153 articles on how ciphers, hashes and protocols work. Search, or narrow the list by topic and level.
Showing 1 to 12 of 153 articles
AES only encrypts one 16-byte block. A mode of operation is the wrapper that turns that single block into something that protects a whole message or an entire disk. This guide walks through four modes, CTR, CFB, OFB, and XTS, with verified NIST numbers you can check yourself.
14 min read
ADFGVX fractionates each letter into two symbols and then shuffles them with a columnar transposition, the combination that made it Germany's toughest field cipher of 1918. This guide runs the modern automated attack: recover the transposition with the index of coincidence, then solve the substitution with quadgrams, and read a 330-letter message back out.
14 min read
The Nihilist cipher turns letters into Polybius numbers and adds a repeating keyword, which makes it a Vigenere cipher wearing a numeric disguise. Index of coincidence finds the period, and column-by-column statistics peel off the key. This guide runs the real attack and recovers a 514-letter message.
13 min read
Elliptic curve security does not come from the size of the field. It comes from one number: the largest prime factor of the group order. When that order is smooth, Pohlig-Hellman splits the discrete log into tiny subgroups and solves it in a flash. This guide runs the real attack on a toy curve and recovers the private key.
13 min read
RSA is unbreakable only when its primes are chosen well. If two keys share a prime, one GCD factors both in microseconds, and if a prime p has a smooth p-1, Pollard's method factors it without any search. This guide runs both real attacks against real 1024-bit keys and recovers the private keys.
11 min read
Bifid fractionates each letter into coordinates and shuffles them, which hides single-letter frequencies. Given the period, a hill climb over the Polybius square guided by English quadgram statistics peels the key apart anyway. This guide runs the real attack and recovers a 669-letter message.
13 min read
A server that only tells you whether decrypted padding was valid hands you the whole plaintext. This guide runs the real CBC padding-oracle attack against full AES-128, recovers a secret message one byte at a time, and explains why POODLE and Lucky 13 made authenticated encryption the rule.
16 min read
Encrypting with DES twice looks like it should double the key to 112 bits. A meet-in-the-middle attack shows it barely adds one bit of real security, which is why 3DES uses three passes. Learn the attack with runnable Python against real DES.
12 min read
The four-square cipher hides letter frequencies behind two keyed grids, but it is still a pencil-and-paper cipher. Learn how simulated annealing with quadgram statistics recovers both secret squares from the ciphertext alone, with runnable Python.
14 min read
Using a plain hash as a MAC, with tag = H(secret || message), is a classic mistake. A length-extension attack appends your own data and forges a valid tag without ever knowing the secret. Learn the attack on SHA-256, with runnable Python, and why HMAC exists.
11 min read
A one-time pad is unbreakable, but only if the key is used once. Reuse it across several messages and the key cancels out. Learn the many-time-pad attack and crib-dragging, with Python that recovers the messages from the ciphertexts alone.
14 min read
DSA and ECDSA stake everything on a secret random nonce that must never repeat. Sign two messages with the same nonce and the private key drops out with a little algebra. This guide runs the real attack against real DSA and secp256k1, the same flaw that broke the PS3 and drained Bitcoin wallets.
12 min read
Every TEA key has three twins that encrypt identically, because flipping the top bits of two key words cancels in the round function. That one-bit quirk shrank TEA's key to 126 bits and let hackers forge a hash to break the original Xbox. This guide runs the real thing against real TEA.
12 min read
The two-square cipher resists the ciphertext-only search that breaks Playfair and four-square, because it has no fixed reference squares. But a crib of known plaintext breaks it in seconds. Learn the known-plaintext attack, with runnable Python.
13 min read
WEP bolted RC4 onto a 3-byte IV sent in the clear, and that choice was fatal. The Fluhrer-Mantin-Shamir attack recovers the shared key from the first byte of thousands of weak-IV packets. This guide runs the real attack against real RC4 and recovers the key byte by byte.
14 min read
IPsec protects IP traffic with ESP, and IKEv2 negotiates the keys. Learn the SKEYSEED key derivation, pre-shared-key authentication, and AES-GCM, with Python code checked against 280 of NIST's own known-answer test vectors.
26 min read
OTR brings deniable, forward-secret encryption to instant messaging, with a SIGMA-style key exchange, DSA signatures, and the Socialist Millionaires' Protocol. Learn the full version 3 wire format, with Python code checked against NIST's own DSA test vectors.
27 min read
Kerberos is a ticket-based authentication protocol from the 1980s that still runs most corporate networks. Learn the AS, TGS, and AP exchanges, the DER message format, and the AES encryption types of RFC 3962 and RFC 8009, with Python code that reproduces the MIT reference encodings and runs a full login.
40 min read
Noise is a framework for building secure channels from Diffie-Hellman exchanges. A protocol is a short pattern of tokens and a name. Learn the three state objects, the 38 handshake patterns, pre-shared keys, and the security properties, with a Python engine that reproduces 1,352 official test vectors.
34 min read
OPAQUE is a password-authenticated key exchange that gives a server nothing to steal: not the password, not a dictionary-attackable verifier. Learn the oblivious pseudorandom function at its core, the envelope that hides a client's key pair, and the 3DH handshake, with Python code that reproduces the official RFC 9807 test vectors.
30 min read
SRP is a password-authenticated key exchange. The server stores only a verifier, the password never crosses the network, and an eavesdropper cannot test guesses. Learn the SRP-6 mathematics of RFC 5054, the proofs of RFC 2945, and the checks that decide its security.
22 min read
SSH secures remote logins with a binary packet protocol, a curve25519-sha256 key exchange, and an Ed25519 host key. Learn the handshake and the chacha20-poly1305@openssh.com cipher, with Python code that reproduces the IETF draft's own worked example byte for byte.
29 min read
WireGuard is a VPN protocol built on the Noise IKpsk2 handshake. Learn the two handshake messages, the cookie mechanism against denial of service, the replay window, and the timers, with Python code that reproduces an official test vector and the Linux kernel self-test.
37 min read
BIKE is a post-quantum key encapsulation scheme built on codes with a sparse parity-check matrix. Learn how its keys hide a sparse code in a dense one, how the Black-Gray-Flip decoder removes the error, why one flipped bit is rejected, and why NIST chose HQC instead.
30 min read
BLS signatures use a bilinear pairing on the curve BLS12-381 to make short, deterministic signatures that can be added together into one. Learn how a pairing works, how a message is hashed to a curve, how aggregation saves space, and how a rogue key attack is stopped.
39 min read
ECDH lets two parties agree on a shared secret using points on an elliptic curve. Learn how P-256, P-384, and secp256k1 define the group, how public keys are encoded and validated, why the secret is only an x coordinate, and how an invalid-curve attack works.
23 min read
ECDSA is the elliptic curve version of DSA, used to sign TLS handshakes and Bitcoin transactions. Learn how signing and verifying work, why a repeated nonce reveals the private key, how RFC 6979 removes that risk, and how a signature is encoded.
23 min read
Ed25519 is the EdDSA signature scheme on the Edwards curve of Curve25519, defined in RFC 8032. Learn how a 32-byte seed becomes a key, how a deterministic nonce replaces random numbers, how a signature is checked with the cofactor, and why the range check on S matters.
19 min read
GeMSS is a post-quantum signature scheme whose signatures have only a few hundred bits and whose public key is a system of quadratic equations. Learn how a hidden polynomial over GF(2^n) becomes a signature, how the signer finds roots, and why NIST dropped the scheme after a key-recovery attack.
41 min read
Picnic is a post-quantum signature scheme built only from a block cipher and a hash function. Learn how a zero-knowledge proof about a secret LowMC key becomes a signature, how three simulated parties hide the key, why 219 repetitions are needed, and why NIST did not select it.
36 min read
Shamir's secret sharing splits a secret into shares so that any k of n shares rebuild it and fewer reveal nothing at all. Learn how a polynomial hides the secret, how Lagrange interpolation recovers it, why k minus one shares give no information, and how GF(256) makes the scheme work on bytes.
20 min read
X25519 is the Diffie-Hellman function on Curve25519, defined in RFC 7748. Learn how a 32-byte private key is clamped, how the Montgomery ladder multiplies a point using only its u coordinate, why the curve was chosen, and what the all-zero check protects against.
18 min read
XMSS and LMS sign with nothing but a hash function, so quantum computers do not break them. Learn how Winternitz chains and Merkle trees work, why a signer must never reuse a one-time key, and how a reused key lets an attacker forge a message.
34 min read
Balloon hashing is a memory-hard password hashing function built from an ordinary hash such as SHA-256. Learn how it expands a buffer, mixes it with salt-driven reads, why its memory access never depends on the password, and what attacks it faces.
16 min read
bcrypt is a password hashing function built from the Blowfish cipher with a deliberately expensive key setup. Learn how the salt, the cost, and the 72-byte limit work, how the hash string is built, and why its versions differ.
20 min read
The Merkle-Hellman knapsack cryptosystem hides an easy subset sum problem behind modular multiplication. Learn how its keys, encryption, and decryption work, and watch a lattice reduction attack with the LLL algorithm recover messages from the public key alone.
22 min read
The Rabin cryptosystem encrypts by squaring a number modulo n = pq. Learn how decryption finds four square roots with the Chinese remainder theorem, why redundancy is needed, why breaking it is as hard as factoring, and why a chosen-ciphertext attack still defeats the plain version.
18 min read
scrypt is a password-based key derivation function that makes every guess cost memory as well as time. Learn how Salsa20/8, BlockMix, and ROMix fill and read a large table, how its parameters work, and what its security proofs say.
19 min read
GMAC is the authentication-only mode of AES-GCM. It authenticates data with a polynomial hash over the field GF(2^128), masked by an AES-encrypted counter. Learn how GHASH works, why an IV must never repeat, and how a repeated IV reveals the hash key.
20 min read
KMAC is the message authentication code built on SHA-3. It needs no HMAC-style double hashing, because the Keccak sponge resists length extension. Learn how cSHAKE, the key block, and the encoded output length work, with every NIST sample checked.
17 min read
Poly1305 is a fast one-time message authentication code that evaluates a polynomial modulo 2^130 - 5. Learn how its key is clamped, how each block joins the accumulator, why a key must never be reused, and how an attacker could recover it if it were.
14 min read
RIPEMD-160 is a 160-bit hash function that runs two independent lines of 80 steps over every block and then merges them. Learn how its padding, rounds, and combine step work, why Bitcoin still uses it, and how it compares with SHA-1.
20 min read
Skein is a hash function built from the Threefish block cipher and a tweak that marks every block. It was one of the five finalists of the NIST SHA-3 competition. Learn how Unique Block Iteration, the configuration block, and the output stage work, with every digest checked.
18 min read
SM3 is the Chinese national standard hash function. It looks like SHA-256 at first glance, but its message expansion, step function, and 16 rounds of pure XOR are different. Learn how it works step by step, with every intermediate value checked against the standard.
15 min read
Streebog, or GOST R 34.11-2012, is the Russian hash function standard. It hashes with a 12-round AES-like cipher, a length counter, and a checksum. Learn how its S-box, byte transposition, and linear map work, with every round of the RFC 6986 example checked.
19 min read
Tiger is a 192-bit hash function designed for fast hashing on 64-bit processors. It uses four large S-boxes and only a handful of operations per round. Learn how its three passes, key schedule, and S-box generator work, and how Tiger2 differs.
16 min read
UMAC is a very fast message authentication code built on universal hashing. A three-layer hash shrinks the message, and an AES-made pad hides the result. Learn how NH, POLY, and the inner product work, and how forging odds of 2^-30 to 2^-120 are guaranteed.
20 min read
Whirlpool is a 512-bit hash function built from an AES-like block cipher that works on an 8 by 8 matrix of bytes. Learn how its S-box, column shift, and diffusion matrix work, how the Miyaguchi-Preneel mode turns the cipher into a hash, and how it compares with SHA-2.
16 min read
A5/1 protected GSM phone calls for decades. Learn how three small shift registers that move at irregular times produce keystream, why the cipher was kept secret, and how researchers broke it in practice.
16 min read
AES-CCM encrypts and authenticates data with a single AES key by combining counter mode with a CBC-MAC. Learn how its blocks are formatted, how the tag is computed and hidden, and why CCM powers Wi-Fi security, Bluetooth Low Energy, and many small devices.
18 min read
AES-SIV is an authenticated encryption mode that keeps working when a nonce is reused. Learn how its CMAC-based S2V function builds a synthetic IV, how that value becomes both the tag and the counter, and why SIV is the standard choice for key wrapping.
15 min read
E0 is the stream cipher that has protected Bluetooth connections since the late 1990s. Learn how four shift registers and a tiny state machine produce keystream, how the session key and clock are loaded, and why E0 is now considered broken.
20 min read
Grain pairs a linear shift register with a nonlinear one and filters them into a keystream. Learn how Grain v1 and Grain-128 work, why they were designed for tiny hardware, and what attacks have taught designers about them.
17 min read
OCB encrypts and authenticates in a single pass, using about one AES call per block. Learn how its secret offsets turn AES into a tweakable cipher, how the tag comes from a checksum, and what the 2018 attacks on OCB2 mean for the version in RFC 7253.
17 min read
Rabbit is a fast software stream cipher from Cryptico, and it was one of the winners of the eSTREAM competition. Learn how eight counters, eight state words, and one squaring trick turn a 128-bit key into a stream of keystream blocks.
17 min read
SEAL is a stream cipher that lets you jump to any position in its keystream. Learn how it uses the SHA-1 compression function to build tables from a 160-bit key, and how a few additions and lookups per word make it fast on 32-bit processors.
17 min read
Trivium is one of the smallest strong stream ciphers ever designed. Learn how three shift registers, a few XORs, and three AND gates build a cipher that fits in about 3,500 gates and made it into the eSTREAM hardware portfolio.
13 min read
XChaCha20-Poly1305 extends ChaCha20-Poly1305 with a 192-bit nonce, so you can simply pick a random nonce for every message. Learn how HChaCha20 builds a fresh subkey, how the rest of the AEAD works, and why the bigger nonce makes collisions a non-issue.
15 min read
ARIA is South Korea's national block cipher, a close cousin of AES that shares its S-box but mixes bytes with a different, self-inverse diffusion layer. Learn how its alternating rounds, key schedule, and 1/π constants work.
17 min read
Camellia is the cipher that stands next to AES in international standards. Learn how this Japanese Feistel design combines byte S-boxes, a linear mixing layer, and key-dependent FL layers to match AES-level security.
16 min read
CAST-128, also called CAST5, was the default cipher in some versions of PGP and GnuPG. Learn how its three alternating round functions, huge 8x32-bit S-boxes, and key-dependent rotations work, and why its 64-bit block now limits it.
25 min read
GOST 28147-89 was the Soviet Union's answer to DES. Learn how its 32-round Feistel design works, why the standard left the S-boxes undefined, and how the modern Magma cipher fixed that.
14 min read
RC5 and RC6 are built from just three operations: addition, XOR, and rotations whose amounts come from the data itself. Learn how Ron Rivest's flexible RC5 led to RC6, an AES finalist.
15 min read
Serpent finished second in the AES competition, and it was built to be the safest finalist. Learn how 32 rounds of tiny S-boxes and a bitslice design traded speed for one of the largest security margins of any block cipher.
15 min read
Simon and Speck are two lightweight block ciphers released by the NSA in 2013 for tiny devices. Learn how Simon gets by on AND, rotate, and XOR, how Speck uses add, rotate, and XOR, and why they became some of the most debated ciphers ever published.
16 min read
Skipjack was the secret NSA cipher inside the Clipper chip, declassified in 1998. Learn how its 32 rounds of alternating rules work on four 16-bit words, and why its 80-bit key and its history make it a cautionary tale.
14 min read
SM4 is China's national block cipher standard, a 32-round design that updates one 32-bit word at a time. Learn how its byte S-box, rotate-and-XOR mixing, and compact key schedule work, and where the cipher is used.
13 min read
TEA is a block cipher small enough to write in a few lines of code, and XTEA is its repaired successor. Learn how shifts, additions, and XORs make a working cipher, and how a flaw in TEA's key handling led to a famous console hack.
14 min read
Threefish is the tweakable block cipher inside the Skein hash function, a SHA-3 finalist. Learn how it builds a strong cipher from just addition, rotation, and XOR on 64-bit words, with no S-boxes at all.
16 min read
DES never fell to clever math. It fell to a loop: try a key, encrypt a known block, compare, repeat. This post runs that exact loop against real DES, the same one EFF's Deep Crack ran over all 2⁵⁶ keys in 1998.
18 min read
Every hash function is vulnerable to a generic birthday attack. MD5 is vulnerable to something worse: a real, structural flaw that produces full 128-bit collisions far faster than any generic attack should allow. Both are demonstrated here, live and verified.
16 min read
RC4's second keystream byte is zero twice as often as it should be. Encrypt the same secret enough times, under any keys at all, and that one flaw hands the secret's second byte straight to anyone watching the ciphertexts.
12 min read
Diffie-Hellman's security rests on the discrete logarithm problem being hard. For a small prime, it isn't. Baby-step giant-step trades a brute-force search of size p for one of roughly √p, and that's the whole reason real DH needs huge safe primes.
11 min read
ElGamal's private key is just another discrete logarithm. The same baby-step giant-step technique that breaks Diffie-Hellman over a small prime recovers ElGamal's private key too, and from there decrypts any captured ciphertext directly.
11 min read
A low public exponent like e=3 is efficient and, by itself, still safe. Broadcast the same message to three recipients using e=3 with no padding, and the Chinese Remainder Theorem recovers it with no private key at all.
10 min read
Sharing one RSA modulus across multiple key pairs looks like a harmless shortcut: skip prime generation, reuse n. If the same message ever gets encrypted under two of those keys, no private key is needed to read it back.
13 min read
RSA's security assumes factoring n back into p and q is infeasible. That assumption quietly breaks if the key generator picks p and q too close together. Fermat's 1643 factoring method recovers them both in seconds.
13 min read
Small private exponents make RSA decryption and signing faster. Michael Wiener showed in 1990 that a d small enough to help performance is also small enough to recover from the public key alone, via continued fractions.
12 min read
The Autokey cipher defeats Kasiski examination and the Index of Coincidence by never repeating its key. But the short priming key that starts everything off is still just a handful of letters, and one wrong guess collapses the entire decryption for you.
34 min read
The site's simplified Enigma breaker fixes the rotor order, skips the plugboard, and brute-forces 17,576 positions by statistics. The real Bombe did none of that. It searched rotor order and position too, deduced the plugboard through pure logic, and never scored a single decryption.
34 min read
Every other breaker on this site attacks ciphertext alone, guessing at a key through brute force or statistical search. The Hill cipher doesn't need any of that. Its encryption is pure linear algebra, so a handful of known plaintext letters is enough to solve for the entire key matrix directly.
16 min read
Playfair defeated single-letter frequency analysis by encrypting pairs of letters through a 5×5 key square. But the same simulated-annealing idea that cracks the substitution cipher still works here too, once you swap in quadgram statistics and a richer set of moves.
20 min read
Every other transposition breaker on this site has to search over orderings. Columnar Transposition alone hides a factorial number of column arrangements behind its key. Rail Fence has no such trapdoor: the entire key is a single small number, so brute force checks every possibility outright.
14 min read
Learn about ADFGVX, the German WWI field cipher that combined Polybius-square fractionation with columnar transposition. It was considered so strong that French cryptanalyst Georges Painvin needed weeks to break a message that helped stop a 1918 offensive.
14 min read
Learn how to break the Affine cipher by brute-forcing its entire 312-key keyspace and scoring each decryption with a common-word heuristic. It's the same strategy that cracks Caesar, just applied to a slightly bigger lock.
15 min read
Learn about the Affine cipher, a generalization of the Caesar cipher that combines multiplication and addition to create a larger, but still breakable, keyspace.
14 min read
Learn about the Atbash cipher, one of the oldest known substitution ciphers, where each letter is mirrored to the opposite end of the alphabet.
11 min read
Learn about the Autokey cipher, the Vigenère variant that fixes the repeating-key weakness by folding the plaintext itself into the key stream. That closes the door on Kasiski examination.
14 min read
Learn about Bacon's cipher, Francis Bacon's 17th-century biliteral system that hides a secret message not by scrambling it, but by encoding it into which of two typefaces each letter of an innocent-looking cover text uses.
13 min read
The Beaufort cipher's reciprocal formula (C = K − P instead of Vigenère's C = P + K) looks like it should matter to an attacker. It doesn't: the same Kasiski examination, Index of Coincidence, and chi-squared pipeline that breaks Vigenère breaks Beaufort just as cleanly.
16 min read
Learn about the Beaufort cipher, a Vigenère variant that flips the subtraction around to become its own inverse. The same formula both encrypts and decrypts.
11 min read
Learn about the Bifid cipher, Félix Delastelle's fractionating cipher that scrambles a Polybius square's coordinates across an entire message, defeating single-letter frequency analysis far more thoroughly than plain substitution.
14 min read
Columnar transposition doesn't hide letters. It just rearranges them, so frequency analysis finds nothing wrong. Learn the attack that actually works: brute-forcing every column order for each candidate key length, scored by common English substrings.
18 min read
Learn about the columnar transposition cipher, a classic cipher that scrambles the order of letters instead of replacing them. Learn why combining it with substitution led to some of the toughest hand ciphers ever used.
13 min read
The real wartime Enigma resisted brute force because of two unknowns stacked on top of its rotor positions: which three rotors were chosen and in what order, and how the plugboard was wired. Together these push the key space past 10^20. Strip those two unknowns away and only 17,576 rotor positions are left, small enough for a modern computer to brute-force outright.
27 min read
Learn how the Enigma machine worked: the WWII German cipher machine that produced a different substitution alphabet for every single keystroke. Its defeat by Alan Turing and Bletchley Park changed the course of the war.
17 min read
Learn about the four-square cipher, a digraph substitution cipher that uses four 5x5 grids to encrypt letter pairs without Playfair's awkward same-row and same-column special cases.
12 min read
Learn about the Nihilist cipher, the 19th-century Russian revolutionary cipher that turns a Polybius square into a polyalphabetic system by adding coordinate numbers together instead of shifting letters.
13 min read
Learn about the one-time pad, the only cipher in this series that is mathematically proven unbreakable, and why that proof rests on three conditions that are almost impossible to satisfy in practice.
15 min read
Learn about the Polybius square, the ancient Greek cipher that turns every letter into a pair of coordinates. It became the foundation for tap codes, telegraph ciphers, and the ADFGVX cipher.
12 min read
A monoalphabetic substitution key is one arbitrary permutation of 26 letters: 26! of them, far too many to brute force and immune to Kasiski or the Index of Coincidence since there's no repeating key. Here's how frequency analysis and a hill-climbing search crack it anyway.
26 min read
Learn about the monoalphabetic substitution cipher, the general family of ciphers that Caesar, Atbash, and Affine are all special cases of, and why its huge keyspace still isn't enough to make it secure.
12 min read
Learn about the two-square cipher, a digraph substitution cipher that sits between Playfair's single grid and four-square's four grids: two independently keyed squares, one uniform encryption rule.
13 min read
For three centuries the Vigenère cipher was called 'le chiffre indéchiffrable.' Learn the two statistical techniques, Kasiski examination and the Index of Coincidence, that finally broke it, and watch them recover a real key letter by letter.
17 min read
In August 2025, NIST standardized a cipher small enough to run on a battery-powered sensor and simple enough to fit its whole state in five CPU registers. Learn how Ascon's sponge-based permutation delivers real authenticated encryption at a fraction of AES-GCM's footprint.
14 min read
NIST's primary post-quantum signature standard works by signing, checking your own signature against a size limit, and throwing it away and starting over if it's too big. Learn how 'Fiat-Shamir with Aborts' turns a leaky lattice proof into a secure signature.
14 min read
Falcon produces the smallest signatures of any NIST post-quantum standard. It does that by solving a problem that broke the leading lattice signature schemes of the late 1990s/early 2000s. Learn the hash-and-sign paradigm, and why the naive version of it is fatally insecure.
13 min read
FrodoKEM deliberately throws away the algebraic structure that makes lattice cryptography fast. It trades performance for a security proof that rests on plain, 'vanilla' Learning With Errors. Learn how it works and why some cryptographers prefer that trade.
10 min read
In March 2025, NIST picked a second code-based algorithm to back up Kyber. This one hides its noise completely differently from McEliece. Learn how HQC masks a public, unscrambled code with pure algebraic randomness instead.
10 min read
The key encapsulation mechanism NIST chose to replace RSA and ECDH for general-purpose use. Learn how Kyber hides a noisy linear system inside a polynomial ring to get both lattice-hard security and real-world speed.
9 min read
Before Kyber, before LWE was even named, NTRU showed that ordinary polynomial multiplication in the right ring could resist quantum attacks. Learn how NTRU hides a fast decryption trick behind a public convolution product.
11 min read
Rainbow signed messages using polynomial equations so tangled that solving them looks impossible. Then, in 2022, someone found a shortcut and broke it in a weekend on a laptop. Learn how it worked, and how it fell.
12 min read
SABER reached the final round of NIST's post-quantum competition with a trick Kyber doesn't use: instead of adding random noise, it rounds numbers down and lets the rounding error itself do the job. Learn how Learning With Rounding works.
10 min read
Every other post-quantum signature scheme bets on a new hard math problem holding up. SPHINCS+ makes almost no new bet at all: its security rests on nothing but hash functions. Learn how a tree of one-time signatures becomes a full signature scheme.
11 min read
DES's 56-bit key became too weak, but the industry didn't design a new cipher. It just ran DES three times. Learn how Triple DES extended the life of the original standard for another two decades.
7 min read
AES-GCM does two jobs at once: it hides your data AND proves nobody tampered with it. Learn how Galois/Counter Mode combines AES with GHASH authentication to become the default choice for TLS, IPsec, and disk encryption.
10 min read
AES secures nearly everything: HTTPS traffic, encrypted disks, and government secrets alike. Here's how the Rijndael cipher transforms data, round by round.
17 min read
Argon2 won the 2015 Password Hashing Competition by making brute-force attacks expensive in RAM, not just CPU time. That closes off the GPU and ASIC cracking farms that broke older schemes. Here's how memory-hardness works.
9 min read
Bruce Schneier designed Blowfish as a free, fast alternative to DES, with a distinctive twist: its S-boxes are rebuilt from the encryption key through a key schedule that starts from the digits of pi. Learn how it works, with every value shown, and why it's still found in legacy systems today.
21 min read
TLS 1.3's second mandatory cipher suite pairs ChaCha20 encryption with the Poly1305 message authenticator, delivering AES-GCM-equivalent security without needing any special hardware. Here's how the pairing works.
9 min read
What if you already have AES in your system and don't want to bring in a separate hash function just for message authentication? CMAC builds a MAC directly from a block cipher instead.
9 min read
The Data Encryption Standard ruled cryptography for over two decades. Learn how its Feistel network works, why its 56-bit key ultimately doomed it, and why it still matters as the foundation for 3DES and AES.
10 min read
DSA was the U.S. government's answer to a simple question: how do you prove a message came from you, without RSA's patent? Learn how the Digital Signature Algorithm works, and why a single reused number sank Sony's PS3 security.
9 min read
TLS 1.3 and the Signal Protocol both lean on the same small, elegant primitive to turn a shared secret into however many separate keys they actually need. Here's how HKDF's extract-then-expand design works.
8 min read
A hash alone can't prove a message wasn't tampered with. Anyone can recompute it. HMAC fixes that by mixing in a secret key, becoming one of the most quietly essential building blocks in TLS, SSH, and beyond.
8 min read
IDEA was one of the first ciphers to mix three completely different mathematical operations within a single round. Learn how this Swiss-designed algorithm became a mainstay of early PGP, and why it eventually gave way to AES.
11 min read
McEliece has survived over 45 years of cryptanalysis without ever being broken. It's one of NIST's chosen post-quantum standards. Learn how hiding an error-correcting code behind scrambling matrices creates a public-key system quantum computers can't crack.
10 min read
What if you could add two numbers together without ever decrypting them? Paillier encryption makes that possible. It's the mathematical trick behind private vote tallying and secure multi-party computation.
8 min read
For nearly two decades, PBKDF2's answer to password cracking was simple: make every guess expensive by repeating a hash thousands of times. Here's how it works, and why memory-hard successors like Argon2 eventually surpassed it.
8 min read
RC4 was the simplest, fastest cipher of its era. It powered SSL, WEP, and WPA for over a decade before a decade of accumulating bias attacks quietly killed it. Learn how it works and exactly why it's insecure today.
8 min read
RSA made public-key cryptography practical for the world. Here's how it works, why it's secure, and where it's headed as quantum computing looms.
18 min read
Designed by Daniel J. Bernstein as a fast, secure, RC4-free alternative for software encryption, ChaCha20 now secures TLS 1.3 and WireGuard alike. Learn how its add-rotate-XOR "quarter round" builds a full cipher from pure arithmetic.
9 min read
Schnorr signatures are what DSA might have been if a 20-year patent hadn't gotten in the way. Simpler, provably secure, and now at the heart of Bitcoin's Taproot upgrade: here's how they work.
8 min read
Most hash functions give you a fixed-size output no matter what you ask for. SHAKE breaks that rule: it's a hash function you can ask for any amount of output from, built from the same Keccak sponge as SHA-3.
10 min read
Twofish was Bruce Schneier's answer to Blowfish's biggest weakness, and one of the five finalists in the competition that chose AES. Learn how its key-dependent S-boxes, MDS matrix, and Pseudo-Hadamard Transform work, with every value of a real test vector shown.
32 min read
Diffie-Hellman solved cryptography's oldest problem: sharing a secret over a channel anyone can watch. Here's the math, and how it still secures the web.
14 min read
ECC gets RSA-level security from far smaller keys. Here's the curve math behind it, and why it now powers most of the web.
13 min read
ElGamal turns Diffie-Hellman key exchange into full public-key encryption. Here's how the discrete-log problem protects every message it sends.
7 min read
EdDSA replaced random nonces with deterministic ones, closing off one of ECDSA's worst failure modes. Here's the math behind Ed25519.
8 min read
Understanding TLS: The Backbone of Secure Internet Communication
22 min read
The Signal Protocol is a modern, open-source cryptographic protocol that provides end-to-end encryption for voice calls, video calls, and instant messaging conversations.
12 min read
Understanding Pretty Good Privacy: Hybrid Encryption for Secure Messaging and Data
11 min read
BLAKE2 and BLAKE3 have emerged as the preferred choice for new applications requiring high-performance hashing
20 min read
Secure Hash Algorithm 1 was for years one of the most widely used cryptographic hash functions.
9 min read
The SHA-2 family of cryptographic hash functions is the gold standard for digital security today.
10 min read
SHA-3, also known as **Keccak** (pronounced 'ketchak'), is the newest member of the Secure Hash Algorithm family standardized by NIST.
11 min read
Ronald Rivest designed MD5 in 1991. By 2004 it was broken. Here's the algorithm, and why real collisions ended its cryptographic career.
9 min read
Lester Hill brought matrix multiplication to cryptography in 1929. It was the first cipher to encrypt whole blocks of letters at once.
7 min read
The Playfair Cipher: A Complete Educational Guide
17 min read
Learn about Mathematical Elegance in Classical Cryptography
13 min read
Breaking the Caesar Cipher: A Python Journey from Comprehensive to Concise
15 min read
The Vigenère Cipher: A Journey Through History and Modern Applications.
12 min read
Learn about one of the simplest and most widely known encryption techniques, the Caesar cipher.
12 min read
No articles found
Try fewer words, or remove a filter.
