Tag
106 articles with this tag.
AES only encrypts one 16-byte block. A mode of operation is the wrapper that turns that single block into something that protects a whole message or an entire disk. This guide walks through four modes, CTR, CFB, OFB, and XTS, with verified NIST numbers you can check yourself.
14 min read
IPsec protects IP traffic with ESP, and IKEv2 negotiates the keys. Learn the SKEYSEED key derivation, pre-shared-key authentication, and AES-GCM, with Python code checked against 280 of NIST's own known-answer test vectors.
26 min read
OTR brings deniable, forward-secret encryption to instant messaging, with a SIGMA-style key exchange, DSA signatures, and the Socialist Millionaires' Protocol. Learn the full version 3 wire format, with Python code checked against NIST's own DSA test vectors.
27 min read
Kerberos is a ticket-based authentication protocol from the 1980s that still runs most corporate networks. Learn the AS, TGS, and AP exchanges, the DER message format, and the AES encryption types of RFC 3962 and RFC 8009, with Python code that reproduces the MIT reference encodings and runs a full login.
40 min read
Noise is a framework for building secure channels from Diffie-Hellman exchanges. A protocol is a short pattern of tokens and a name. Learn the three state objects, the 38 handshake patterns, pre-shared keys, and the security properties, with a Python engine that reproduces 1,352 official test vectors.
34 min read
OPAQUE is a password-authenticated key exchange that gives a server nothing to steal: not the password, not a dictionary-attackable verifier. Learn the oblivious pseudorandom function at its core, the envelope that hides a client's key pair, and the 3DH handshake, with Python code that reproduces the official RFC 9807 test vectors.
30 min read
SRP is a password-authenticated key exchange. The server stores only a verifier, the password never crosses the network, and an eavesdropper cannot test guesses. Learn the SRP-6 mathematics of RFC 5054, the proofs of RFC 2945, and the checks that decide its security.
22 min read
SSH secures remote logins with a binary packet protocol, a curve25519-sha256 key exchange, and an Ed25519 host key. Learn the handshake and the chacha20-poly1305@openssh.com cipher, with Python code that reproduces the IETF draft's own worked example byte for byte.
29 min read
WireGuard is a VPN protocol built on the Noise IKpsk2 handshake. Learn the two handshake messages, the cookie mechanism against denial of service, the replay window, and the timers, with Python code that reproduces an official test vector and the Linux kernel self-test.
37 min read
BIKE is a post-quantum key encapsulation scheme built on codes with a sparse parity-check matrix. Learn how its keys hide a sparse code in a dense one, how the Black-Gray-Flip decoder removes the error, why one flipped bit is rejected, and why NIST chose HQC instead.
30 min read
BLS signatures use a bilinear pairing on the curve BLS12-381 to make short, deterministic signatures that can be added together into one. Learn how a pairing works, how a message is hashed to a curve, how aggregation saves space, and how a rogue key attack is stopped.
39 min read
ECDH lets two parties agree on a shared secret using points on an elliptic curve. Learn how P-256, P-384, and secp256k1 define the group, how public keys are encoded and validated, why the secret is only an x coordinate, and how an invalid-curve attack works.
23 min read
ECDSA is the elliptic curve version of DSA, used to sign TLS handshakes and Bitcoin transactions. Learn how signing and verifying work, why a repeated nonce reveals the private key, how RFC 6979 removes that risk, and how a signature is encoded.
23 min read
Ed25519 is the EdDSA signature scheme on the Edwards curve of Curve25519, defined in RFC 8032. Learn how a 32-byte seed becomes a key, how a deterministic nonce replaces random numbers, how a signature is checked with the cofactor, and why the range check on S matters.
19 min read
GeMSS is a post-quantum signature scheme whose signatures have only a few hundred bits and whose public key is a system of quadratic equations. Learn how a hidden polynomial over GF(2^n) becomes a signature, how the signer finds roots, and why NIST dropped the scheme after a key-recovery attack.
41 min read
Picnic is a post-quantum signature scheme built only from a block cipher and a hash function. Learn how a zero-knowledge proof about a secret LowMC key becomes a signature, how three simulated parties hide the key, why 219 repetitions are needed, and why NIST did not select it.
36 min read
Shamir's secret sharing splits a secret into shares so that any k of n shares rebuild it and fewer reveal nothing at all. Learn how a polynomial hides the secret, how Lagrange interpolation recovers it, why k minus one shares give no information, and how GF(256) makes the scheme work on bytes.
20 min read
X25519 is the Diffie-Hellman function on Curve25519, defined in RFC 7748. Learn how a 32-byte private key is clamped, how the Montgomery ladder multiplies a point using only its u coordinate, why the curve was chosen, and what the all-zero check protects against.
18 min read
XMSS and LMS sign with nothing but a hash function, so quantum computers do not break them. Learn how Winternitz chains and Merkle trees work, why a signer must never reuse a one-time key, and how a reused key lets an attacker forge a message.
34 min read
Balloon hashing is a memory-hard password hashing function built from an ordinary hash such as SHA-256. Learn how it expands a buffer, mixes it with salt-driven reads, why its memory access never depends on the password, and what attacks it faces.
16 min read
bcrypt is a password hashing function built from the Blowfish cipher with a deliberately expensive key setup. Learn how the salt, the cost, and the 72-byte limit work, how the hash string is built, and why its versions differ.
20 min read
The Merkle-Hellman knapsack cryptosystem hides an easy subset sum problem behind modular multiplication. Learn how its keys, encryption, and decryption work, and watch a lattice reduction attack with the LLL algorithm recover messages from the public key alone.
22 min read
The Rabin cryptosystem encrypts by squaring a number modulo n = pq. Learn how decryption finds four square roots with the Chinese remainder theorem, why redundancy is needed, why breaking it is as hard as factoring, and why a chosen-ciphertext attack still defeats the plain version.
18 min read
scrypt is a password-based key derivation function that makes every guess cost memory as well as time. Learn how Salsa20/8, BlockMix, and ROMix fill and read a large table, how its parameters work, and what its security proofs say.
19 min read
GMAC is the authentication-only mode of AES-GCM. It authenticates data with a polynomial hash over the field GF(2^128), masked by an AES-encrypted counter. Learn how GHASH works, why an IV must never repeat, and how a repeated IV reveals the hash key.
20 min read
KMAC is the message authentication code built on SHA-3. It needs no HMAC-style double hashing, because the Keccak sponge resists length extension. Learn how cSHAKE, the key block, and the encoded output length work, with every NIST sample checked.
17 min read
Poly1305 is a fast one-time message authentication code that evaluates a polynomial modulo 2^130 - 5. Learn how its key is clamped, how each block joins the accumulator, why a key must never be reused, and how an attacker could recover it if it were.
14 min read
RIPEMD-160 is a 160-bit hash function that runs two independent lines of 80 steps over every block and then merges them. Learn how its padding, rounds, and combine step work, why Bitcoin still uses it, and how it compares with SHA-1.
20 min read
Skein is a hash function built from the Threefish block cipher and a tweak that marks every block. It was one of the five finalists of the NIST SHA-3 competition. Learn how Unique Block Iteration, the configuration block, and the output stage work, with every digest checked.
18 min read
SM3 is the Chinese national standard hash function. It looks like SHA-256 at first glance, but its message expansion, step function, and 16 rounds of pure XOR are different. Learn how it works step by step, with every intermediate value checked against the standard.
15 min read
Streebog, or GOST R 34.11-2012, is the Russian hash function standard. It hashes with a 12-round AES-like cipher, a length counter, and a checksum. Learn how its S-box, byte transposition, and linear map work, with every round of the RFC 6986 example checked.
19 min read
Tiger is a 192-bit hash function designed for fast hashing on 64-bit processors. It uses four large S-boxes and only a handful of operations per round. Learn how its three passes, key schedule, and S-box generator work, and how Tiger2 differs.
16 min read
UMAC is a very fast message authentication code built on universal hashing. A three-layer hash shrinks the message, and an AES-made pad hides the result. Learn how NH, POLY, and the inner product work, and how forging odds of 2^-30 to 2^-120 are guaranteed.
20 min read
Whirlpool is a 512-bit hash function built from an AES-like block cipher that works on an 8 by 8 matrix of bytes. Learn how its S-box, column shift, and diffusion matrix work, how the Miyaguchi-Preneel mode turns the cipher into a hash, and how it compares with SHA-2.
16 min read
A5/1 protected GSM phone calls for decades. Learn how three small shift registers that move at irregular times produce keystream, why the cipher was kept secret, and how researchers broke it in practice.
16 min read
AES-CCM encrypts and authenticates data with a single AES key by combining counter mode with a CBC-MAC. Learn how its blocks are formatted, how the tag is computed and hidden, and why CCM powers Wi-Fi security, Bluetooth Low Energy, and many small devices.
18 min read
AES-SIV is an authenticated encryption mode that keeps working when a nonce is reused. Learn how its CMAC-based S2V function builds a synthetic IV, how that value becomes both the tag and the counter, and why SIV is the standard choice for key wrapping.
15 min read
E0 is the stream cipher that has protected Bluetooth connections since the late 1990s. Learn how four shift registers and a tiny state machine produce keystream, how the session key and clock are loaded, and why E0 is now considered broken.
20 min read
Grain pairs a linear shift register with a nonlinear one and filters them into a keystream. Learn how Grain v1 and Grain-128 work, why they were designed for tiny hardware, and what attacks have taught designers about them.
17 min read
OCB encrypts and authenticates in a single pass, using about one AES call per block. Learn how its secret offsets turn AES into a tweakable cipher, how the tag comes from a checksum, and what the 2018 attacks on OCB2 mean for the version in RFC 7253.
17 min read
Rabbit is a fast software stream cipher from Cryptico, and it was one of the winners of the eSTREAM competition. Learn how eight counters, eight state words, and one squaring trick turn a 128-bit key into a stream of keystream blocks.
17 min read
SEAL is a stream cipher that lets you jump to any position in its keystream. Learn how it uses the SHA-1 compression function to build tables from a 160-bit key, and how a few additions and lookups per word make it fast on 32-bit processors.
17 min read
Trivium is one of the smallest strong stream ciphers ever designed. Learn how three shift registers, a few XORs, and three AND gates build a cipher that fits in about 3,500 gates and made it into the eSTREAM hardware portfolio.
13 min read
XChaCha20-Poly1305 extends ChaCha20-Poly1305 with a 192-bit nonce, so you can simply pick a random nonce for every message. Learn how HChaCha20 builds a fresh subkey, how the rest of the AEAD works, and why the bigger nonce makes collisions a non-issue.
15 min read
ARIA is South Korea's national block cipher, a close cousin of AES that shares its S-box but mixes bytes with a different, self-inverse diffusion layer. Learn how its alternating rounds, key schedule, and 1/π constants work.
17 min read
Camellia is the cipher that stands next to AES in international standards. Learn how this Japanese Feistel design combines byte S-boxes, a linear mixing layer, and key-dependent FL layers to match AES-level security.
16 min read
CAST-128, also called CAST5, was the default cipher in some versions of PGP and GnuPG. Learn how its three alternating round functions, huge 8x32-bit S-boxes, and key-dependent rotations work, and why its 64-bit block now limits it.
25 min read
GOST 28147-89 was the Soviet Union's answer to DES. Learn how its 32-round Feistel design works, why the standard left the S-boxes undefined, and how the modern Magma cipher fixed that.
14 min read
RC5 and RC6 are built from just three operations: addition, XOR, and rotations whose amounts come from the data itself. Learn how Ron Rivest's flexible RC5 led to RC6, an AES finalist.
15 min read
Serpent finished second in the AES competition, and it was built to be the safest finalist. Learn how 32 rounds of tiny S-boxes and a bitslice design traded speed for one of the largest security margins of any block cipher.
15 min read
Simon and Speck are two lightweight block ciphers released by the NSA in 2013 for tiny devices. Learn how Simon gets by on AND, rotate, and XOR, how Speck uses add, rotate, and XOR, and why they became some of the most debated ciphers ever published.
16 min read
Skipjack was the secret NSA cipher inside the Clipper chip, declassified in 1998. Learn how its 32 rounds of alternating rules work on four 16-bit words, and why its 80-bit key and its history make it a cautionary tale.
14 min read
SM4 is China's national block cipher standard, a 32-round design that updates one 32-bit word at a time. Learn how its byte S-box, rotate-and-XOR mixing, and compact key schedule work, and where the cipher is used.
13 min read
TEA is a block cipher small enough to write in a few lines of code, and XTEA is its repaired successor. Learn how shifts, additions, and XORs make a working cipher, and how a flaw in TEA's key handling led to a famous console hack.
14 min read
Threefish is the tweakable block cipher inside the Skein hash function, a SHA-3 finalist. Learn how it builds a strong cipher from just addition, rotation, and XOR on 64-bit words, with no S-boxes at all.
16 min read
Learn about ADFGVX, the German WWI field cipher that combined Polybius-square fractionation with columnar transposition. It was considered so strong that French cryptanalyst Georges Painvin needed weeks to break a message that helped stop a 1918 offensive.
14 min read
Learn about the Affine cipher, a generalization of the Caesar cipher that combines multiplication and addition to create a larger, but still breakable, keyspace.
14 min read
Learn about the Atbash cipher, one of the oldest known substitution ciphers, where each letter is mirrored to the opposite end of the alphabet.
11 min read
Learn about the Autokey cipher, the Vigenère variant that fixes the repeating-key weakness by folding the plaintext itself into the key stream. That closes the door on Kasiski examination.
14 min read
Learn about Bacon's cipher, Francis Bacon's 17th-century biliteral system that hides a secret message not by scrambling it, but by encoding it into which of two typefaces each letter of an innocent-looking cover text uses.
13 min read
Learn about the Beaufort cipher, a Vigenère variant that flips the subtraction around to become its own inverse. The same formula both encrypts and decrypts.
11 min read
Learn about the Bifid cipher, Félix Delastelle's fractionating cipher that scrambles a Polybius square's coordinates across an entire message, defeating single-letter frequency analysis far more thoroughly than plain substitution.
14 min read
Learn about the columnar transposition cipher, a classic cipher that scrambles the order of letters instead of replacing them. Learn why combining it with substitution led to some of the toughest hand ciphers ever used.
13 min read
Learn how the Enigma machine worked: the WWII German cipher machine that produced a different substitution alphabet for every single keystroke. Its defeat by Alan Turing and Bletchley Park changed the course of the war.
17 min read
Learn about the four-square cipher, a digraph substitution cipher that uses four 5x5 grids to encrypt letter pairs without Playfair's awkward same-row and same-column special cases.
12 min read
Learn about the Nihilist cipher, the 19th-century Russian revolutionary cipher that turns a Polybius square into a polyalphabetic system by adding coordinate numbers together instead of shifting letters.
13 min read
Learn about the one-time pad, the only cipher in this series that is mathematically proven unbreakable, and why that proof rests on three conditions that are almost impossible to satisfy in practice.
15 min read
Learn about the Polybius square, the ancient Greek cipher that turns every letter into a pair of coordinates. It became the foundation for tap codes, telegraph ciphers, and the ADFGVX cipher.
12 min read
Learn about the monoalphabetic substitution cipher, the general family of ciphers that Caesar, Atbash, and Affine are all special cases of, and why its huge keyspace still isn't enough to make it secure.
12 min read
Learn about the two-square cipher, a digraph substitution cipher that sits between Playfair's single grid and four-square's four grids: two independently keyed squares, one uniform encryption rule.
13 min read
In August 2025, NIST standardized a cipher small enough to run on a battery-powered sensor and simple enough to fit its whole state in five CPU registers. Learn how Ascon's sponge-based permutation delivers real authenticated encryption at a fraction of AES-GCM's footprint.
14 min read
In March 2025, NIST picked a second code-based algorithm to back up Kyber. This one hides its noise completely differently from McEliece. Learn how HQC masks a public, unscrambled code with pure algebraic randomness instead.
10 min read
DES's 56-bit key became too weak, but the industry didn't design a new cipher. It just ran DES three times. Learn how Triple DES extended the life of the original standard for another two decades.
7 min read
AES-GCM does two jobs at once: it hides your data AND proves nobody tampered with it. Learn how Galois/Counter Mode combines AES with GHASH authentication to become the default choice for TLS, IPsec, and disk encryption.
10 min read
AES secures nearly everything: HTTPS traffic, encrypted disks, and government secrets alike. Here's how the Rijndael cipher transforms data, round by round.
17 min read
Argon2 won the 2015 Password Hashing Competition by making brute-force attacks expensive in RAM, not just CPU time. That closes off the GPU and ASIC cracking farms that broke older schemes. Here's how memory-hardness works.
9 min read
Bruce Schneier designed Blowfish as a free, fast alternative to DES, with a distinctive twist: its S-boxes are rebuilt from the encryption key through a key schedule that starts from the digits of pi. Learn how it works, with every value shown, and why it's still found in legacy systems today.
21 min read
TLS 1.3's second mandatory cipher suite pairs ChaCha20 encryption with the Poly1305 message authenticator, delivering AES-GCM-equivalent security without needing any special hardware. Here's how the pairing works.
9 min read
What if you already have AES in your system and don't want to bring in a separate hash function just for message authentication? CMAC builds a MAC directly from a block cipher instead.
9 min read
The Data Encryption Standard ruled cryptography for over two decades. Learn how its Feistel network works, why its 56-bit key ultimately doomed it, and why it still matters as the foundation for 3DES and AES.
10 min read
DSA was the U.S. government's answer to a simple question: how do you prove a message came from you, without RSA's patent? Learn how the Digital Signature Algorithm works, and why a single reused number sank Sony's PS3 security.
9 min read
TLS 1.3 and the Signal Protocol both lean on the same small, elegant primitive to turn a shared secret into however many separate keys they actually need. Here's how HKDF's extract-then-expand design works.
8 min read
A hash alone can't prove a message wasn't tampered with. Anyone can recompute it. HMAC fixes that by mixing in a secret key, becoming one of the most quietly essential building blocks in TLS, SSH, and beyond.
8 min read
IDEA was one of the first ciphers to mix three completely different mathematical operations within a single round. Learn how this Swiss-designed algorithm became a mainstay of early PGP, and why it eventually gave way to AES.
11 min read
McEliece has survived over 45 years of cryptanalysis without ever being broken. It's one of NIST's chosen post-quantum standards. Learn how hiding an error-correcting code behind scrambling matrices creates a public-key system quantum computers can't crack.
10 min read
What if you could add two numbers together without ever decrypting them? Paillier encryption makes that possible. It's the mathematical trick behind private vote tallying and secure multi-party computation.
8 min read
For nearly two decades, PBKDF2's answer to password cracking was simple: make every guess expensive by repeating a hash thousands of times. Here's how it works, and why memory-hard successors like Argon2 eventually surpassed it.
8 min read
RC4 was the simplest, fastest cipher of its era. It powered SSL, WEP, and WPA for over a decade before a decade of accumulating bias attacks quietly killed it. Learn how it works and exactly why it's insecure today.
8 min read
RSA made public-key cryptography practical for the world. Here's how it works, why it's secure, and where it's headed as quantum computing looms.
18 min read
Designed by Daniel J. Bernstein as a fast, secure, RC4-free alternative for software encryption, ChaCha20 now secures TLS 1.3 and WireGuard alike. Learn how its add-rotate-XOR "quarter round" builds a full cipher from pure arithmetic.
9 min read
Schnorr signatures are what DSA might have been if a 20-year patent hadn't gotten in the way. Simpler, provably secure, and now at the heart of Bitcoin's Taproot upgrade: here's how they work.
8 min read
Most hash functions give you a fixed-size output no matter what you ask for. SHAKE breaks that rule: it's a hash function you can ask for any amount of output from, built from the same Keccak sponge as SHA-3.
10 min read
Twofish was Bruce Schneier's answer to Blowfish's biggest weakness, and one of the five finalists in the competition that chose AES. Learn how its key-dependent S-boxes, MDS matrix, and Pseudo-Hadamard Transform work, with every value of a real test vector shown.
32 min read
Diffie-Hellman solved cryptography's oldest problem: sharing a secret over a channel anyone can watch. Here's the math, and how it still secures the web.
14 min read
ECC gets RSA-level security from far smaller keys. Here's the curve math behind it, and why it now powers most of the web.
13 min read
ElGamal turns Diffie-Hellman key exchange into full public-key encryption. Here's how the discrete-log problem protects every message it sends.
7 min read
EdDSA replaced random nonces with deterministic ones, closing off one of ECDSA's worst failure modes. Here's the math behind Ed25519.
8 min read
Understanding TLS: The Backbone of Secure Internet Communication
22 min read
Understanding Pretty Good Privacy: Hybrid Encryption for Secure Messaging and Data
11 min read
BLAKE2 and BLAKE3 have emerged as the preferred choice for new applications requiring high-performance hashing
20 min read
Secure Hash Algorithm 1 was for years one of the most widely used cryptographic hash functions.
9 min read
The SHA-2 family of cryptographic hash functions is the gold standard for digital security today.
10 min read
SHA-3, also known as **Keccak** (pronounced 'ketchak'), is the newest member of the Secure Hash Algorithm family standardized by NIST.
11 min read
Ronald Rivest designed MD5 in 1991. By 2004 it was broken. Here's the algorithm, and why real collisions ended its cryptographic career.
9 min read
Learn about Mathematical Elegance in Classical Cryptography
13 min read
Learn about one of the simplest and most widely known encryption techniques, the Caesar cipher.
12 min read
