Appendix B: Notation reference

A symbol in this book is always defined the first time it appears in a chapter. This appendix lists every reservation, organized by the part that introduces it, and flags the letters whose meaning shifts across parts.

When a symbol carries a subscript (like $r_\mathrm{FRI}$ versus $r_\mathrm{FS}$), the bare letter is reserved only in the chapter that introduces the decoration, and the decorations are never elided.

Scope collisions

The book reuses a handful of letters across parts. Each occurrence is defined locally, but a reader moving between parts should confirm the context before interpreting the letter.

Symbol	Part I	Part II	Part III	Part IV	Part VI
$n$	Modulus in modular arithmetic	Lattice dimension / polynomial degree	Hash output length	Code length	Not used bare
$q$	RSA large prime (Ch 4)	ML-KEM ring modulus 3329	Not used	Field order (codes)	Quantum query budget
$r$	Shor’s period (Ch 4); ECDSA nonce half (Ch 6)	Not used bare	Not used bare	Received word (Ch 19)	Never bare; $r_\mathrm{FRI}$, $r_\mathrm{FS}$, $r_\mathrm{out}$
$s$	ECDSA signature half (Ch 6)	LWE secret vector	One-time secret-key slot	Syndrome (Ch 19)	Not used
$e$	RSA public exponent (Ch 4)	LWE error vector	Not used	Error pattern in a received word	Not used
$d$	RSA private exponent / ECDSA private key	Not used	Digest, MSS depth (Ch 13); WOTS+ digit (Ch 14); hypertree layers (Ch 16)	Minimum distance of a code	Not used
$k$	Not used bare	Module rank (Ch 9)	FORS trees per signature (Ch 15)	Code dimension	Target PQ soundness in bits (Ch 33)
$t$	Not used bare	Not used bare	FORS leaves per tree (Ch 15)	Error-correcting capability (Ch 19)	Not used bare
$g$	Generator of a cyclic group (Ch 2)	Not used	Not used	Not used	Grinding-bit count on the Fiat-Shamir transcript
$B$	Not used	Lattice basis matrix (Ch 7); also the scalar noise bound $	e^\top r	\leq mB$ in Regev-style LWE correctness arguments (Ch 8, Ch 10)	Not used
$H$	Hash in an abstract game (Ch 5)	Not used	Cryptographic hash function (Ch 13)	Parity-check matrix (Ch 18)	Not used
$T$	Not used	Not used	Merkle authentication path (Ch 13)	Not used	Trace domain (Ch 33)
$\beta$	Not used	BKZ block size (Ch 12)	Not used	Not used	FRI fold challenge
$\delta_0$	Not used	Not used	Not used	Not used	Proximity-gap threshold in Hamming distance (Ch 33)
$\zeta$	Not used	Primitive 256th root of unity, $\zeta = 17$ in $\mathbb{Z}_{3329}$ (Ch 11, FIPS 203). Not used in Ch 12; the LWE secret-error standard deviation in Ch 12’s primal and dual sections is $\sigma$, matching the Kyber Round 3 submission.	Not used	Not used	Not used

Chapter 13 reuses $d$ internally for two quantities: the message digest in Section 1 and the MSS tree depth from the many-time signature section onward. Part III reuses $d$ in two more chapters. Ch 14 uses $d$ for the WOTS+ digit value, the base-$w$ encoding of the message digest. Ch 16 uses $d$ for the SLH-DSA hypertree layer count per FIPS 205 (for example, $d = 7$ for SLH-DSA-SHA2-192s). The Part III reservation table splits these uses across rows. Ch 14 reserves $h$ for XMSS tree height per RFC 8391.

Part I: Foundations

Introduced in Chapters 1 through 6. These symbols propagate into every later part.

Symbol	Meaning	First used
$n$	Modulus for modular arithmetic (also overloaded in later parts)	Chapter 2
$\mathbb{Z}/n\mathbb{Z}$	Ring of integers modulo $n$	Chapter 2
$\mathbb{F}_p$	Finite field with $p$ elements, $p$ prime	Chapter 2
$\mathbb{F}_p^*$	Multiplicative group of $\mathbb{F}_p$	Chapter 2
$g$	Generator of a cyclic group	Chapter 2
$\varphi(n)$	Euler totient function	Chapter 2
$\mathbb{F}_p[x]$	Polynomial ring over $\mathbb{F}_p$	Chapter 2
$\mathbb{F}_p[x]/(f(x))$	Quotient ring by the ideal $(f(x))$	Chapter 2
$(p, q, n, e, d)$	RSA key-parameter tuple: distinct primes $p, q$; modulus $n = pq$; public exponent $e$; private exponent $d$	Chapter 4
$r$	Multiplicative order of a base mod $n$; Shor’s period in the toy factoring walk	Chapter 4
$\lambda$	Security parameter, in bits	Chapter 5 (formally introduced at the first $\{0, 1\}^\lambda$ use in key agreement); also appears as the chord slope in Chapter 4’s EC group law
$\Pr[E]$	Probability of event $E$	Chapter 5
$\mathsf{negl}(\lambda)$	Negligible function in $\lambda$	Chapter 6
$(d, k, r, s, N)$	ECDSA signature tuple: private key $d$; nonce $k$; signature pair $(r, s)$; curve group order $N$	Chapter 6

Part II: Lattice-based cryptography

Introduced in Chapters 7 through 12. Centered on LWE, Module-LWE, and ML-KEM. Letters marked with $\dagger$ collide with a later-part letter; the collision table at the top gives the resolution.

Symbol	Meaning	First used
$L(B)$	Lattice generated by basis $B$	Chapter 7
$B$	Basis matrix, columns are basis vectors (distinct from the scalar noise bound $B$ used in Ch 8 and Ch 10 LWE correctness arguments; the collision table at the top of this appendix records the split)	Chapter 7
$b_i$	The $i$-th basis vector	Chapter 7
$U$	Unimodular change-of-basis matrix	Chapter 7
$\mathrm{GL}_n(\mathbb{Z})$	Group of $n \times n$ unimodular integer matrices	Chapter 7
$\det(L)$	Determinant of a lattice	Chapter 7
$\mathcal{P}(B)$	Fundamental parallelepiped of basis $B$	Chapter 7
$L^*$	Dual lattice of $L$	Chapter 7
$B^{-T}$	Dual basis, $(B^{-1})^T$	Chapter 7
$\lambda_i(L)$	The $i$-th successive minimum of $L$	Chapter 7
$s$ $\dagger$	LWE secret vector	Chapter 8
$e$ $\dagger$	LWE error vector	Chapter 8
$\chi$	Error distribution, usually centered binomial	Chapter 8
$q$ $\dagger$	Ring modulus in the lattice construction; 3329 for ML-KEM	Chapter 8
$A$	Public-key sample matrix in $(A, As + e)$	Chapter 8
$a$	A row of $A$; LWE public vector	Chapter 8
$\zeta_{2n}$	Primitive $2n$th root of unity, cyclotomic framing of Ring-LWE	Chapter 9
$R_q$	Polynomial ring $\mathbb{Z}_q[x]/(x^n+1)$	Chapter 9
$k$ $\dagger$	Module rank, Module-LWE and ML-KEM	Chapter 9
$\eta_1, \eta_2$	Centered binomial noise widths in ML-KEM ($\eta_1 = \eta_2 = 2$ for ML-KEM-768)	Chapter 11
$\zeta$	ML-KEM’s primitive 256th root of unity in $\mathbb{Z}_{3329}$; $\zeta = 17$	Chapter 11
$d_u, d_v$	Ciphertext compression widths in ML-KEM ($d_u = 10, d_v = 4$ for ML-KEM-768)	Chapter 11
$\beta$ $\dagger$	BKZ block size	Chapter 12
$\delta(\beta)$	Root-Hermite factor at block size $\beta$	Chapter 12

Part III: Hash-based signatures

Introduced in Chapters 13 through 17. Centered on Lamport, Merkle trees, WOTS+, FORS, and SLH-DSA. In this part, $n$ means hash output length, not lattice dimension. The unit splits across the part: Chapter 13 works $n$ in bits (matching the Lamport digest length); Chapters 14 through 17 work $n$ in bytes (matching the FIPS 205 and SPHINCS+ convention). Every code block in Chapter 17 introduces the explicit n_bytes / n_bits = 8 * n_bytes pair so the switch is local and visible.

Symbol	Meaning	First used
$H$ $\dagger$	Cryptographic hash function (SHA-256, SHAKE)	Chapter 13
$n$ $\dagger$	Hash output length: in bits in Chapter 13, in bytes in Chapters 14 through 17	Chapter 13
$s_0^{(i)}, s_1^{(i)}$	Lamport secret-key slots at bit position $i$	Chapter 13
$p_0^{(i)}, p_1^{(i)}$	Lamport public-key slots at bit position $i$	Chapter 13
$d$ $\dagger$	Message digest (Section 1) and MSS tree depth (many-time signature section)	Chapter 13
$T$ $\dagger$	Merkle authentication path	Chapter 13
$h$	Merkle tree height; XMSS tree height (RFC 8391 convention)	Chapter 14
$d$ $\dagger$	WOTS+ digit value, base-$w$ encoding of the message digest	Chapter 14
$w$	WOTS+ base (Winternitz parameter), usually 16	Chapter 14
$\ell_1, \ell_2$	WOTS+ chain counts: message and checksum	Chapter 14
$k$ $\dagger$	FORS trees per signature	Chapter 15
$t$ $\dagger$	FORS leaves per tree	Chapter 15
$\mathrm{ADRS}$	SLH-DSA address structure: 32 bytes in the general form (FIPS 205 Section 4.2), compressed to 22 bytes for the SHA2 parameter sets (Section 11.2)	Chapter 16
$\mathsf{PRF}_k$	Keyed pseudorandom function with key $k$	Chapter 16
$d$ $\dagger$	Number of hypertree layers in SLH-DSA (FIPS 205); $d = 7$ for SLH-DSA-SHA2-192s, $d = 22$ for SLH-DSA-SHA2-256f	Chapter 16

Part IV: Code-based and isogeny-based cryptography

Introduced in Chapters 18 through 23. Code-based notation in Chapters 18 through 20; isogeny notation in Chapters 21 and 22. Part IV works over $\mathrm{GF}(2)$ throughout; the length-dimension-distance triple is written unsubscripted.

Symbol	Meaning	First used
$\mathbb{F}_{2^m}$	Binary extension field, $m$ the extension degree	Chapter 18
$[n, k, d]$	Linear code parameters: length $n$, dimension $k$, minimum distance $d$, over $\mathrm{GF}(2)$	Chapter 18
$C$	Linear code, subspace of $\mathrm{GF}(2)^n$	Chapter 18
$G$	Generator matrix ($k \times n$) of a linear code	Chapter 18
$H$ $\dagger$	Parity-check matrix ($(n-k) \times n$); distinct from Part III’s hash function	Chapter 18
$r$ $\dagger$	Received word $r = c + e$, where $c$ is the transmitted codeword	Chapter 18
$s$ $\dagger$	Syndrome, $s = H \cdot r^T$ (column convention used throughout Part IV)	Chapter 18
$t$ $\dagger$	Error-correcting capability of a code, $t = \lfloor (d-1)/2 \rfloor$	Chapter 18
$E_0, E_1, \ldots$	Supersingular elliptic curves in an isogeny path	Chapter 21
$\varphi$	Isogeny map between elliptic curves	Chapter 21
$j(E)$	$j$-invariant of an elliptic curve	Chapter 21
$\ell$-isogeny	Isogeny of prime degree $\ell$	Chapter 21
$\mathcal{O}$	Order in a quaternion algebra (SQIsign)	Chapter 22

Part V: Migration and deployment

Part V does not introduce new mathematical notation; it reuses Part II and Part III symbols when referencing the constructions those parts built.

Part VI: Post-quantum zero-knowledge

Introduced in Chapters 30 through 34. Chapter 33 Section 3 (“AIR, LDE, and the Reed-Solomon lift”) and Chapter 34 Table 34.1 each publish explicit reservation tables; the Part VI entries below match those tables verbatim. Part VI reuses several Part II and Part III letters with new meanings (notably $q$, $T$, $g$, $\beta$); the table below flags those collisions with $\dagger$ and the top-of-appendix collision table gives the full resolution.

Symbol	Meaning	First used
$p$	STARK field prime	Chapter 33
$L$	Trace length	Chapter 33
$N$	LDE domain size, usually $N = L / \rho$	Chapter 33
$\rho$	Code rate, $\rho = L / N$	Chapter 33
$r_\mathrm{FRI}$	Number of FRI folding rounds	Chapter 33
$r_\mathrm{FS}$	Number of Fiat-Shamir rounds on the transcript	Chapter 33
$\mu$	FRI query openings per round	Chapter 33
$g$ $\dagger$	Grinding-bit count on the Fiat-Shamir transcript	Chapter 33
$q$ $\dagger$	Adversary’s quantum query budget	Chapter 33
$k$ $\dagger$	Target post-quantum soundness, in bits	Chapter 33
$\delta_0$ $\dagger$	Proximity-gap threshold in Hamming distance	Chapter 33
$\mathbb{D}$	LDE evaluation domain	Chapter 33
$T$ $\dagger$	Trace domain, a subgroup of the LDE domain	Chapter 33
$c$	Reed-Solomon codeword, $c = \mathrm{LDE}(t)$	Chapter 33
$t(x)$	Trace polynomial of degree $< L$	Chapter 33
$(L_2, L_4)$	Grid cell label in the four-layer decomposition	Chapter 34
$k_\mathrm{sys}$	Target PQ bit margin at the system level	Chapter 34
$q_\mathrm{sys}$	Adversary’s quantum query budget at the system threat model	Chapter 34
$r_\mathrm{out}$	Fiat-Shamir rounds on an outer wrapper proof	Chapter 34
$n_\mathrm{hash}$	Hash-output bit width in a Part VI protocol	Chapter 34

Meta conventions

A few notation conventions hold throughout the book and are not individually reserved in any chapter:

• In Parts II and VI, bold lowercase letters ($\mathbf{s}, \mathbf{e}, \mathbf{a}$) denote vectors and bold uppercase ($\mathbf{A}, \mathbf{B}$) denote matrices. Part IV follows the coding-theory convention and uses non-bold uppercase for matrices ($G$, $H$, $A$); the dimension is always stated at first use.
• Set-builder notation uses $\{ x \in X : P(x) \}$, never the shorthand with a mid-line bar.
• $\log$ without a base is base 2, matching the cryptographic convention. Natural log is written $\ln$.
• Security levels are stated in bits of classical work or, for the quantum model, in quantum gates under a specified cost model (with MAXDEPTH bound).
• Cryptographic hash output is written in lowercase hex throughout.