Learn cryptography by doing the math.
Pick a journey, or browse the catalog. Each algorithm walks step by step from the basic math to a Python script you can run.
Start here
Curated journeys — pick one to see how the pieces connect.
How TLS 1.3 works essay
The modern handshake. ECDH for key exchange, an authenticated cipher for the record stream, Ed25519 (or a CA-signed RSA cert) for identity.
How HTTPS works (the classic story)
The older RSA-based TLS handshake, still useful to understand. Two strangers meet on the internet and build a secure channel — asymmetric meets symmetric.
Why crypto looks weird
The attacks that motivated the design choices in the rest of the catalog. Padding oracles (CBC + RSA), ECB penguins, length extension, hash collisions, birthday math, PS3 nonce reuse — each one explains a design decision.
Post-quantum primer
Shor's algorithm breaks RSA, ECDH, and ECDSA on a fault-tolerant quantum computer. NIST standardized three replacements in August 2024.
Hashing for developers
SHA-256 fingerprints data; HMAC authenticates messages; HKDF derives keys; SHA-3 is the alternative when you want diversity. Plus password hashing (PBKDF2/bcrypt/Argon2).
Where to start
If you've never touched cryptography, start here. Caesar through one-time pad — all the ciphers that broke, and one (the OTP) that's mathematically perfect but impractical.
Signatures, classical to modern
Sign with a private key, verify with a public one. From RSA's textbook math through RSA-PSS, ECDSA's nonce-reuse footguns, and the Schnorr/Ed25519 design family, to the post-quantum signatures from NIST 2024.
Key exchange, classical to modern
Diffie-Hellman invented the public-key handshake in 1976. Fifty years and one curve later, X25519 is what everyone uses.
Elliptic curves end to end
Start with what an elliptic curve actually IS — points, addition, scalar multiplication. Then watch the same operations power X25519 key exchange, Ed25519 signatures, and ECDSA's PS3 disaster.
How card payments work
Your PIN travels through three banks. It's never decrypted along the way — only re-encrypted under fresh keys, inside tamper-evident HSMs.
Block ciphers, old to new
How AES became the standard. The 30-year story from DES's deathbed through Blowfish and Twofish to ChaCha20 — plus the modes that make it work.
How Linux stores your password essay
From `openssl passwd` to /etc/shadow's $y$, $gy$ and $argon2id$ prefixes. Why password storage got slow on purpose, then memory-hungry on purpose.
All algorithms
The full catalog, grouped by family.
Historical / pre-modern
Where cryptography started — substitution and shift ciphers, frequency analysis, the one-time pad. The on-ramp.
Asymmetric
Public/private keypairs. Anyone can encrypt; only the holder can decrypt — or sign.
RSA
Hybrid Encryption
## Hybrid Encryption RSA can only encrypt small things. Real systems wrap a random symmetric key with RSA, then use that key with AES to e…
Elliptic curves
## Elliptic curves — the foundation under X25519, Ed25519, ECDSA A visual lesson on the group structure: point addition, doubling, scalar …
X25519
## X25519 — key exchange on a curve Two strangers on a public network agree on a shared secret without ever transmitting it. The primitive…
Ed25519
## Ed25519 EdDSA signatures on the Edwards form of Curve25519 (RFC 8032). 32-byte keys, 64-byte sigs, deterministic, fast. SSH default sin…
Diffie-Hellman
## Diffie-Hellman — the 1976 handshake Two strangers agree on a shared secret over a public channel. The math trick that started modern pu…
ECDSA
## ECDSA NIST's elliptic-curve signature standard (FIPS 186-2). TLS, Bitcoin, Ethereum, JWT ES256. The PS3 disaster lives here.
Schnorr signatures
## Schnorr signatures The cleanest signature math — four lines on a discrete-log group. Patent-blocked until 2008; Bitcoin Taproot shipped…
Bleichenbacher Attack
## Bleichenbacher attack An RSA decrypt that distinguishes "PKCS#1 v1.5 conforming" from any other failure leaks one bit per query — enoug…
RSA-PSS
## RSA-PSS PKCS#1 v2.1 probabilistic signatures (RFC 8017). Hash + random salt + RSA. 256-byte signatures, 2048-bit keys. TLS 1.3 Certific…
Symmetric
Shared-key ciphers. Both sides hold the same key; fast enough for bulk data.
AES
## AES The Advanced Encryption Standard — the symmetric block cipher used everywhere. This lesson teaches the four moves AES applies to a …
Triple DES
## Triple DES DES with a 56-bit key is too weak for modern compute. Tripling DES with three keys gives ~112-bit effective security — expla…
Blowfish
## Blowfish A 1993 Feistel cipher by Bruce Schneier — free alternative to DES. 64-bit block, variable key. Still in bcrypt password hashin…
Twofish
## Twofish 1998 AES finalist by Schneier et al. 128-bit block, 16 Feistel-like rounds, key-dependent S-boxes, whitening. Lost to Rijndael;…
ChaCha20-Poly1305
## ChaCha20-Poly1305 A modern AEAD: ChaCha20 stream cipher + Poly1305 one-time MAC. ARX-only design, used by TLS 1.3 and WireGuard.
Block Cipher Modes
## Block Cipher Modes ECB, CBC, CTR, GCM — the recipes around AES. A block cipher encrypts ONE block; modes handle real-sized data, random…
Padding Oracle Attack
## Padding oracle attack A server that distinguishes "bad padding" from other errors leaks one bit per query — enough to decrypt CBC ciphe…
Hash & MAC
One-way functions that fingerprint data and authenticate messages — the building blocks under almost every protocol.
SHA-256
## SHA-256 The workhorse cryptographic hash: any input, fixed 256-bit fingerprint. One-way, deterministic, avalanche. The primitive under …
HMAC
## HMAC MACs prove a message came from someone with the shared key. HMAC is the standard MAC — used by TLS, JWT (HS256), AWS SigV4, and we…
Password Hashing
## Password Hashing Storing passwords: salt them, slow the hash way down. PBKDF2, bcrypt, and Argon2id are the three industry standards. A…
SHA-3 (Keccak)
## SHA-3 (Keccak) NIST's 2015 backup hash. Same security level as SHA-2 from a radically different construction — a sponge, not Merkle-Dam…
HKDF
## HKDF One shared secret in, many independent keys out. The KDF behind TLS 1.3, Signal, WireGuard. Extract + Expand, built on HMAC.
Length Extension Attack
## Length extension Merkle-Damgard hashes expose their internal state as the output. An attacker given `H(secret || msg)` can forge `H(sec…
Hash Collisions
## Hash collisions Two distinct inputs, same fingerprint. MD5 fell in 2004, SHA-1 in 2017. Real, downloadable proof. The pigeonhole princi…
Birthday Attack
## Birthday attack The generic sqrt(N) attack on N-output hash functions. An n-bit hash gives only n/2 bits of collision resistance — whic…
bcrypt
## bcrypt A password hash built on Blowfish's deliberately slow key schedule, iterated 2^cost times. The most-deployed password hash in 20…
yescrypt
The hash guarding most Linux logins since 2021 — scrypt's memory-hard idea tuned for /etc/shadow. Meet the $y$ prefix.
GOST-yescrypt
yescrypt wrapped in Russia's national-standard Streebog HMAC. Same engine, different paperwork — the $gy$ prefix.
Argon2id
The recommended variant of Argon2, the Password Hashing Competition winner. Memory-hard by design — the $argon2id$ everyone recommends.
Post-quantum
Algorithms designed to survive an adversary with a large quantum computer.
Kyber (ML-KEM)
## Kyber (ML-KEM) Post-quantum key encapsulation, FIPS 203 (Aug 2024). Lattice math survives Shor's algorithm. Replacing X25519 in TLS 1.3…
Dilithium (ML-DSA)
## Dilithium (ML-DSA) Post-quantum signatures, FIPS 204 (Aug 2024). Module-SIS lattice math; survives Shor. Pairs with Kyber as the PQ sta…
SPHINCS+ (SLH-DSA)
## SPHINCS+ (SLH-DSA) Post-quantum signatures, FIPS 205 (Aug 2024). Security from hashing alone — no lattice, no number theory. ~8-50 KB s…
Key management & HSMs
Patterns and devices for protecting the key material itself — vaults, not algorithms.