r/cryptography • • Apr 01 '26

[Meta] low-effort and anti-slop rules

56 Upvotes

Hello community,

In light of AI and the rise of vibecode, vibeproofs and vibe blogging, the mod team has expanded the "low-effort" rule with more specificity. While an extraordinary tool, AI caused a rise of sloppy content that may be time-consuming to disprove or speculatively break lattice cryptography via theoretical physics or even fully automated karma farming and arguing bots via OpenClaw agents.

Also please feel free to use this post for meta-discussion or suggestions about the sub itself be what you appreciate, what you'd like to see more or less.

The new rules:

Extraordinary claims require extraordinary proofs

Posts making cryptographic claims must include substantiated analysis not just speculation or qualitative arguments or be presented as a challenge to the community. Arguments primarily based on non-cryptographic sources are very likely flawed. Posts claiming to break cryptography via non-mathematical means (e.g. theoretical physics) without rigorous mathematical analysis are prohibited. Authors of cryptographic primitives are encouraged to read NIST submissions as example of cryptographic rigor.

No AI-slop

AI-assisted content must be thoroughly reviewed for slop, hallucinations, crackpot cryptography and errors before posting. AI does pattern matching, if the training data contained errors or misunderstandings, they will propagate.   Low effort AI-generated blogpost or code implementations will be removed.


r/cryptography • • Jan 25 '22 Bless Up Bravo

Information and learning resources for cryptography newcomers

337 Upvotes

Please post any sources that you would like to recommend or disclaimers you'd want stickied and if i said something stupid, point it out please.

Basic information for newcomers

There are two important laws in cryptography:

Anyone can make something they don't break. Doesn't make something good. Heavy peer review is needed.

A cryptographic scheme should assume the secrecy of the algorithm to be broken, because it will get out.

 

Another common advice from cryptographers is Don't roll your own cryptography until you know what you are doing. Don't use what you implement or invented without serious peer review. Implementing is fine, using it is very dangerous due to the many pitfalls you will miss if you are not an expert.

 

Cryptography is mainly mathematics, and as such is not as glamorous as films and others might make it seem to be. It is a vast and extremely interesting field but do not confuse it with the romanticized version of medias. Cryptography is not codes. It's mathematical algorithms and schemes that we analyze.

 

Cryptography is not cryptocurrency. This is tiring to us to have to say it again and again, it's two different things.

 

Resources

  • All the quality resources in the comments

  • The wiki page of the r/crypto subreddit has advice on beginning to learn cryptography. Their sidebar has more material to look at.

  • github.com/pFarb: A list of cryptographic papers, articles, tutorials, and how-tos - seems quite complete

  • github.com/sobolevn: A list of cryptographic resources and links -seems quite complete

  • u/dalbuschat 's comment down in the comment section has plenty of recommendations

  • this introduction to ZKP from COSIC, a widely renowned laboratory in cryptography

  • The "Springer encyclopedia of cryptography and security" is quite useful, it's a plentiful encyclopedia. Buy it legally please. Do not find for free on Russian sites.

  • CrypTool 1, 2, JavaCrypTool and CrypTool-Online: this one i did not look how it was

*This blog post details how to read a cryptography paper, but the whole blog is packed with information.

 

Overview of the field

It's just an overview, don't take it as a basis to learn anything, to be honest the two github links from u/treifi seem to do the same but much better so go there instead. But give that one a read i think it might be cool to have an overview of the field as beginners. Cryptography is a vast field. But i'll throw some of what i consider to be important and (more than anything) remember at the moment.

 

A general course of cryptography to present the basics such as historical cryptography, caesar cipher and their cryptanalysis, the enigma machine, stream ciphers, symmetric vs public key cryptography, block ciphers, signatures, hashes, bit security and how it relates to kerckhoff's law, provable security, threat models, Attack models...

Those topics are vital to have the basic understanding of cryptography and as such i would advise to go for courses of universities and sources from laboratories or recognized entities. A lot of persons online claim to know things on cryptography while being absolutely clueless, and a beginner cannot make the difference, so go for material of serious background. I would personally advise mixing English sources and your native language's courses (not sources this time).

With those building blocks one can then go and check how some broader schemes are made, like electronic voting or message applications communications or the very hype blockchain construction, or ZKP or hybrid encryption or...

 

Those were general ideas and can be learnt without much actual mathematical background. But Cryptography above is a sub-field of mathematics, and as such they cannot be avoided. Here are some maths used in cryptography:

  • Finite field theory is very important. Without it you cannot understand how and why RSA works, and it's one of the simplest (public key) schemes out there so failing at understanding it will make the rest seem much hard.

  • Probability. Having a good grasp of it, with at least understanding the birthday paradox is vital.

  • Basic understanding of polynomials.

With this mathematical knowledge you'll be able to look at:

  • Important algorithms like baby step giant step.

  • Shamir secret sharing scheme

  • Multiparty computation

  • Secure computation

  • The actual working gears of previous primitives such as RSA or DES or Merkle–Damgård constructions or many other primitives really.

 

Another must-understand is AES. It requires some mathematical knowledge on the three fields mentioned above. I advise that one should not just see it as a following of shiftrows and mindless operations but ask themselves why it works like that, why are there things called S boxes, what is a SPN and how it relates to AES. Also, hey, they say this particular operation is the equivalent of a certain operation on a binary field, what does it mean, why is it that way...? all that. This is a topic in itself. AES is enormously studied and as such has quite some papers on it.

For example "Peigen – a Platform for Evaluation, Implementation, and Generation of S-boxes" has a good overviews of attacks that S-boxes (perhaps The most important building block of Substitution Permutation Network) protect against. You should notice it is a plentiful paper even just on the presentation of the attacks, it should give a rough idea of much different levels of work/understanding there is to a primitive. I hope it also gives an idea of the number of pitfalls in implementation and creation of ciphers and gives you trust in Schneier's law.

 

Now, there are slightly more advanced cryptography topics:

  • Elliptic curves

  • Double ratchets

  • Lattices and post quantum cryptography in general

  • Side channel attacks (requires non-basic statistical understanding)

For those topics you'll be required to learn about:

  • Polynomials on finite fields more in depth

  • Lattices (duh)

  • Elliptic curve (duh again)

At that level of math you should also be able to dive into fully homomorphic encryption, which is a quite interesting topic.

 

If one wish to become a semi professional cryptographer, aka being involved in the field actively, learning programming languages is quite useful. Low level programming such as C, C++, java, python and so on. Network security is useful too and makes a cryptographer more easily employable. If you want to become more professional, i invite you to look for actual degrees of course.

Something that helps one learn is to, for every topic as soon as they do not understand a word, go back to the prerequisite definitions until they understand it and build up knowledge like that.

I put many technical terms/names of subjects to give starting points. But a general course with at least what i mentioned is really the first step. Most probably, some important topics were forgotten so don't stop to what is mentioned here, dig further.

There are more advanced topics still that i did not mention but they should come naturally to someone who gets that far. (such as isogenies and multivariate polynomial schemes or anything quantum based which requires a good command of algebra)


r/cryptography • • 23h ago

With NIST IR 8547 finalized and FN-DSA (Falcon) still delayed, is ML-DSA-65 effectively the only viable general-purpose signature for decentralized P2P networks?

6 Upvotes

NIST finalized IR 8547 on October 27, 2026, deprecating all quantum-vulnerable digital signatures (RSA, ECDSA, EdDSA) across all security strengths after 2030 and disallowing them after 2035. At the same time, the finalized report confirms that the FIPS standard derived from FALCON (FN-DSA) is still under development, leaving ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) as the only finalized general-purpose post-quantum signature standards.

For decentralized consensus and peer-to-peer networks where every node independently verifies thousands of signatures per block without centralized PKI, that narrows the practical design space significantly:

First, SLH-DSA (FIPS 205) offers conservative hash-based assumptions, but its verification latency and multi-kilobyte signature sizes make it painful for high-throughput gossip and transaction mempools unless paired with heavy recursive SNARK aggregation.

Second, FN-DSA (Falcon) has the smallest bandwidth footprint at roughly 666 bytes for Level 1, which is why blockchain researchers love it on paper, but beyond the FIPS standard still not being finalized, constant-time floating-point signing on heterogeneous consumer hardware and mobile devices remains notoriously tricky to implement safely without side-channel leaks.

Third, ML-DSA-65 (FIPS 204) sits right in the middle: deterministic integer arithmetic, fast verification times on both desktop and mobile CPUs, and a finalized NIST standard, at the cost of a 1,952-byte public key and a 3,309-byte signature.

For cryptographers and protocol engineers working on decentralized systems today, are you standardizing on ML-DSA-65 as the default workhorse despite the 3.3 KB bandwidth hit, or are you holding out for FN-DSA or hash-based SNARK aggregation?


r/cryptography • • 21h ago

Anyone have access to "Toward Finding S-Box Circuits With Optimal Multiplicative Complexity"?

2 Upvotes

Hey everyone,

I’m currently trying to get my hands on a copy of "Toward Finding S-Box Circuits With Optimal Multiplicative Complexity" (by Yongjin Jeon, Seungjun Baek, and Jongsung Kim, published in IEEE Transactions on Computers, 2024).

I don't have institutional access, and IEEE thinks I should pay for that.

If anyone with university credentials or an IEEE Xplore subscription can help me out, I'd be very grateful.


r/cryptography • • 1d ago

algorithm replicating

0 Upvotes

if i have secure implementation of algorithm in 1 language and i wana port it to other language and they dont have compiler is there secure way to do it?


r/cryptography • • 1d ago

I think we could reverse a private key based on a signed file for asymmetric encryption [SPECULATION]

0 Upvotes

So basically to sign a file you take the hash of the file and encrypt it with a private key and you decrypt the hash using public key, what I fear we could do is do a known-plaintext attack on the private key because you know the plaintext and ENCRYPTED version of the file hash using private key, and reverse the private key using the known-plaintext attack, that's what I fear could happen.


r/cryptography • • 1d ago

compensating enrophy with time

0 Upvotes

im thinking is this posible to make low entrophy password secure by adding more time to check if its right like for example u need to hash with argon2 with allot of cycles but password has small amount of enrophy will it be secure since attacker cant check all passwords fast


r/cryptography • • 2d ago

[Career Advice] help me break into cryptography.

7 Upvotes

I am in my final year of btech (graduating in 2027).

I've built a sumcheck cpu and gpu (ICICLE) based prover and verifier, a low level OCI compliant container runtime (contributed to most of the features), and building an adaptive proving runtime on edge as a research project, including groth n stark (wip).

I always intend to go the deepest layer possible, now can derive the complete math equations of groth n stark so far, training myself to be comfortable with the math.

My interests are in applied cryptography, zkps, systems engineering.

Almost everyone wants to hire devs with experience, am not able to land a job.

As the graduation date is getting closer, I am losing confidence day by day, my mind calling it out and thinking to get a swe role.

How do I get a job in cryptography with a btech.

I really need you advice, if your company hires grad with some knowledge and willing to put in efforts please let me know. Thanks guys.


r/cryptography • • 1d ago

How does asymmetric cryptography REALLY WORK?

0 Upvotes

Like I get that the public key can't be reversed to show a private key and the mathematical relation between private and public keys but like how does it work in detail? How are the keys generated? How is the public key generated from the private key and why almost can't we reverse it?


r/cryptography • • 2d ago

What the AlphaProof Code proofs of Signal assume and leave out: a visual walkthrough.

Thumbnail
sheets.works
2 Upvotes

r/cryptography • • 2d ago

Visualizing GF(2^8) in AES: How do you usually explain the jump from polynomials to xtime (0x1b)?

5 Upvotes

I've been putting together an interactive visual guide on Galois Fields for AES, and the hardest part to explain cleanly is the transition from abstract polynomial arithmetic over GF(2) to the actual byte-level xtime (0x11b -> 0x1b) shift-and-XOR implementation.

Most resources either gloss over why 0x11b is irreducible or dump ring axioms before showing how MixColumns and the S-Box actually use the field structure.

For those who teach or implement cryptography: what mental model clicked best for you when connecting polynomial reduction to byte-level AES round operations?


r/cryptography • • 3d ago

Linear cryptanalysis lectures

45 Upvotes

I just wanted to let you all know that COSIC published a series of recorded lectures by Tim Beyne and Vincent Rijmen based on their book on linear cryptanalysis:

https://youtube.com/playlist?list=PLb8djaPEg5m4&si=YjtaH6kIoCsVKQ-x

Definitely worth checking if you enjoy symmetric cryptography cryptanalysis.


r/cryptography • • 4d ago

Detecting split views between small transparency logs when witnesses can only be reached by courier

1 Upvotes

I am sketching a design for a federation of small, independent append-only logs, one per community, where each log's signed tree head is cosigned by neighbouring logs whenever someone physically travels between them. Links between the communities are intermittent, and some are down for weeks. The records are access receipts and contain no personal data, which stays encrypted off the log under a key only its subject holds.

My worry is split views. If a log operator shows one tree to the neighbour on the left and a different one to the neighbour on the right, how long can that survive when cosigning happens in occasional bursts rather than continuously? I understand how gossip among auditors handles this in the CT ecosystem, but I do not know how the guarantees degrade when the gossip is hand-carried and the gaps are days or weeks. Is there a standard way to bound the window in which a lie could go unnoticed, and what would you put in each checkpoint to make comparison cheap for a courier carrying very little?

A second problem is key loss. If the data subject dies or loses their key, the file becomes unreadable and, in my design, nobody can be notified of accesses to it. Social recovery with threshold shares seems the obvious answer, but it also gives a handful of shard holders a quiet power over the dead. Does anyone have experience with recovery schemes where the shard holders themselves must be public and logged, and what goes wrong in practice?

I am doing this for a fictional world I am building at r/TheGreatFederation, but I want the cryptography to be honest, so please be as unkind to the design as it deserves.


r/cryptography • • 5d ago

Statistical audit of an electronic roulette draw series — interpreting daytime vs night biases

5 Upvotes

I'm doing a statistical audit of the public draw history of an electronic roulette lottery game (Ruleta Express, Dominican Republic). Looking for advice on randomness-quality tests and how to interpret structured biases — not gambling advice, and I'm not asking anyone to bet.

Game shape (public): • 19 pockets, numbers 0–18. Draw about every 5 minutes. Pays 18×. • Historic operator was Intralot/LOTOS until ~2020; current RNG implementation is not public.

Observed patterns in the history: • Daytime window (~07:38–19:59): very strong anti-repetition — a number almost never repeats the previous draw (~0%). • Late night: repeats around ~5% (closer to uniform independent draws). • "0" appears roughly ~10% less often than a fair 1/19 would predict, across the day.

What I already checked (no credible match): • Classic daily-seeded 32-bit PRNGs against the series: MSVC/ANSI rand, glibc rand(), Java LCG, .NET Framework LCG, MT19937.

Questions for people who audit RNG / randomness quality:

  1. Does a daytime anti-repetition rule layered on top of an otherwise uniform generator fit this better than a single biased generator? How would you separate those hypotheses statistically?

  2. Sensible next randomness tests on a categorical 0–18 series: PractRand / TestU01 (after a suitable encoding), chi-square / runs / autocorrelation, spectral / period checks, or something else cheap?

  3. For lottery-style electronic draws, are scheduled rule layers (different daytime vs night behavior) common in certified systems, or more often a symptom of a non-certified path?

  4. Any references on auditing short discrete alphabets (19 symbols) rather than bitstreams?

Happy to share anonymized summary stats. Again: analysis / audit only — please don't bet on this.


r/cryptography • • 6d ago

ChaCha AVX-512 optimization for Linux 7.5 yields up to 99% improvement on AMD Zen 5

Thumbnail
phoronix.com
27 Upvotes

r/cryptography • • 5d ago

Can AI crack a one-time pad?

0 Upvotes

I don't give a f if it says it can.

Is mine a technically stupid question, I don't know!


r/cryptography • • 6d ago

anonymus gruop sign

3 Upvotes

is there any cryptographic algorithms(preferably post quantum) where theres these functions

gena(seed)->ask,apk
genu(seed)->usk,upk
asign(ask,upk)->asgn
usign(usk,data,asgn)->usgn
verify(usgn,data,apk)->valid
check(usgn,usgn,data)->bool

and no one(at least before heat death of universe) can get upk/usk from usgn and ask from apk

and verify checks if upk used to make usgn is signed by selected authority and is signing that specific data

and check checks if 2 usgn are made by same upk but only works for same data,if 2 usgns are from diferend data it wont work


r/cryptography • • 6d ago

Are Diffie hellman and rsa irrelevant to cryptography mathematically, theoretically, and experimentally in the post quantum age? Will they be replaced?

0 Upvotes

r/cryptography • • 7d ago

Use cases for message or file encryption?

0 Upvotes

I've been thinking about use cases that my friends and I could do with RSA encryption or one-time pads because I haven't really found anything unless you're super worried about people like Apple or Google snooping or sending illegal or illicit data or information. I've really just been doing fun tests or, "Hey, use my public key, bro!" Any insight would be nice for fun things to do with encryption besides the obvious.


r/cryptography • • 9d ago

Google DeepMind says AI agents found two weaknesses in legacy 1024-bit RSA

Thumbnail
runtimewire.com
113 Upvotes

r/cryptography • • 9d ago

Best books to learn cryptography as a complete beginner?

40 Upvotes

Hey everyone!

I'm interested in learning cryptography, but I'm still a complete beginner in this field.

I'd like to build a solid foundation and gradually move on to more advanced concepts.

What books would you recommend for someone starting from scratch?

I'm particularly interested in understanding the fundamentals, including encryption, decryption, symmetric and asymmetric cryptography, hashing, and public-key cryptography.

Also, would you recommend learning some mathematics or programming (Python) before diving into cryptography?

I'd appreciate any book recommendations, learning resources, or personal experiences.

Thanks in advance!


r/cryptography • • 9d ago

Is the HNDL ("Harvest Now, Decrypt Later") strategy kind of useless?

0 Upvotes

Because we know that most encryptions are done using AES, and we also know that AES is far far farr from ever being broken or brute-forced, no matter how much technology advances


r/cryptography • • 10d ago

Is it realistic to aspire for a career in cryptography without a PhD?

20 Upvotes

Good day everyone, and thank you for your time.

I would like to keep this simple - I am from India and currently in my mid 30s working a dead end procurement job, I am aspiring for a career switch especially to a profile that is mathematically rigorous and interesting. Cryptography kind of fits that bill from the limited exposure that I have received.

However, it will be much better if I'll get insights from folks who are in the field and have got their hands dirty in the real world. Please go ahead and guide me if I can get my foot in by working on side-projects or am I being delusional here?

Your honest feedback will be appreciated!


r/cryptography • • 12d ago

SRP-6a gotcha: tssrp6a drops a leading 0x00 byte from the salt, swift-srp doesn't

8 Upvotes

Ran into this one while wiring up SRP-6a between an iOS app (swift-srp 2.4.0) and a Node server (tssrp6a), and figured I'd share it in case it saves someone a few hours.

I ran the same fixed inputs through both libraries and compared everything. x, A, u, S and the proofs all matched byte for byte, except when the salt started with a 0x00 byte. Then x came out completely different and every login failed, even with the right password.

What's going on: tssrp6a pushes the salt through a JS bigint, and bigint.toString(16) never keeps leading zeros, so the 0x00 just disappears inside computeX. swift-srp hashes the literal bytes it's given. Both are doing what they're built to do, they just don't agree on that one detail.

It only hits about 1 in 256 random salts, so in the real world it would show up as a rare login failure that you can't reproduce on demand. That's the part that would've driven me nuts.

My fix was to strip the leading zero bytes from the salt on the Swift side before any SRP math. I also added a test with a fixed salt that starts with 0x00 so it can't sneak back in.

Happy to share the test vectors if anyone wants them. Has anyone else run into this with other SRP library pairs?


r/cryptography • • 13d ago

could the roots of polynomials be used as encryption?

30 Upvotes

My idea is, you have a 5th degree polynomial as shared secret. To encrypt data, Alice encodes a part of it as a number, turns it into a root in the form (x - root) and multiplies the root with the secret polynomial. She does that 4 times. Alice then sends the final polynomial of degree 9 to Bob. Bob then divides the polynomial Alice send him by the shared secret. He gets a 4th degree poylnomial and uses rhe quartic formula to find the roots, by that retrieving the data Alice send him. If Eve intercepts the message, she only has a 9th degree polynomial, for which the roots cant be calculated.

I am very new to the field of cryptography, so I am fairly certain I missed some things. I would really appreciate the opinion of you. Thanks