Appendix B: Notation reference

A symbol in this book is always defined the first time it appears in a chapter. This appendix lists every reservation, organized by the part that introduces it, and flags the letters whose meaning shifts across parts.

When a symbol carries a subscript (like $r_\mathrm{FRI}$ versus $r_\mathrm{FS}$ ), the bare letter is reserved only in the chapter that introduces the decoration, and the decorations are never elided.

Scope collisions

The book reuses a handful of letters across parts. Each occurrence is defined locally, but a reader moving between parts should confirm the context before interpreting the letter. A cell names the Part’s reserved meaning and the chapters that carry it. “Not reserved” means the Part introduces no book-level reservation for that letter, and never that no chapter uses it: a letter defined inside one construction, such as Chapter 32’s toy parameters or Chapter 33’s Schnorr example, is a legitimate local use and appears below only where a reader could carry the wrong meaning into it.

Symbol	Part I	Part II	Part III	Part IV	Part VI
$n$	Modulus in modular arithmetic	Lattice dimension / polynomial degree	Hash output length	Code length (Ch 19 to Ch 21), reset in Ch 24 to the MQ variable count	Subgroup order in Ch 33’s Schnorr example, trace length in Ch 34 E3
$q$	RSA large prime (Ch 4)	ML-KEM modulus 3329 (Ch 11), ML-DSA modulus 8380417 (Ch 12)	Signatures observed by the adversary (Ch 16, Ch 18)	Field order (codes)	Quantum query budget (Ch 33, Ch 34), and the field order in Ch 32’s scalar toy
$r$	Shor’s period (Ch 4), first half of an ECDSA signature (Ch 4)	Regev encryption randomness (Ch 10), ML-KEM coin seed (Ch 11)	XMSS per-signature randomizer (Ch 15)	Received word (Ch 19)	Schnorr nonce (Ch 33). Decorated as $r_\mathrm{FRI}$ , $r_\mathrm{FS}$ , $r_\mathrm{out}$ from Ch 34 on, never elided
$s$	Second half of an ECDSA signature (Ch 4)	LWE secret vector	One-time secret-key slot	Syndrome (Ch 19)	Not reserved
$e$	RSA public exponent (Ch 4)	LWE error vector	Not reserved	Error pattern in a received word	Schnorr challenge (Ch 33)
$d$	RSA private exponent / ECDSA private key	ML-DSA dropped-bit count 13 (Ch 12), lattice dimension (Ch 13)	Digest, MSS depth (Ch 14); WOTS+ digit (Ch 15); hypertree layers (Ch 17)	Minimum distance of a code	Degree bound in Ch 32’s toy
$k$	ECDSA per-message nonce (Ch 4, Ch 6)	Module rank (Ch 9), ML-DSA matrix rows (Ch 12)	FORS trees per signature (Ch 16)	Code dimension	Target PQ soundness in bits (Ch 34), and the commitment dimension in Ch 32’s scalar toy
$c$	Not reserved	ML-DSA challenge polynomial (Ch 12)	Not reserved	Transmitted codeword (Ch 19)	Reed-Solomon codeword (Ch 34)
$h$	Not reserved	ML-DSA hint vector (Ch 12)	Merkle / XMSS tree height (Ch 15)	HQC quasi-cyclic public element (Ch 19, Ch 21)	Schnorr public relation $h = g^x$ (Ch 33)
$\mu$	Not reserved	ML-DSA message representative (Ch 12)	Not reserved	Not reserved	FRI query paths (Ch 34)
$\rho$	Not reserved	ML-DSA matrix seed (Ch 12)	Not reserved	Not reserved	Code rate (Ch 34)
$t$	Not reserved bare	Not reserved bare	FORS leaves per tree (Ch 16)	Error-correcting capability (Ch 19), MQ target vector (Ch 24)	Not reserved bare
$g$	Generator of a cyclic group (Ch 2)	Not reserved	Not reserved	Not reserved	Grinding-bit count on the Fiat-Shamir transcript (Ch 34), and the Schnorr group generator (Ch 33)
$B$	Lattice basis matrix in Ch 3’s exercise	Lattice basis matrix (Ch 7); also the scalar noise bound $\lvert e^\top r \rvert \leq mB$ in Regev-style LWE correctness arguments (Ch 8, Ch 10)	Not reserved	Not reserved	Not reserved
$H$	Hash in an abstract game (Ch 5)	SHA3-256 in ML-KEM’s function table (Ch 11), ML-DSA’s general hash SHAKE-256 (Ch 12)	Cryptographic hash function (Ch 14)	Parity-check matrix (Ch 19)	Random-oracle hash (Ch 33)
$T$	Not reserved	Not reserved	Merkle authentication path (Ch 14)	Not reserved	Trace domain (Ch 34)
$\beta$	Integer coefficient in Ch 3’s lattice definition	ML-DSA box margin $\tau\eta$ (Ch 12), BKZ block size (Ch 13)	Not reserved	Not reserved	FRI fold challenge
$\delta_0$	Not reserved	Not reserved	Not reserved	Not reserved	Proximity-gap threshold in Hamming distance (Ch 34)
$\zeta$	Not reserved	ML-KEM’s primitive 256th root of unity $\zeta = 17$ in $\mathbb{Z}_{3329}$ (Ch 11, FIPS 203); ML-DSA’s primitive 512th root $\zeta = 1753$ in $\mathbb{Z}_{8380417}$ (Ch 12, FIPS 204). Not used in Ch 13. The LWE secret-error standard deviation in Ch 13’s primal and dual sections is $\sigma$ , matching the Kyber Round 3 submission.	Not reserved	Not reserved	Not reserved

Part II reuses three symbols across its own chapters. $\beta$ is the ML-DSA box margin $\tau\eta$ in Chapter 12 and the BKZ block size in Chapter 13. $\zeta$ is ML-KEM’s primitive 256th root of unity in Chapter 11 and ML-DSA’s primitive 512th root in Chapter 12. The modulus $q$ is 3329 for ML-KEM and 8380417 for ML-DSA. Each is defined at its point of use. The Part II reservation table below splits $\beta$ across two rows.

Chapter 14 reuses $d$ internally for two quantities: the message digest $d = H(m)$ in the Lamport sections and the MSS tree depth from the many-time signature section onward. Part III reuses $d$ in two more chapters. Ch 15 uses $d$ for the WOTS+ digit value, the base- $w$ encoding of the message digest. Ch 17 uses $d$ for the SLH-DSA hypertree layer count per FIPS 205 (for example, $d = 7$ for SLH-DSA-SHA2-192s). The Part III reservation table splits these uses across rows. Ch 15 reserves $h$ for XMSS tree height per RFC 8391.

Part I: Foundations

Introduced in Chapters 1 through 6. These symbols propagate into every later part.

Symbol	Meaning	First used
$n$	Modulus for modular arithmetic (also overloaded in later parts)	Chapter 2
$\mathbb{Z}/n\mathbb{Z}$	Ring of integers modulo $n$	Chapter 2
$\mathbb{F}_p$	Finite field with $p$ elements, $p$ prime	Chapter 2
$\mathbb{F}_p^*$	Multiplicative group of $\mathbb{F}_p$	Chapter 2
$g$	Generator of a cyclic group	Chapter 2
$\varphi(n)$	Euler totient function	Chapter 2
$\mathbb{F}_p[x]$	Polynomial ring over $\mathbb{F}_p$	Chapter 2
$\mathbb{F}_p[x]/(f(x))$	Quotient ring by the ideal $(f(x))$	Chapter 2
$\Phi_m(x)$	$m$ th cyclotomic polynomial; for $n$ a power of two, $\Phi_{2n}(x) = x^n + 1$	Chapter 2
$\deg(f)$	Degree of a polynomial, with $\deg(0) = -\infty$ by convention	Chapter 2
$(p, q, n, e, d)$	RSA key-parameter tuple: distinct primes $p, q$ ; modulus $n = pq$ ; public exponent $e$ ; private exponent $d$	Chapter 4
$r$	Multiplicative order of a base mod $n$ , Shor’s period in the toy factoring walk	Chapter 4
$\lambda$	Security parameter, in bits	Chapter 5 (introduced alongside the key-agreement API, where the chapter separates it from the shared-secret length $\ell_K$ ); also appears as the chord slope in Chapter 4’s EC group law
$\ell_K$	Bit length of a KEM or key-agreement shared secret; matched to $\lambda$ at design time but a separate quantity, since ML-KEM outputs 256 bits at every parameter set	Chapter 5
$\Pr[E]$	Probability of event $E$	Chapter 5
$\mathsf{negl}(\lambda)$	Negligible function in $\lambda$	Chapter 6
$(d, k, r, s, N)$	ECDSA signature tuple: private key $d$ ; nonce $k$ ; signature pair $(r, s)$ ; curve group order $N$	Chapter 4 (built there), reused in Chapter 6’s nonce-reuse recovery
$X, Y, Z$	Mosca’s inequality: $X$ the useful lifetime of the secret in years, $Y$ the time to migrate, $Z$ the time until a CRQC exists. The asset is exposed when $X + Y > Z$	Chapter 1, specialized and reused throughout Part VII

Part II: Lattice-based cryptography

Introduced in Chapters 7 through 13. Centered on LWE, Module-LWE, ML-KEM, and ML-DSA. Letters marked with $\dagger$ collide with a letter reserved in another part or, for $\beta$ , with a second use inside Part II. The collision table at the top gives the resolution.

Symbol	Meaning	First used
$L(B)$	Lattice generated by basis $B$	Chapter 7
$B$	Basis matrix, columns are basis vectors (distinct from the scalar noise bound $B$ used in Ch 8 and Ch 10 LWE correctness arguments, and the collision table at the top of this appendix records the split)	Chapter 7
$b_i$	The $i$ -th basis vector	Chapter 7
$U$	Unimodular change-of-basis matrix	Chapter 7
$\mathrm{GL}_n(\mathbb{Z})$	Group of $n \times n$ unimodular integer matrices	Chapter 7
$\det(L)$	Determinant of a lattice	Chapter 7
$\mathcal{P}(B)$	Fundamental parallelepiped of basis $B$	Chapter 7
$L^*$	Dual lattice of $L$	Chapter 7
$B^{-T}$	Dual basis, $(B^{-1})^T$	Chapter 7
$\lambda_i(L)$	The $i$ -th successive minimum of $L$	Chapter 7
$s$ $\dagger$	LWE secret vector	Chapter 8
$e$ $\dagger$	LWE error vector	Chapter 8
$\chi$	Error distribution, usually centered binomial	Chapter 8
$q$ $\dagger$	Ring modulus in the lattice construction, 3329 for ML-KEM	Chapter 8
$A$	Public-key sample matrix in $(A, As + e)$	Chapter 8
$a$	A row of $A$ , LWE public vector	Chapter 8
$\zeta_{2n}$	Primitive $2n$ th root of unity, cyclotomic framing of Ring-LWE	Chapter 9
$R_q$	Polynomial ring $\mathbb{Z}_q[x]/(x^n+1)$	Chapter 9
$k$ $\dagger$	Module rank, Module-LWE and ML-KEM	Chapter 9
$\eta_1, \eta_2$	Centered binomial noise widths in ML-KEM ( $\eta_1 = \eta_2 = 2$ for ML-KEM-768)	Chapter 11
$\zeta$	ML-KEM’s primitive 256th root of unity in $\mathbb{Z}_{3329}$ , $\zeta = 17$	Chapter 11
$d_u, d_v$	Ciphertext compression widths in ML-KEM ( $d_u = 10, d_v = 4$ for ML-KEM-768)	Chapter 11
$\ell$	ML-DSA column dimension: columns of $\mathbf{A}$ , height of $\mathbf{s}_1, \mathbf{y}, \mathbf{z}$	Chapter 12
$\eta$	ML-DSA secret coefficient bound: $\mathbf{s}_1, \mathbf{s}_2$ have coefficients in $[-\eta, \eta]$	Chapter 12
$\tau$	ML-DSA challenge weight: number of $\pm 1$ coefficients in the challenge $c$	Chapter 12
$\gamma_1$	ML-DSA mask bound: $\mathbf{y}$ has coefficients in $(-\gamma_1, \gamma_1]$	Chapter 12
$\gamma_2$	ML-DSA low-order rounding window used by Decompose	Chapter 12
$\beta$ $\dagger$	ML-DSA box margin $\beta = \tau\eta$ , bounding the challenge-times-secret product $\lVert c\mathbf{s}_1 \rVert_\infty$ and supplying the rejection margin, so an accepted response is bounded by $\gamma_1 - \beta$ rather than by $\beta$ (distinct from the BKZ block size $\beta$ in Chapter 13, and the collision table records the split)	Chapter 12
$\omega$	ML-DSA hint budget: maximum number of set bits in the hint $\mathbf{h}$	Chapter 12
$d$	ML-DSA dropped-bit count in Power2Round ( $d = 13$ )	Chapter 12
$\mathbf{t}, \mathbf{t}_1, \mathbf{t}_0$	ML-DSA public vector $\mathbf{t} = \mathbf{A}\mathbf{s}_1 + \mathbf{s}_2$ and its Power2Round split	Chapter 12
$\mathbf{s}_1, \mathbf{s}_2$	ML-DSA secret and error vectors	Chapter 12
$\mathbf{y}, \mathbf{z}$	ML-DSA signing mask and response $\mathbf{z} = \mathbf{y} + c\mathbf{s}_1$	Chapter 12
$\mathbf{w}, \mathbf{w}_1$	ML-DSA commitment $\mathbf{w} = \mathbf{A}\mathbf{y}$ and its high bits $\mathrm{HighBits}(\mathbf{w})$	Chapter 12
$c$ $\dagger$	ML-DSA challenge polynomial: exactly $\tau$ nonzero $\pm 1$ coefficients	Chapter 12
$\tilde c$	ML-DSA challenge hash $\tilde c = H(\mu \mathbin\Vert \mathrm{w1Encode}(\mathbf{w}_1))$	Chapter 12
$\mathbf{h}$ $\dagger$	ML-DSA hint vector, one bit per coefficient	Chapter 12
$\mu$ $\dagger$	ML-DSA message representative $\mu = H(\mathrm{tr} \mathbin\Vert M')$	Chapter 12
$\rho, \rho', \rho''$ $\dagger$	ML-DSA matrix seed, noise seed, and per-signature mask seed	Chapter 12
$\kappa$	ML-DSA mask counter, advances by $\ell$ on each abort iteration	Chapter 12
$\bmod^{\pm}\alpha$	Centered modular reduction, representative in $(-\alpha/2, \alpha/2]$	Chapter 12
$\lVert\cdot\rVert_\infty$	Infinity norm on centered representatives	Chapter 12
$\beta$ $\dagger$	BKZ block size	Chapter 13
$\delta(\beta)$	Root-Hermite factor at block size $\beta$	Chapter 13

Part III: Hash-based signatures

Introduced in Chapters 14 through 18. Centered on Lamport, Merkle trees, WOTS+, FORS, and SLH-DSA. In this part, $n$ means hash output length, not lattice dimension. The unit splits across the part: Chapter 14 works $n$ in bits (matching the Lamport digest length); Chapters 15 through 18 work $n$ in bytes in the scheme descriptions (matching the FIPS 205 and SPHINCS+ convention), and return to bits in the generic hash-cost discussions, where Chapters 17 and 18 state the unit at the point of use. Chapter 18’s Blocks 1 and 3 introduce the explicit n_bytes / n_bits = 8 * n_bytes pair so the switch is local and visible where both units are in play. Block 4’s quantum-cost table labels its bit variable n_bits directly, and the remaining blocks need neither.

Symbol	Meaning	First used
$H$ $\dagger$	Cryptographic hash function (SHA-256, SHAKE)	Chapter 14
$n$ $\dagger$	Hash output length: in bits in Chapter 14, in bytes in the scheme descriptions of Chapters 15 through 18, in bits in their hash-cost discussions	Chapter 14
$s_0^{(i)}, s_1^{(i)}$	Lamport secret-key slots at bit position $i$	Chapter 14
$p_0^{(i)}, p_1^{(i)}$	Lamport public-key slots at bit position $i$	Chapter 14
$d$ $\dagger$	Message digest $d = H(m)$ (Lamport sections) and MSS tree depth (many-time signature section)	Chapter 14
$T$ $\dagger$	Merkle authentication path	Chapter 14
$h$	Merkle tree height, XMSS tree height (RFC 8391 convention)	Chapter 15
$d$ $\dagger$	WOTS+ digit value, base- $w$ encoding of the message digest	Chapter 15
$w$	WOTS+ base (Winternitz parameter), usually 16	Chapter 15
$\ell_1, \ell_2$	WOTS+ chain counts: message and checksum	Chapter 15
$k$ $\dagger$	FORS trees per signature	Chapter 16
$t$ $\dagger$	FORS leaves per tree	Chapter 16
$\mathrm{ADRS}$	SLH-DSA address structure: 32 bytes in the general form (FIPS 205 Section 4.2), compressed to 22 bytes for the SHA2 parameter sets (Section 11.2)	Chapter 17
$\mathsf{PRF}_k$	Keyed pseudorandom function with key $k$	Chapter 17
$d$ $\dagger$	Number of hypertree layers in SLH-DSA (FIPS 205); $d = 7$ for SLH-DSA-SHA2-192s, $d = 22$ for SLH-DSA-SHA2-128f	Chapter 17

Part IV: Code-based and isogeny-based cryptography

Introduced in Chapters 19 through 24. Code-based notation in Chapters 19 through 21. Isogeny notation in Chapters 22 and 23. The codewords on the wire, the syndromes and the error vectors in Chapters 19 through 21 are binary, over $\mathrm{GF}(2)$ . The Goppa polynomial in Chapter 20 and HQC’s outer Reed-Solomon code in Chapter 21 live over binary extension fields $\mathrm{GF}(2^m)$ , the isogeny chapters work over $\mathbb{F}_p$ and $\mathbb{F}_{p^2}$ , and Chapter 24’s multivariate toy works over the prime field $\mathrm{GF}(7)$ . The length-dimension-distance triple is written unsubscripted.

Symbol	Meaning	First used
$\mathbb{F}_{2^m}$	Binary extension field, $m$ the extension degree; Chapter 20 writes it $\mathrm{GF}(2^m)$	Chapter 20
$[n, k, d]$	Linear code parameters: length $n$ , dimension $k$ , minimum distance $d$ , over $\mathrm{GF}(2)$	Chapter 19
$C$	Linear code, subspace of $\mathrm{GF}(2)^n$	Chapter 19
$G$	Generator matrix ( $k \times n$ ) of a linear code	Chapter 19
$H$ $\dagger$	Parity-check matrix ( $(n-k) \times n$ ), distinct from Part III’s hash function	Chapter 19
$r$ $\dagger$	Received word $r = c + e$ , where $c$ is the transmitted codeword	Chapter 19
$s$ $\dagger$	Syndrome, $s = H \cdot r^T$ (column convention used throughout Part IV)	Chapter 19
$t$ $\dagger$	Error-correcting capability of a code, $t = \lfloor (d-1)/2 \rfloor$	Chapter 19
$\mathbb{F}_p$ , $\mathbb{F}_{p^2}$	Prime field and its quadratic extension, the fields the supersingular curves of Chapters 22 and 23 are defined over	Chapter 22
$E_0, E_1, \ldots$	Supersingular elliptic curves in an isogeny path	Chapter 22
$\varphi$	Isogeny map between elliptic curves	Chapter 22
$j(E)$	$j$ -invariant of an elliptic curve	Chapter 22
$\ell$ -isogeny	Isogeny of prime degree $\ell$	Chapter 22
$\mathcal{O}$	Order in a quaternion algebra (SQIsign)	Chapter 23

Part V: Migration and deployment

Part V does not introduce new mathematical notation; it reuses Part II and Part III symbols when referencing the constructions those parts built.

Part VI: Post-quantum zero-knowledge

Introduced in Chapters 31 through 35. Chapter 34 Section 3 (“AIR, LDE, and the Reed-Solomon lift”) and Chapter 35 Table 35.1 each publish explicit reservation tables. The Part VI entries below summarize those tables. Where a chapter row carries a configuration caveat or a worked count, read the chapter’s own row for it. Part VI reuses several Part II and Part III letters with new meanings (notably $q$ , $T$ , $g$ , $\beta$ ). The table below flags those collisions with $\dagger$ and the top-of-appendix collision table gives the full resolution.

Symbol	Meaning	First used
$p$	STARK field prime	Chapter 34
$L$	Trace length	Chapter 34
$N$	LDE domain size, usually $N = L / \rho$	Chapter 34
$\rho$	Code rate, $\rho = L / N$	Chapter 34
$r_\mathrm{FRI}$	Number of FRI folding rounds	Chapter 34
$r_\mathrm{FS}$	Number of Fiat-Shamir rounds on the transcript	Chapter 34
$\mu$	Number of independent FRI query paths: each picks one LDE position and follows it through every fold layer	Chapter 34
$g$ $\dagger$	Grinding-bit count on the Fiat-Shamir transcript	Chapter 34
$q$ $\dagger$	Adversary’s quantum query budget	Chapter 33
$k$ $\dagger$	Target post-quantum soundness, in bits	Chapter 34
$\delta_0$ $\dagger$	Proximity-gap threshold in Hamming distance	Chapter 34
$\beta_i$ $\dagger$	FRI folding challenge at layer $i$ , drawn from the transcript hash	Chapter 34
$\mathbb{D}$	LDE evaluation domain	Chapter 34
$T$ $\dagger$	Trace domain, a multiplicative subgroup of $\mathbb{F}_p^{\times}$ , disjoint from the LDE evaluation domain, which is a coset of a larger subgroup	Chapter 34
$c$	Reed-Solomon codeword, $c = \mathrm{LDE}(t)$	Chapter 34
$t(x)$	Trace polynomial of degree $< L$	Chapter 34
$(L_2, L_4)$	Grid cell label in the four-layer decomposition, classified in Table 31.2 and drawn as Figure 35.1	Chapter 31, reserved for the case studies in Chapter 35
$k_\mathrm{sys}$	Target PQ bit margin at the system level	Chapter 35
$q_\mathrm{sys}$	Adversary’s quantum query budget at the system threat model	Chapter 35
$r_\mathrm{out}$	Fiat-Shamir rounds on an outer wrapper proof	Chapter 35
$n_\mathrm{hash}$	Hash-output bit width in a Part VI protocol	Chapter 35

Part VII: Post-quantum blockchain

Introduced in Chapters 36 through 41. Part VII does not build new mathematics. What it reserves is deployment notation, plus one specialization of a Part I reservation. Its dominant symbols are the Mosca triple $X$ , $Y$ , $Z$ from Chapter 1, which every chapter in the Part uses. Chapter 36 splits the first of them. For an asset on a public ledger, $X$ has an exposure lifetime, unbounded once a verification key is on-chain, and a value lifetime, which is how long that key still controls anything.

Symbol	Meaning	First used
$X_\mathrm{eff}$	Effective reuse window, substituted for $X$ in the breach check when a key or contract rotates on a fixed interval	Chapter 40
$N$ $\dagger$	Validator-set size in the normalized per-attestation byte budget	Chapter 39
$T$ $\dagger$	Cosigner threshold in a threshold-signature proposal	Chapter 39
$x$	BLS signing scalar, $x \in \mathbb{Z}_q$	Chapter 39
$G_1, G_2$	The two pairing source groups on BLS12-381; public keys in $G_1$ , signatures in $G_2$	Chapter 39
$E_1, E_2$	The curves underlying $G_1$ and $G_2$	Chapter 39
$q$ $\dagger$	Order of the pairing groups	Chapter 39
$K_\mathrm{par}, G$	BIP-32 child-key derivation: parent point and curve generator, with $K_i = K_\mathrm{par} + tG$	Chapter 38
$t$ $\dagger$	BIP-32 tweak scalar in that derivation	Chapter 38
$\xi$	32-byte secret seed passed to ML-DSA.KeyGen_internal in the BIP-32-like seed schedule, distinct from the child chain code the same step produces	Chapter 38

Part VII reuses four letters that earlier Parts reserve, marked $\dagger$ above and resolved here rather than in the top-of-appendix collision table, which is already six columns wide and would overflow the print measure with a seventh. $N$ is the LDE domain size in Part VI (Chapter 34) and the curve group order in Part I’s ECDSA tuple; in Chapter 39 it is the validator count. $T$ is the Merkle authentication path in Part III (Chapter 14) and the trace domain in Part VI (Chapter 34); in Chapter 39 it is a cosigner threshold. $q$ is the lattice modulus in Part II, the field order in Part IV, and the quantum query budget in Part VI; in Chapter 39 it is the pairing-group order. $t$ is the FORS leaf count in Part III and the error-correcting capability in Part IV; in Chapter 38 it is the BIP-32 tweak scalar. Each is defined at its point of use.

Meta conventions

A few notation conventions hold throughout the book and are not individually reserved in any chapter:

In Parts II and VI, bold lowercase letters ( $\mathbf{s}, \mathbf{e}, \mathbf{a}$ ) denote vectors and bold uppercase ( $\mathbf{A}, \mathbf{B}$ ) denote matrices. Part IV follows the coding-theory convention and uses non-bold uppercase for matrices ( $G$ , $H$ , $A$ ). The dimension is always stated at first use.
Set-builder notation uses $\{ x \in X : P(x) \}$ , never the shorthand with a mid-line bar.
$\log$ without a base is base 2, matching the cryptographic convention. Natural log is written $\ln$ .
Attack costs and security levels name their unit at the figure, because the book uses four that are not interchangeable: bits of classical work, idealized oracle queries (Chapter 18’s BHT and Grover figures), proxy operations under a stated model (Chapter 13’s core-SVP exponent), and soundness-error bits at a stated adversary budget (Part VI).
Gate, depth and memory counts under an explicit circuit model appear where a figure is compared against NIST’s security categories, and the MAXDEPTH bound belongs to that comparison model rather than to every quantum figure in the book.
Cryptographic hash output is written in lowercase hex throughout.