Appendix D: Solutions
This appendix collects a worked solution for every compute and derivation exercise, and an editorial note on what a strong answer addresses for every open-ended one. One page per chapter, ordered by chapter number.
Two kinds of entries appear:
- Solutions for compute and derivation exercises (run the toy code, do the arithmetic, walk the proof). The entry shows the worked answer with code, math, and any derivation steps.
- Editorial notes for open-ended exercises (defend a position, design a system, write a paragraph of analysis with no single canonical answer). The entry frames what a strong response addresses (sources to cite, distinctions to make, traps to avoid) without imposing one right answer.
The routines worked here also ship as code. Each chapter has a reference package under solutions/ in the companion repository, the same package with its taught functions stubbed under exercises/, and a pytest suite under tests/ that proves either tree. Appendix C: Environment setup walks the clone, the environment, and how to run them.
Every chapter that has an Exercises section has a corresponding page here. Notation follows Appendix B: Notation. Terms used in solutions but not redefined here have their definitions in Appendix A: Glossary.
Part I: Foundations
Section titled “Part I: Foundations”- Chapter 1: The quantum threat
- Chapter 2: Mathematical preliminaries
- Chapter 3: Hard problems at a glance
- Chapter 4: From classical to post-quantum
- Chapter 5: KEMs vs key agreement vs public-key encryption
- Chapter 6: Digital signatures reconsidered
Part II: Lattice-based cryptography
Section titled “Part II: Lattice-based cryptography”- Chapter 7: Lattices for programmers
- Chapter 8: The LWE problem
- Chapter 9: Ring-LWE and Module-LWE
- Chapter 10: Regev encryption from scratch
- Chapter 11: ML-KEM (FIPS 203) from scratch
- Chapter 12: ML-DSA (FIPS 204) from scratch
- Chapter 13: Lattice cryptanalysis
Part III: Hash-based signatures
Section titled “Part III: Hash-based signatures”- Chapter 14: One-time signatures from hash functions
- Chapter 15: Many-time signatures
- Chapter 16: FORS and the stateless hypertree
- Chapter 17: SLH-DSA (FIPS 205) from scratch
- Chapter 18: Hash-based signature cryptanalysis
Part IV: Code-based and isogeny-based cryptography
Section titled “Part IV: Code-based and isogeny-based cryptography”- Chapter 19: Coding theory for cryptographers
- Chapter 20: McEliece: the original PQC
- Chapter 21: HQC, a pedagogical implementation
- Chapter 22: Isogenies for programmers
- Chapter 23: SQIsign in a toy setting
- Chapter 24: Multivariate signature schemes
Part V: Migration and deployment
Section titled “Part V: Migration and deployment”- Chapter 25: Inventory first: CBOM
- Chapter 26: Crypto agility
- Chapter 27: Hybrid schemes in practice
- Chapter 28: TLS 1.3 migration
- Chapter 29: PKI and code signing
- Chapter 30: Running a PQ migration program
Part VI: Post-quantum zero-knowledge
Section titled “Part VI: Post-quantum zero-knowledge”- Chapter 31: The four-layer decomposition
- Chapter 32: PQ-secure commitment schemes
- Chapter 33: Fiat-Shamir in the QROM
- Chapter 34: STARKs and FRI revisited
- Chapter 35: Case studies: Zcash, ZKsync, Starknet
Part VII: Post-quantum blockchain
Section titled “Part VII: Post-quantum blockchain”- Chapter 36: Quantum threat model for blockchains
- Chapter 37: Layer-1 signature migration: Bitcoin and Ethereum
- Chapter 38: Wallets, addresses, and key rotation
- Chapter 39: Consensus and staking signatures
- Chapter 40: Quantum threats to ZK rollups
- Chapter 41: Governance, hard forks, and migration case studies