a doomed final transcript is rejected, and whatever the prover sends, each verifier challenge takes a doomed state to one that is not only with small probability. Chiesa, Manohar and Spooner lift it through the BCS transformation into the QROM. Named in Chapter 31, which relies on this definition.
RS256. The JOSE algorithm identifier for an RSA signature with SHA-256 (RSASSA-PKCS1-v1_5). See JWT.

S

Schnorr signature. The three-move sigma protocol for discrete log plus Fiat-Shamir. Shor breaks it. The template for every sigma-protocol-based signature in Part VI. Named in Chapter 1. Its sigma-protocol form, Schnorr identification, opens Chapter 31, and Chapter 33 builds it again and makes it non-interactive.
SBOM (Software Bill of Materials). The more general cousin of CBOM. An inventory of every software component. Referenced in Chapter 25.
secp256k1. The specific elliptic curve $y^2 = x^3 + 7$ over $\mathbb{F}_p$ with $p = 2^{256} - 2^{32} - 977$ . The curve Bitcoin uses. Broken by Shor. Referenced in Chapter 4.
Sigma protocol. A three-move (commitment, challenge, response) public-coin interactive proof. The template Fiat-Shamir compiles to signatures. Named in Chapter 23’s SQIsign walkthrough. Chapter 31 opens on Schnorr identification, the canonical example, and Chapter 33 introduces the term by that example.
SHA-3. The FIPS 202 hash family, built on the Keccak sponge construction. Used in ML-KEM (SHA3-256, SHA3-512 and SHAKE) and, through its SHAKE functions alone, in ML-DSA and the SHAKE parameter sets of SLH-DSA. Referenced in Chapters 1, 5 and 11, and through its SHAKE functions in Chapters 12 and 17.
SHAKE. The extendable-output functions SHAKE128 and SHAKE256, specified beside SHA-3 in FIPS 202 on the same Keccak sponge. Used as an XOF inside ML-KEM and ML-DSA, and in SLH-DSA’s SHAKE parameter sets. Introduced in Chapter 11, named earlier in Chapter 5.
SHARP (SHARed Prover). StarkWare’s proof aggregator: it verifies each proof it receives off-chain with a verifier program written in Cairo, aggregates those verifications recursively, and sends the last proof to the Solidity verifier on Ethereum. Named in Chapter 33, described in Chapter 34.
Shor’s algorithm. The 1994 quantum algorithm factoring integers and computing discrete logarithms in polynomial time. Introduced in Chapter 1.
SIDH (Supersingular Isogeny Diffie-Hellman). The isogeny-based key exchange broken in 2022 by the Castryck-Decru attack. Referenced in Chapter 3 and Chapter 22.
Simulator. In a zero-knowledge proof, an algorithm that produces transcripts without the witness, distributed as the real ones, and whose existence is what zero knowledge means. Schnorr’s simulator picks the challenge and the response first and solves the verification equation for the commitment. Named in Chapter 23, defined in Chapter 31.
SIS (Short Integer Solution). The lattice hardness assumption dual to LWE, used in lattice signatures. Its module version Module-SIS is what a forking-lemma reduction extracts from any solver for SelfTargetMSIS, which is why SelfTargetMSIS is at least as hard as Module-SIS in the random-oracle model (Chapter 12). ML-DSA’s unforgeability rests on SelfTargetMSIS together with Module-LWE. Introduced in Chapter 12, referenced in Chapter 13.
Slashing. The penalty a proof-of-stake protocol imposes on a validator caught signing conflicting messages, such as two different blocks for one slot or contradictory attestations. It destroys part of the validator’s stake and removes it from the validator set. Named in Chapter 36, which relies on this definition.
SLH-DSA (Stateless Hash-Based Digital Signature Algorithm). The stateless hash-based signature scheme standardized in FIPS 205. The standardized form of SPHINCS+. Introduced in Chapter 1, built in Chapter 17.
SLIP (SatoshiLabs Improvement Proposal). The registry of wallet and derivation conventions maintained by SatoshiLabs alongside the BIPs. Referenced in Chapter 38.
SNARK (Succinct Non-Interactive Argument of Knowledge). A proof system with short proofs and fast verification. Most SNARKs in deployment use pairings (Shor-broken); hash-based STARKs have no known quantum break, subject to hash width and to the Fiat-Shamir analysis in the quantum random-oracle model (Chapter 33). Introduced in Chapter 31.
SNOVA. A multivariate signature scheme submitted to NIST’s additional signatures process. Introduced in Chapter 24.
Soft fork. A consensus-rule change that only tightens the rules, so that every block valid under the new rules is valid under the old ones, and a node that has not upgraded keeps following the chain without checking the new rules. See Hard fork. Named in Chapter 17, which relies on this definition. Chapter 41 traces a soft-fork proposal through the BIP process.
Special soundness. The property of a three-move protocol that any two accepting transcripts with the same commitment and different challenges yield the witness. It gives knowledge soundness with knowledge error $1/|C|$ for a challenge set $C$ , since a prover that cannot compute the witness can answer at most one challenge per commitment. Introduced in Chapter 31, restated in Chapter 33.
SPHINCS+. The construction name for the stateless hash-based signature scheme standardized as SLH-DSA in FIPS 205. See SLH-DSA, covered in Chapter 17 under the standardized name.
SQIsign. The isogeny-based signature scheme surviving the Castryck-Decru attack. Submitted to NIST’s additional signatures round. Introduced in Chapter 1, built in Chapter 23.
SSZ (SimpleSerialize). The serialization format of Ethereum’s consensus-layer data structures, the BeaconBlock and Attestation containers among them. Introduced in Chapter 39.
STARK (Scalable Transparent Argument of Knowledge). A proof system with polylogarithmic verifier time, no trusted setup, and hash-based soundness. Built on FRI. Its post-quantum standing is conditional on hash output width and on QROM accounting of its Fiat-Shamir step at deployment parameters. For the production FRI pipelines Chapter 34 Section 5.6 lists, that section records no published end-to-end QROM accounting, and records separately the open rate question and the gaps that larger folds and circle STARKs leave. Introduced in Chapter 31, built in Chapter 34, applied in Chapter 35.
SVP (Shortest Vector Problem). Given a lattice, find the nonzero vector of minimal Euclidean norm. The canonical lattice hardness problem. Introduced in Chapter 3.
Syndrome. The product $s = H r^T$ of the parity-check matrix $H$ and a received word $r$ (under the column convention used in Chapter 19 and Appendix B). It depends only on the error pattern: zero exactly when the error is itself a codeword (the zero error included), a case no code can detect, and nonzero otherwise. Introduced in Chapter 3, developed in Chapter 19.
Syndrome decoding. The problem of recovering a low-weight error from its syndrome. NP-hard in the worst case. It is the task HQC and Classic McEliece both rely on, distinct from each scheme’s own assumption. Classic McEliece states one-wayness of decoding for the codes it publishes (Chapter 20), and HQC’s IND-CPA security rests on two decisional quasi-cyclic syndrome decoding assumptions (Chapter 21). Introduced in Chapter 3, developed in Chapter 19.
Systematic form. A generator matrix of the form $[I_k \mid A]$ , or a parity-check matrix of the form $[B \mid I_{n-k}]$ , so that the message appears unchanged in the codeword’s first $k$ positions. Chapter 19’s $[7, 4, 3]$ Hamming code is written $G = [I_4 \mid A^T]$ and $H = [A \mid I_3]$ . Introduced in Chapter 19.

T

Target-collision resistance. A multi-target property of a tweakable hash function: the adversary fixes its targets, an input under each tweak, before it learns the public seed, and must then find a different input with the same output as one of them under that target’s tweak. It asks for a second preimage of a target fixed in advance, not a free collision. Introduced in Chapter 18.
Threshold signature. A signature scheme in which any $t$ of $n$ parties holding shares of one jointly generated key can sign together, producing one signature that verifies under the joint public key. A $t$ -of- $n$ multisig instead registers $n$ keys and checks $t$ signatures. Introduced in Chapter 35, applied to governance in Chapter 36, developed in Chapter 39.
TLS (Transport Layer Security). The protocol securing HTTPS. It was the first widely deployed transport for the post-quantum hybrid key exchange X25519MLKEM768. See that entry for the wire format. Introduced in Chapter 1, developed in Chapter 28.
Torsion subgroup. For an integer $n$ , the points $P$ of an elliptic curve $E$ with $nP$ equal to the identity, written $E[n]$ . For a prime $\ell$ other than the field’s characteristic, $E[\ell] \cong (\mathbb{Z}/\ell\mathbb{Z})^2$ over the algebraic closure. SIDH published the images of torsion points under its secret isogeny, the leakage the Castryck-Decru attack exploits. Named from Chapter 1 on, shown by example in Chapter 22, where a point $T$ with $2T = \mathcal{O}$ is a 2-torsion point and the $\ell + 1$ cyclic subgroups of order $\ell$ in $E[\ell]$ give the isogeny graph’s edges.
TTL (Time To Live). The lifetime after which a cached or issued artifact expires. In Chapter 29’s JWKS rotation it is the token lifetime that decides when a retired key can leave the key set. Introduced in Chapter 29.
Tweakable hash. A hash variant taking an additional tweak input, used in SLH-DSA to mitigate multi-target attacks. Named from Chapter 14 on, defined and built in Chapter 17.

U

Undetectability. A property asked of a hash function family in hash-based signature proofs: an adversary cannot tell its outputs on hidden random inputs from uniformly random strings. Chapter 15 names it among the properties Hülsing’s WOTS+ proof asks of a keyed function family, and Chapter 18 states it as a multi-target game over tweaks. Named in Chapter 15, defined in Chapter 18.
UOV (Unbalanced Oil and Vinegar). A multivariate signature construction from 1999. The basis for MAYO and SNOVA. Introduced in Chapter 24.
uSVP (Unique Shortest Vector Problem). A promise version of SVP where the shortest vector is much shorter than every lattice vector linearly independent of it. The problem LWE reduces to via the BDD-to-uSVP embedding. Introduced in Chapter 13.
UTXO (Unspent Transaction Output). Bitcoin’s transaction model where each unit of value is an immutable output, and ownership transitions via a signature on a spending transaction. Introduced in Chapter 36.

V

Velu’s formulas. Velu’s 1971 explicit rational formulas for the isogeny $E \to E/H$ with a given finite kernel $H$ . Their evaluation form computes the image of a point by summing a correction term for each kernel element. Introduced in Chapter 22.
VEX (Vulnerability Exploitability eXchange). The CycloneDX companion format that records whether a known vulnerability is actually exploitable in a given product. A CBOM inventories primitives; VEX is the separate artifact that carries exploitability. Introduced in Chapter 25.

W

Wallet. The software or hardware that holds private keys and produces transaction signatures. Introduced in Chapter 38.
Watch-only wallet. A wallet that holds an extended public key and no private key. It can compute the addresses that non-hardened BIP-32 derivation reaches below that key and follow their payments, and it cannot spend them. Introduced in Chapter 38.
WOTS+ (Winternitz One-Time Signature Plus). The hash-chain one-time signature with improved multi-target security. Used inside XMSS and SLH-DSA. Introduced in Chapter 14, built in Chapter 15.

X

X25519. The Diffie-Hellman key exchange on Curve25519. Broken by Shor. Used as the classical half of X25519MLKEM768. Referenced in Chapters 1, 25, 27, 28, and 30.
X25519MLKEM768. The deployed hybrid KEM combining X25519 and ML-KEM-768. Introduced in Chapter 27.
X.509. The certificate format underlying most PKIs. Introduced in Chapter 29.
XMSS (eXtended Merkle Signature Scheme). The stateful hash-based signature scheme specified in RFC 8391 and approved by NIST in SP 800-208. Introduced in Chapter 6, built in Chapter 15.
XOF (Extendable-Output Function). A hash-function variant producing arbitrary-length output. SHAKE128 and SHAKE256 are the standard XOFs. Used inside ML-KEM, ML-DSA and SLH-DSA. Introduced in Chapter 11.

Z

Zcash. The privacy-focused cryptocurrency whose shielded pools run two proof systems: Sapling verifies pairing-based Groth16 proofs over BLS12-381, and Orchard verifies Halo 2 proofs whose inner-product argument rests on discrete log over Pallas and Vesta, with no pairing. Since the NU6.3 upgrade of 28 July 2026, new Orchard-protocol value goes to the Ironwood pool, which uses the same Halo 2 proofs, and the Orchard pool can only be spent from. Both proof systems fall to Shor. A Chapter 35 case study of a system that will need PQ reproofing. Introduced in Chapter 31.
ZK (Zero-Knowledge). A proof system where the verifier learns nothing beyond the truth of the statement. Part VI is the book’s treatment of post-quantum ZK. Introduced in Chapter 31.
ZKsync. The Ethereum Layer-2 rollup whose STARK-style proofs are compressed by a pairing-based outer wrapper before its L1 verifier reads them. Introduced in Chapter 30, developed in Chapter 35.