Prerequisites

This page is a checklist. If you can read it and think “yes, I have all of that,” go to Chapter 1. If something feels shaky, the brush-up section below lists a resource for each gap.

The short version, by when you need it. Chapter 1 needs algorithmic thinking and enough exposure to deployed cryptography to follow a TLS handshake, say what Diffie-Hellman and AES each provide, and say what a certificate binds. From Chapter 2 on you also need high-school algebra and modular arithmetic, basic linear algebra, and basic discrete probability. The exercises need Python 3. No quantum-computing background is required to begin. The book treats the relevant complexity results for Shor’s and Grover’s algorithms as established, not as material to derive.

What you should already be comfortable with

Each item below names a skill and then asks one question you can answer to check it. The answer is folded away, so try first and open it afterwards. Getting one wrong tells you which brush-up entry to read, not that you should stop.

Before Chapter 1

Chapter 1 is a threat-modeling chapter, not a math chapter. It assumes you accept Shor’s algorithm as a cited result and reasons about what that means for RSA, ECDH, and ECDSA. The math chapter is Chapter 2, so a reader who is strong on deployed cryptography and rusty on algebra can start here and rebuild the algebra as Chapter 2 goes.

What each primitive is for. You can say which primitive solves which problem: encryption for confidentiality, a signature for authenticity that anyone can check, key agreement for a shared secret neither side transports, and a hash for a fingerprint that binds without hiding.

Four situations. (a) Two parties want a shared key over a public channel. (b) A vendor wants anyone at all to be able to check that a firmware image came from them. (c) A file has to be identifiable later without storing the file. (d) Two parties who already share a key want to detect tampering. Name the primitive for each.

Check your answer

They are key agreement or a KEM, a digital signature, a hash, and a message authentication code. Two of those are worth dwelling on. A signature is verifiable by anyone holding the public key, while a MAC is verifiable only by someone holding the shared secret, which is why the authenticity story in this book runs through signatures rather than MACs. And public-key encryption answers (a) only in the key-transport sense, by encrypting a key one party chose, which is a different interface from key agreement and from a KEM, and it answers none of the other three. Confidentiality is a separate problem, and this book spends most of its time on the other three.

The MAC is the one item here the book does not teach. It appears only as a named deployed primitive, inside HKDF in Chapter 27 and inside the inventories of Chapters 25 and 26, so recognizing the name is enough.

Classical algorithms. You can read pseudocode and reason about Big-O complexity. You know what RSA does at the level of the public-key interface: a scheme whose security depends on the hardness of factoring the modulus, since recovering the factors recovers the private key. You do not need to have implemented it.

A loop tries every candidate divisor from 2 up to $\sqrt{n}$, one division per step. Give its running time in terms of $n$, and then in terms of the number of bits of $n$.

Check your answer

It is $O(\sqrt{n})$ in the value of $n$, and $O(2^{b/2})$ in the number of bits $b$, because an integer of $b$ bits has a value near $2^b$. The second form is the one that matters: $\sqrt{n}$ looks modest until you notice that $n$ itself is exponential in the input size. Chapter 1 turns that gap into years.

Diffie-Hellman key agreement. You know that two parties can each publish a public share, keep a private value secret, and derive the same shared secret that a passive eavesdropper is assumed unable to compute. You recognize the elliptic-curve form, ECDH, where the private value is a scalar and the public share is a curve point. You recognize X25519 and P-256 as named groups used in that role.

Alice publishes $A$, Bob publishes $B$, and both derive the same secret. Name what each keeps private, and say what an eavesdropper who sees both $A$ and $B$ is assumed unable to compute.

Check your answer

Each keeps a private exponent, or in the elliptic-curve form a private scalar. The eavesdropper is assumed unable to compute the shared secret from $A$ and $B$ alone, which is the computational Diffie-Hellman assumption. Chapter 4 builds the curve arithmetic from scratch and Chapter 5 builds a toy Diffie-Hellman over a small prime, so neither is a prerequisite.

Symmetric primitives. You know that AES is a block cipher keyed with 128, 192, or 256 bits, and that AES-GCM is an authenticated-encryption mode. You know that a cryptographic hash function maps arbitrary-length input to a fixed-length digest.

AES-GCM encrypts and does one other thing. Name it. Then name the two hash properties this book relies on most.

Check your answer

It authenticates, so a receiver detects tampering rather than decrypting altered ciphertext into plausible garbage. The two hash properties are preimage resistance, meaning it is hard to find an input with a given digest, and collision resistance, meaning it is hard to find two inputs sharing one. Chapter 1 needs only the names and what each one provides. Chapter 3 restates the properties precisely.

The TLS 1.3 handshake. You can follow the shape of the exchange in its common form, where the server authenticates with a certificate and both sides contribute an ephemeral share. You recognize ClientHello and ServerHello as the messages that carry the shares, and CertificateVerify as the message that signs the handshake transcript. Chapter 1 opens on a recorded handshake of exactly this form.

The server sends a certificate and a CertificateVerify. Name the three checks a client makes before it trusts the connection.

Check your answer

First, the certificate chain validates back to a trust anchor the client already trusts. Second, the CertificateVerify signature over the handshake transcript verifies under the public key in that certificate. Third, and most often forgotten, the certificate identifies the server the client meant to reach, which means matching the expected hostname against the certificate’s presented identifiers (RFC 9525 Section 6, “Verifying Service Identity”). The first two checks alone are satisfied by an attacker holding a perfectly valid certificate, and its matching private key, for a different domain.

Note also what none of the three does: authentication and confidentiality are separate here. The session keys come from the ephemeral exchange, not from the certificate key, which is why Chapter 1 can break the recording without breaking the certificate.

Before Part II, where the construction starts

Chapter 2 rebuilds the algebra from high-school level, so these are the things it builds on rather than things it teaches from nothing.

Mathematical language. You can read a quantified statement and say what is assumed and what is concluded. You are comfortable with sets, functions, subscripts, and summation notation. Appendix B lists this book’s symbols, but it is a reference, not an introduction to reading mathematics.

Read: for every efficient adversary $A$ there is a negligible function $\nu$ such that $A$ wins the game with probability at most $1/2 + \nu(\lambda)$. Say what is quantified over what, and what $\lambda$ is.

Check your answer

The statement quantifies over every adversary first, and only then asserts that a bound exists, so each adversary is allowed its own negligible function. Swapping the two, to make one negligible function bound every adversary at once, is a strictly stronger claim than the definition makes. $\lambda$ is the security parameter, and the claim is about behaviour as $\lambda$ grows rather than at any single value of it.

Modular arithmetic. You can work with remainders, congruence, and negative representatives. You recognize $\mathbb{Z}/n\mathbb{Z}$ as the integers mod $n$ with the usual addition and multiplication.

Compute $7^{200} \bmod 13$. Then say what $-3 \bmod 13$ is.

Check your answer

The first is 3. Reducing the exponent modulo 12 first, to $7^8 \bmod 13$, is Fermat’s little theorem. Chapter 2 restates it, so knowing the theorem by name in advance is not required. The second is 10, and it is the step readers skip: a negative value has a representative in $\{0, \dots, 12\}$ like any other, and the book’s code relies on that throughout.

Linear algebra. You can multiply two $3 \times 3$ matrices on paper. You know what the rank of a matrix is, what it means for a set of vectors to be linearly independent, and what a basis is. You know what a determinant and a matrix inverse are, and what the Euclidean norm of a vector measures.

Say what the determinant of a square matrix tells you, and what the Euclidean norm of a vector measures.

Check your answer

The determinant is the signed factor by which the matrix scales volume, and it is zero exactly when the columns are linearly dependent. The Euclidean norm is the square root of the sum of the squared entries, which is the vector’s length. Chapter 7 leans on both without defining either. It defines a lattice’s determinant as $|\det B|$ for any basis $B$, which assumes you already know what $\det B$ is, and it measures the shortest vector in the Euclidean norm without saying what that norm is.

Discrete probability. You know what a uniform distribution is and can compute the expectation of a discrete random variable. You know what it means for two events to be independent, what a conditional probability is, and how to count arrangements and selections.

Two events are independent. Write $\Pr[A \wedge B]$. Then write the variance of a discrete random variable in terms of its expectation.

Check your answer

Independence gives $\Pr[A \wedge B] = \Pr[A] \cdot \Pr[B]$, and it is an assumption about the events rather than a rule of probability. The variance is $\operatorname{Var}[X] = \mathbb{E}[X^2] - \mathbb{E}[X]^2$. Both appear in this book’s attack analyses, where a bound on how far a sample strays from its mean is what makes an attack succeed or fail.

Security parameters and negligible probability. You recognize “negligible probability” as a property of a function of the security parameter, not of a single number.

Is $2^{-40}$ a negligible probability?

Check your answer

The question cannot be answered as asked, and noticing that is the skill. Negligible describes a function $\nu$ of the security parameter $\lambda$: one that eventually falls below $1/p(\lambda)$ for every polynomial $p$. A fixed $2^{-40}$ is a single small number at one parameter choice, and whether the function producing it is negligible depends entirely on how it behaves as $\lambda$ grows. “Small enough here” and “negligible” are different claims, and the book’s security arguments turn on the second.

Before the coding exercises

Python 3. You can read and write Python that uses lists, dictionaries, classes, and the standard library. You can convert between bytes, hexadecimal, and integers. The exact environment the book targets is documented in Appendix C: Environment setup.

What do 3 ** 2 and 3 ^ 2 evaluate to? Convert b'\xff\x01' to an integer. Then say which module gives you a key and which gives you a reproducible test.

Check your answer

3 ** 2 is 9 and 3 ^ 2 is 1, because ^ is bitwise XOR and not exponentiation. This book uses XOR constantly, in one-time pads, in hash-based constructions, and in the code chapters, so the two must not blur. int.from_bytes(b'\xff\x01', 'big') is 65281. Keys come from secrets, which draws on the operating system’s cryptographic source; reproducible test vectors come from random with a fixed seed. Using random for a key is a real vulnerability, and using secrets for a test makes the test unrepeatable.

Chapter 1’s second exercise is a coding exercise, so this item arrives earlier than the heading suggests if you work the exercises as you read.

What you do not need to know already

Topics you do not need before starting. The book builds most of them from the ground up. The one exception is named below.

• Quantum computing, to begin with. This is the exception, and the distinction matters: the book does not teach it. Chapters 1 through 30 treat Shor’s and Grover’s results as cited and reason about their consequences, which is all those chapters need, and they never introduce a qubit as a state vector. Part VI is different. Chapter 31 introduces the quantum random oracle model, where the adversary queries the hash oracle in superposition, and Chapter 33 works directly with superpositions, measurement, no-cloning, and Dirac notation for quantum states. Read the optional primer at the foot of this page before Part VI if none of that is familiar.
• Lattice theory
• Coding theory
• Isogenies between elliptic curves
• Number theory beyond basic modular arithmetic
• Group theory at a graduate level
• Zero-knowledge proof systems
• Designing or implementing a blockchain

Part VII assumes basic familiarity with one or two production chains (Bitcoin’s UTXO model, Ethereum’s account model and gas, hard forks as the upgrade path) and builds the cryptographic threat model from first principles. It does not assume you have designed or implemented a chain. For Bitcoin, Mastering Bitcoin on GitHub at https://github.com/bitcoinbook/bitcoinbook under CC BY-SA is a free deeper read. For Ethereum, the official documentation covers the two concepts Part VII leans on: accounts for the difference between externally owned and contract accounts and how an address derives from a key, and gas for what a transaction costs and why. Read both before Chapter 36; neither is needed earlier.

If you are not yet there, brush up here

For each gap, this section names a free resource, what to read in it, and which check above you should then be able to answer. Books are listed under Supporting material below.

The entries follow the checklist’s own order, so the resource for a check you missed is in the same position here as the check was above.

What each primitive is for. Christof Paar’s Introduction to Cryptography lecture course is free on YouTube, 25 lectures, linked from cryptography-textbook.com, and the site states that only high-school mathematics is needed to follow it. Watch the lectures on symmetric encryption, public-key encryption, digital signatures, key establishment, and hash functions. The goal is to be able to say what each primitive provides and what it does not, because this book routinely relies on the difference. Encryption gives confidentiality and does not by itself give integrity, which is what authenticated encryption adds. A signature gives authenticity and no confidentiality. Key agreement produces a shared secret rather than transporting one, and a hash binds without hiding. Key-derivation functions arrive in Chapter 5, where a shared secret has to become a key, and Chapter 27 builds the hybrid combiners on them. You should then be able to answer the primitive-roles check above.

Algorithmic complexity. Victor Shoup, A Computational Introduction to Number Theory and Algebra (Shoup, 2009), free PDF at shoup.net/ntb, Chapter 3, “Computing with large integers”: Section 3.1 for asymptotic notation, Section 3.2 for machine models and complexity theory, and Section 3.3 for basic integer arithmetic. Read it for one distinction above all, between an integer’s value and its bit length, because every infeasibility argument in this book rests on it. Jeff Erickson’s Algorithms, free at https://jeffe.cs.illinois.edu/teaching/algorithms/ under CC BY 4.0, is the deeper treatment, but Erickson states plainly that it is not a first introduction to algorithms, so reach for it second. Erickson’s “Appendix II: Solving Recurrences” is a separate 22-page lecture note at https://jeffe.cs.illinois.edu/teaching/algorithms/notes/99-recurrences.pdf, licensed CC BY-NC-SA 4.0 rather than CC BY 4.0 like the textbook. You should then be able to answer the classical-algorithms check above.

Diffie-Hellman and ECDH. NIST SP 800-56A Rev. 3, Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography, free at https://csrc.nist.gov/pubs/sp/800/56/a/r3/final, covers the finite-field and elliptic-curve forms in current use. Read it for the vocabulary and skip the parameter tables. The original paper is Diffie and Hellman, “New directions in cryptography” (Diffie & Hellman, 1976). X25519 is specified in RFC 7748 Section 5, “The X25519 and X448 Functions”, at rfc-editor.org/rfc/rfc7748 (Langley et al., 2016); P-256 and the other NIST curves are in NIST SP 800-186 (Chen et al., 2023). You should then be able to answer the Diffie-Hellman check above.

Symmetric primitives. AES is FIPS 197, Advanced Encryption Standard (AES), free at https://csrc.nist.gov/pubs/fips/197/final. The GCM authenticated mode is NIST SP 800-38D, Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC, free at https://csrc.nist.gov/pubs/sp/800/38/d/final. SHA-2 is FIPS 180-4 at https://csrc.nist.gov/pubs/fips/180-4/upd1/final and SHA-3 is FIPS 202 at https://csrc.nist.gov/pubs/fips/202/final. Read the abstract and the introduction of each and no further. Chapter 3 gives the hash security properties the book actually uses. You should then be able to answer the symmetric-primitives check above.

TLS 1.3 and certificates. RFC 9846 Section 2, “Protocol Overview”, free at rfc-editor.org/rfc/rfc9846, gives the handshake at the level Chapter 1 assumes (Rescorla, 2026). RFC 9846 was published in July 2026 and obsoletes RFC 8446, which specified TLS 1.3 in 2018. It is a minor update that retains the TLS 1.3 version number and is backward compatible. Read as far as Section 2.1 and stop. The resumption and 0-RTT subsections after it are past the prerequisite. Certificates are profiled in RFC 5280, Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile, free at rfc-editor.org/rfc/rfc5280 (Cooper et al., 2008). Read its introduction for the model and no further. For the identity check that the self-test asks about, RFC 9525 Section 6, “Verifying Service Identity”, at rfc-editor.org/rfc/rfc9525 is short and is the current statement of it. You should then be able to answer the TLS check above. Chapter 28 walks the TLS migration and Chapter 29 walks PKI.

Mathematical language. Mike Rosulek, The Joy of Cryptography, free at joyofcryptography.com. Read the “Math Review” appendix, directly at joyofcryptography.com/math-review, which covers the string and probability notation that security definitions are written in. Sets and functions appear there in use rather than as their own sections. You should then be able to answer the mathematical-language check above.

Modular arithmetic and elementary algebra. Start with Eric Lehman, F. Thomson Leighton, and Albert R. Meyer, Mathematics for Computer Science, free under CC BY-SA at https://courses.csail.mit.edu/6.042/spring18/mcs.pdf, whose Chapter 9, “Number Theory”, builds divisibility, congruence, and modular inverses from the beginning and at a gentler pace than the reference below. Then Shoup again: Chapter 1, “Basic properties of the integers”, and Chapter 2, “Congruences”. Shoup opens at a demanding level, so work the exercises in Chapter 1 rather than reading straight through. The material behind this book’s Chapter 2 is all in those two chapters. The ring, finite-field, and polynomial material comes later in Shoup. You should then be able to answer the modular-arithmetic check above.

Linear algebra. MIT OpenCourseWare 18.06SC Linear Algebra with Gilbert Strang, free at https://ocw.mit.edu/courses/18-06sc-linear-algebra-fall-2011/, under CC BY-NC-SA 4.0. You need six of its sessions rather than the course. In Unit I, take “Multiplication and Inverse Matrices”, “Independence, Basis and Dimension”, and “The Four Fundamental Subspaces” for rank. In Unit II, take “Properties of Determinants” and “Determinant Formulas and Cofactors” for the determinant, and “Orthogonal Vectors and Subspaces” for the dot product and length. Unit II’s third determinant session, “Cramer’s Rule, Inverse Matrix and Volume”, is optional here: Chapter 7 builds the volume reading of the determinant where it uses it. Jim Hefferon’s Linear Algebra, free at hefferon.net/linearalgebra, covers the same ground as reading rather than video, in its vector-spaces, linear-maps-and-matrices, and determinants chapters. You should then be able to answer the linear-algebra check above.

Discrete probability. Charles Grinstead and J. Laurie Snell, Introduction to Probability, free PDF at https://math.dartmouth.edu/~prob/prob/prob.pdf. Read Section 1.2 for discrete distributions, Sections 3.1 and 3.2 for permutations and combinations, Section 4.1 for discrete conditional probability, and Sections 6.1 and 6.2 for expected value and variance. MIT OpenCourseWare 6.042J Mathematics for Computer Science at https://ocw.mit.edu/courses/6-042j-mathematics-for-computer-science-spring-2015/ covers the same vocabulary in lecture form. You should then be able to answer the discrete-probability check above.

Security parameters and negligible probability. Rosulek again, Chapter 4, “Modern Computational Cryptography”, at joyofcryptography.com/comp. Its Section 4.2, “The asymptotic approach to provable security”, is where polynomial running time and negligible probability are defined as the asymptotic statements they are. Katz and Lindell cover the same ground in more depth. See Supporting material. You should then be able to answer the negligible-probability check above.

Python 3. The official Python tutorial at docs.python.org/3/tutorial covers what the book uses. Read sections 3 through 5 for the data types and control flow, and section 9 for classes. For the bytes-and-integers half of the check above, the standard-library documentation for int.from_bytes and secrets is the reference, and the secrets page states the distinction between randomness for keys and randomness for everything else. You should then be able to answer the Python check above.

Quantum computing primer (optional). Quantum Country’s “Quantum computing for the very curious” essay by Andy Matuschak and Michael Nielsen, free at quantum.country/qcvc, introduces qubits, quantum gates, and quantum circuits using spaced-repetition prompts. Two warnings before you start it. It has prerequisites of its own that this book does not share: it states that it assumes comfort with complex numbers and with linear algebra, and with classical logic gates. And it stops at universal quantum computing, so Shor’s algorithm appears only as a named application, with no derivation. Nothing before Part VI requires it. Chapter 1 treats Shor’s polynomial-time claim as a cited result.

Supporting material

These textbooks are deeper-dive references. None is required to read this book. The free resources above suffice for the prerequisites.

• Cormen, Leiserson, Rivest, and Stein, Introduction to Algorithms (CLRS). Covers more algorithms than Erickson and goes deeper on network flow, NP-completeness, and randomized algorithms.
• Nielsen and Chuang, Quantum Computation and Quantum Information (Nielsen & Chuang, 2010). Standard graduate-level treatment of quantum information beyond Shor’s algorithm.
• Katz and Lindell, Introduction to Modern Cryptography. A cryptography textbook organized around provable security. Chapters 1 through 3 cover the probabilistic vocabulary that underwrites every security definition in this book, and Section 3.1 is the reference for negligible functions and the asymptotic setting.
• Jean-Philippe Aumasson, Serious Cryptography: A Practical Introduction to Modern Encryption, 2nd edition (No Starch Press, 2024). The closest single book to this one’s assumed background: AES and block ciphers, hash functions, authenticated encryption, RSA, elliptic curves, and TLS, written for engineers rather than as a proof course. If one of the deployed-cryptography items on the self-test above feels shaky, this is the one book that likely covers it.
• Christof Paar, Jan Pelzl, and Tim Güneysu, Understanding Cryptography: From Established Symmetric and Asymmetric Ciphers to Post-Quantum Algorithms, 2nd edition (Springer, 2024). A course textbook with worked problems. The second edition adds a post-quantum chapter. Paar’s companion lecture videos and slides are free at cryptography-textbook.com, which makes it the best option if you prefer lectures to reading.

A note on the shape of the book

The mismatch between Chapter 1, which assumes classical-algorithms maturity and accepts a quantum result, and Chapter 2, which starts from high-school algebra, is deliberate. Chapter 1 is the threat brief that motivates the rest of the book. Chapter 2 is where the from-scratch construction begins.

A reader weak on the quantum side has two options: work through the Quantum Country primer listed above first, or treat Shor’s polynomial-time claim as cited and move on. Either is fine before Part VI. A reader strong on quantum but weak on algebra can read Chapter 1 normally and rebuild the algebra from Chapter 2.

References

Chen, L., Moody, D., Regenscheid, A., Robinson, A., & Randall, K. (2023). Recommendations for Discrete Logarithm-Based Cryptography: Elliptic Curve Domain Parameters. NIST SP 800-186. https://doi.org/10.6028/NIST.SP.800-186

Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., & Polk, T. (2008). Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile. IETF RFC 5280. https://doi.org/10.17487/RFC5280

Diffie, W., & Hellman, M. E. (1976). New directions in cryptography. IEEE Transactions on Information Theory, 22(6), 644–654. https://doi.org/10.1109/TIT.1976.1055638

Langley, A., Hamburg, M., & Turner, S. (2016). Elliptic Curves for Security. IETF RFC 7748. https://doi.org/10.17487/RFC7748

Nielsen, M. A., & Chuang, I. L. (2010). Quantum Computation and Quantum Information: 10th Anniversary Edition. Cambridge University Press. https://www.cambridge.org/highereducation/books/quantum-computation-and-quantum-information/01E10196D0A682A6AEFFEA52D53BE9AE

Rescorla, E. (2026). The Transport Layer Security (TLS) Protocol Version 1.3. RFC 9846. https://doi.org/10.17487/RFC9846

Shoup, V. (2009). A Computational Introduction to Number Theory and Algebra (2nd ed.). Cambridge University Press. https://doi.org/10.1017/cbo9780511814549