Prerequisites
This page is a checklist. If you can read it and think “yes, I have all of that,” go to Chapter 1. If something feels shaky, the brush-up section below lists resources for each gap.
The short version: comfort with high-school algebra and modular arithmetic, basic linear algebra, basic discrete probability, algorithmic thinking, Python 3, and enough exposure to deployed cryptography to recognize TLS, Diffie-Hellman, AES, and certificates by name. No quantum computing background is required; the book treats the relevant complexity results for Shor’s and Grover’s algorithms as established, not as material to derive.
What you should already be comfortable with
Section titled “What you should already be comfortable with”Concrete signals follow. Each item gives one or two example skills you can self-check against.
Modular arithmetic. You can compute and get 3. Reducing the exponent modulo 12 first, to , is Fermat’s little theorem; Chapter 2 restates it, so knowing the theorem by name in advance is not required. You recognize as the integers mod with the usual addition and multiplication.
Linear algebra. You can multiply two matrices on paper. You know what the rank of a matrix is. You know what it means for a set of vectors to be linearly independent. Chapter 2 reviews enough linear algebra to get to Part II; you should not be encountering vectors and matrices for the first time.
Discrete probability. You know what a uniform distribution is. You can compute the expectation of a discrete random variable. You recognize “negligible probability” as a function that vanishes faster than any inverse polynomial in a security parameter.
Classical algorithms. You can read pseudocode. You can reason about Big-O complexity. You know what RSA does at the level of the public-key interface: a scheme whose security depends on the hardness of factoring the modulus, since recovering the factors recovers the private key. You do not need to have implemented it; you do need to understand the shape of the problem.
Diffie-Hellman key agreement. You know that two parties can each publish a public share, keep a private value secret, and derive the same shared secret that a passive eavesdropper is assumed unable to compute. You recognize the elliptic-curve form, ECDH, where the private value is a scalar and the public share is a curve point. You recognize X25519 and P-256 as named groups used in that role. Chapter 5 builds a toy Diffie-Hellman over a small prime and Chapter 4 builds the curve arithmetic from scratch, so neither is a prerequisite.
Symmetric primitives. You know that AES is a block cipher keyed with 128, 192, or 256 bits, and that AES-GCM is an authenticated-encryption mode that both encrypts data and detects tampering. You know that a cryptographic hash function maps arbitrary-length input to a fixed-length digest that is hard to invert and for which two inputs with the same digest are hard to find. Chapter 3 restates the hash properties precisely; Chapter 1 needs only the names and what each one provides.
The TLS 1.3 handshake. You can follow the shape of the exchange in its common form, where the server authenticates with a certificate and both sides contribute an ephemeral share. The client and the server each send an ephemeral public share, and the session keys are derived from the shared secret those two shares produce. You recognize ClientHello and ServerHello as the messages that carry the shares. The server then sends a certificate that binds its identity to a signing key, and a CertificateVerify message that signs the handshake transcript with the matching private key. The client checks the certificate chain back to an authority it trusts, then checks that signature. Authentication comes from the two together, and neither carries the session secret. Chapter 1 opens on a recorded handshake of exactly this form.
Python 3. You can read and write Python that uses lists, dictionaries, classes, and the standard library. You can run pytest and set up a virtual environment. The exact environment the book targets is documented in Appendix C: Environment setup.
What you do not need to know already
Section titled “What you do not need to know already”Topics the book builds from the ground up. If any of these scare you, that is fine. The point of the book is to teach them.
- Quantum computing
- Lattice theory
- Coding theory
- Isogenies between elliptic curves
- Number theory beyond basic modular arithmetic
- Group theory at a graduate level
- Zero-knowledge proof systems
- Designing or implementing a blockchain
Part VII assumes basic familiarity with one or two production chains (Bitcoin’s UTXO model, Ethereum’s account model and gas, hard forks as the upgrade path) and builds the cryptographic threat model from first principles. It does not assume you have designed or implemented a chain. Mastering Bitcoin on GitHub at github.com/bitcoinbook/bitcoinbook under CC BY-SA is a free deeper read alongside the book.
If you are not yet there, brush up here
Section titled “If you are not yet there, brush up here”For each gap, this section lists a free learning resource or an authoritative reference that closes it. Books are listed under Supporting material below.
Quantum computing primer (optional). Quantum Country’s “Quantum computing for the very curious” essay by Andy Matuschak and Michael Nielsen, free at quantum.country/qcvc, introduces qubits, quantum gates, and quantum circuits using spaced-repetition prompts. It stops at universal quantum computing; Shor’s algorithm appears only as a named application, with no derivation. Chapter 1 of this book does not require the background; it treats Shor’s polynomial-time claim as a cited result.
Classical algorithms refresher. Jeff Erickson’s Algorithms, free PDF at jeffe.cs.illinois.edu/teaching/algorithms under CC BY 4.0. Read the chapters on asymptotic analysis and recursion. MIT OpenCourseWare 6.006 Introduction to Algorithms at ocw.mit.edu/courses/6-006-introduction-to-algorithms-spring-2020 is a free video alternative.
Number theory and abstract algebra. Victor Shoup, A Computational Introduction to Number Theory and Algebra (Shoup, 2009), free PDF at shoup.net/ntb. Chapters 1 through 5 overlap directly with this book’s Chapter 2, and Shoup is the reference Chapter 2 cites for the deeper statements.
Probability for cryptographers. MIT OpenCourseWare 6.042J Mathematics for Computer Science at ocw.mit.edu/courses/6-042j-mathematics-for-computer-science-spring-2015 covers the discrete-probability vocabulary used in security definitions: uniform distributions, expectation, and conditional probability. Charles Grinstead and J. Laurie Snell, Introduction to Probability, free PDF at math.dartmouth.edu/~prob/prob/prob.pdf, is a longer-form alternative. Negligible functions are briefly characterized in the What you should already be comfortable with self-test above; for the cryptographic asymptotics in detail, see Katz and Lindell §3.1 in Supporting material.
Diffie-Hellman and ECDH. NIST SP 800-56A Rev. 3, Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography, free at csrc.nist.gov/pubs/sp/800/56/a/r3/final, covers the finite-field and elliptic-curve forms in current use. You want its vocabulary, not its parameter tables. The original paper is Diffie and Hellman, “New directions in cryptography” (Diffie & Hellman, 1976). X25519 is specified in RFC 7748 Section 5, “The X25519 and X448 Functions”, at rfc-editor.org/rfc/rfc7748 (Langley et al., 2016); P-256 and the other NIST curves are in NIST SP 800-186 (Chen et al., 2023).
Symmetric primitives. AES is FIPS 197, Advanced Encryption Standard (AES), free at csrc.nist.gov/pubs/fips/197/final. The GCM authenticated mode is NIST SP 800-38D, Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC, free at csrc.nist.gov/pubs/sp/800/38/d/final. SHA-2 is FIPS 180-4 at csrc.nist.gov/pubs/fips/180-4/upd1/final and SHA-3 is FIPS 202 at csrc.nist.gov/pubs/fips/202/final. Read the abstracts; Chapter 3 gives the hash security properties the book actually uses.
TLS 1.3 and certificates. RFC 9846 Section 2, “Protocol Overview”, free at rfc-editor.org/rfc/rfc9846, gives the handshake at the level Chapter 1 assumes (Rescorla, 2026). RFC 9846 was published in July 2026 and obsoletes RFC 8446, which specified TLS 1.3 in 2018; it is a minor update that retains the TLS 1.3 version number and is backward compatible. Read as far as Section 2.1; the resumption and 0-RTT subsections after it are past the prerequisite. Certificates are profiled in RFC 5280, Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile, free at rfc-editor.org/rfc/rfc5280 (Cooper et al., 2008). For the prerequisite level a certificate binds an identity to a public key, and a valid certificate chain connects that binding to a trust anchor the client trusts; Chapter 27 walks the TLS migration and Chapter 28 walks PKI.
Python 3. The official Python tutorial at docs.python.org/3/tutorial covers what the book uses.
Supporting material
Section titled “Supporting material”These textbooks are deeper-dive references. None is required to read this book; the free resources above suffice for the prerequisites.
- Cormen, Leiserson, Rivest, and Stein, Introduction to Algorithms (CLRS). Covers more algorithms than Erickson and goes deeper on network flow, NP-completeness, and randomized algorithms.
- Nielsen and Chuang, Quantum Computation and Quantum Information (Nielsen & Chuang, 2010). Standard graduate-level treatment of quantum information beyond Shor’s algorithm.
- Katz and Lindell, Introduction to Modern Cryptography. A cryptography textbook organized around provable security; chapters 1 through 3 cover the probabilistic vocabulary that underwrites every security definition in this book.
- Jean-Philippe Aumasson, Serious Cryptography: A Practical Introduction to Modern Encryption, 2nd edition (No Starch Press, 2024). The closest single book to this one’s assumed background: AES and block ciphers, hash functions, authenticated encryption, RSA, elliptic curves, and TLS, written for engineers rather than as a proof course. If one of the deployed-cryptography items on the self-test above feels shaky, this is the one book that likely covers it.
- Christof Paar, Jan Pelzl, and Tim Güneysu, Understanding Cryptography: From Established Symmetric and Asymmetric Ciphers to Post-Quantum Algorithms, 2nd edition (Springer, 2024). A course textbook with worked problems; the second edition adds a post-quantum chapter. Paar’s companion lecture videos and slides are free at cryptography-textbook.com, which makes it the best option if you prefer lectures to reading.
A note on Chapter 1
Section titled “A note on Chapter 1”Chapter 1 is a threat-modeling chapter, not a math chapter. It assumes you accept Shor’s algorithm as a cited result and reasons about what that means for RSA, ECDH, and ECDSA. It also draws on the key-agreement, symmetric-primitive, and certificate vocabulary in the self-test above. The math chapter is Chapter 2.
A reader weak on the quantum side has two options: work through the Quantum Country primer listed above first, or treat Shor’s polynomial-time claim as cited and move on. Either is fine. A reader strong on quantum but weak on algebra can read Chapter 1 normally and rebuild the algebra from Chapter 2.
The mismatch between Chapter 1 (assumes classical-algorithms maturity and accepts a quantum result) and Chapter 2 (starts from high-school algebra) is deliberate. Chapter 1 is the threat brief that motivates the rest of the book; Chapter 2 is where the from-scratch construction begins.