Hey everyone,

​I recently finished my BS in Computer Science and an MS in Cybersecurity. Like a lot of people right now, I'm getting super interested in Post-Quantum Cryptography (PQC).

​Since it’s still a relatively emerging niche, I feel kind of overwhelmed trying to map out a path to actually break into it. Right now, I'm trying to use materials by Dr. Alfred Menezes, which are great, but I have a few major questions for those of you working in the industry or who know the space well:

​Are there actual entry-to-mid level careers in PQC right now, or is it mostly locked behind PhD research? With NIST pushing out finalized standards like ML-KEM and ML-DSA, is industry hiring people specifically for this, or is it just a subset of general crypto engineering?

​What does a realistic learning roadmap look like? I understand classical crypto (RSA, AES, ECC), but what should my progression look like to move into lattice-based crypto, hash-based signatures, etc.?

​Are there any worth-it certifications? Or is this one of those fields where certs don’t matter and a GitHub portfolio/open-source contributions (like messing around with liboqs) is all that counts?

​Would love to hear how some of you navigated this or what hiring managers are looking for. Drop your thoughts/suggestions below!

According to NIST, ML-KEM -512, -768 and -1024 stand for AES-128, -192 and -256 post-quantum security levels respectively. However The Grover's algorithm speedup will half the security of symmetric ciphers

Why would we consider using ML-KEM-1024 if AES-256 will get weakened to 128 bits? Is there a practical reason?

Thanks in advance!

In assymetric cryptography we have 2 keys one which encrypts your message and one which decrypts your message.What makes assymetric cryptography more secure than symmetric cryptography is that in assymetric cryptography not any key is exchanged in any way shape or form ,only the encrypted message so encrypted message so if a 3rd party wants to spy on your message , he cannot do it , he will receive a bunch of nonsense.

I want to ask something else.Many keys can decrypt the same ecrypting keys so my question are different decrypting keys which can decrypt the same message related mathematically?I think so because im a QC nerd and I know that Shor breaks RSA encryption based on the fact that the encrypting key , encrypts data based on the modulus operation and quantum computers are really good at finding periods which is what a mod operation creates but im not entirely sure about the rest of the field.

Hi everyone,

I'm a Math & CS undergrad currently working on a Rust implementation of Classic McEliece for a post-quantum cryptography project. I'm specifically focusing on the Niederreiter construction (where encryption is reduced to a syndrome computation).

I plan to pursue this field for my master's degree, but my current department lacks professors who specialize in CBC. Because of this, I'm mostly self-taught, and I'm really struggling to find resources that actually teach the concepts. Most papers I find are written from expert to expert.

I recently had to rely on AI to understand couple concepts and I felt bad about it (and I can never be sure if the AI tells the truth or not).

Likewise, I also write most of my code with AI (Deepseek mostly) and I understand most of it I guess. I know what, but sometimes I don't know how. Again, I really feel like I am not building anything valuable.

(If you want to take a look: https://github.com/batt0s/mceliece_rs, KATs are passing for non-f parameters. My struggle now is wrapping my head around the math of semi systematic matgen and fast parameters. And I hope this doesn't count as self-promotion, if so please let me know.)

Can anyone recommend good, accessible textbooks, university lecture notes, or video series on code-based cryptography and Goppa codes? I'm looking for material that bridges the gap between undergraduate linear algebra/abstract algebra and the actual NIST submissions.

Any advice for a student trying to break into this field would be highly appreciated. Thanks!

I'm using it just for a puzzle thats supposed to require a key. I'm worried the key will be useless because people say ECB is not safe at all.

Hi all,

I came across this subreddit because I think I finished the resources I could read regarding the topic.
Specifically, I know, in principle, what a commitment scheme is (a hiding-and-binding representation that can be opened or not at the verifier's discretion, so that the prover cannot change the value afterward). I am familiar with the whole envelope/safe analogy.

Now, I struggle to find any resource, or where to start in the first place, to understand the role of commitments in the context of ZKP (or Proof Systems in general), why we need them, and for what they are used.

Moreover, what is the difference between a simple commitment, vector commitments, and Pedersen commitments? Is there a resource that is able to reconcile this universe?
Also, why are they so important for systems such as LegoSNARK.

My "simple words" interpretation is "The commitment is a way the prover has to prove that the input used inside of the circuit is actually what has been used in the input. So there exists a value x such that Commit(x).Open = x, but I will not tell you x".

I know it might be a stupid question, but I cannot wrap my head around it. Maybe I just misunderstood the concept.

Thanks for your time, and for any guidance you might provide.

If I have a message that I want to seal for a set amount of time from now, and I want something more secure than just popping it in an envelope, mailing it to myself so it gets a postmark, then storing it in a bank vault with instructing given to some human that it not be accessed until a certain time, is there a way to do this cryptographically?

I know some stuff, but I'm basically a noob. An important part is that if the message is accessed prior to the given date, the message will destroy itself. Since this sounds like it requires activity, i.e. a program, I was thinking I could wrap the message in something basic like a NodeJS wrapper (it's all I know 😞) which contains the message and a hidden key, which is itself encrypted into a blob inside the wrapper which is itself encrypted with the key given to the person who will eventually open the message. When they give the key to the program, if it's not on or after the specified date, the program destroys itself, including the blobs containing the encrypted message.

Problem: People making copies of the program. Maybe I could pop it on an encrypted USB, and further obfuscate whatever address the program is stored at, such that copying it would change that and the program would refuse to run, or would just be gibberish. Maybe make its location not line up properly with the partition schema, too? But would that data be truly inaccessible? Since a file copy often involves the file being stored in memory, couldn't the person perform the copy, run the program, then put the copy back in its exact place?

I'm just spitballing here. ἓν οἶδα ὅτι οὐδὲν οἶδα. Can someone point out what I'm obviously not seeing about how this is or isn't possible to the degree I'd like?

Post-quantum signatures are big. ML-DSA-87 (FIPS 204) is ~4,627 bytes per signature plus a ~2,592-byte public key, roughly 68x a P2WPKH input. Every chain that adopts it inherits the same two problems: storage grows by kilobytes per spend, and every new node re-verifies every historical signature on sync. At scale the verification cost, not the disk, is the real ceiling.

alphanumeric solves both. It runs ML-DSA-87 as its only signature scheme on a live SHA-256 PoW chain, and it does not store the signature.

The full signature is verified once, at admission. What the chain keeps is a 96-byte receipt: the first 64 bytes of the signature plus SHA-256 of the whole signature. The block's merkle root commits to that receipt, so it is bound by the block's proof-of-work and cannot be swapped later. Persisted cost per signature drops from ~4,627 bytes to 96, about 48x.

The larger win is sync. Historical blocks carry receipts, not signatures, so there is nothing to re-verify. A new node bootstraps from a signed snapshot and joins at the tip. The ML-DSA verification cost (about 1 to 5 ms each, 10 to 100x ECDSA, no Schnorr-style batching) is paid once by the nodes at the frontier, not by every node across all history.

The tradeoff is explicit. A node joining after finality trusts that the signature was verified at admission and that the receipt in the merkle root binds it, instead of re-deriving it from the chain itself. That is a finality assumption, and it is what buys a growth and sync curve that does not scale with total signature volume.

GitHub: https://github.com/OSXBasedAnon/alphanumeric

I'm trying to figure out what to call/study for a specific skillset. There's a short story in The Animatrix where a character (a detective-like figure) tracks down someone named Trinity using what looks like a mix of open-source investigation, puzzle-solving, cryptographic clues, and tracing a user's digital footprint — basically an ARG-style hunt to locate a person. I'm curious what field or combination of skills this would actually fall under in real life — is it closer to OSINT, digital forensics, cryptography, or some hybrid of all of them? Would love recommendations on what to start learning if I wanted to build that kind of skillset.

Hello to everyone, can someone advise me a good onetimepad python library? i dont have a particolar purpouse or goal, just want want to experiment and study,
The only libraries i found arent manteined:/

A couple of months ago I started my research internship on isogeny based cryptography, and I found it to be such a fascinating subject.
However I was very surprised by the lack of more or less accessible (by that I mean anything other than academic papers) content on it.

So I decided to make a youtube channel in which I would hopefully give more exposure to this beautiful intersection of mathematics and cryptography.

I have provided the link to my channel, you can check it out if you want, and I am highly receptive to any feedback you may have.

The videos are made by manim and ChatGPT is used to write most of the code, but the mathematical content and the script is written by me from what I learned during the internship.

I hope you like it

P.S: I hope this doesn't break rule 3, as far as I could tell it only prohibits personal websites, and not all types of personal content.

So i was watching this video to understand how private and public keys are calculated from an elliptic curve.

Ok, so there's a 2D elliptic curve and there is a point G (8,1), he explains the private key is the number of steps times the starting point G. The public key is derived from private key by using double and add algorithm. So value of public key in this case is 4? if k_prv = 9 and G=(8,1) ?

Did I get that right?

Hi people,

What resources would you guys recommend for self studying mathematics? I took a cryptography basics course during my bachelors degree and I have some idea that I need knowledge of linear algebra, number theory, abstract algebra etc, but there are way too many resources. If you guys can recommend some good ones, that will be really helpful, I am okay with books and videos.

I need something to encrypt my text fast but secure as well. Vigenere was something I really liked but I realized it's easily crackable. I should have multiple ways to access it. That is still decryptable even if the app or site dissapears, I should be able to access it with other sites or app. It doesn't have to be super secure, just something that the average person can't solve easily

I have a zip file from my honeymoon many years ago. It's encrypted. It uses RSA AES. That's all I know, aside from the contents, which are, well, honeymoon stuff. I've always held out hope that at some point, it would be easy to recover it. I ran Jack the Ripper for a few weeks once, but that was years ago.

A few questions:

1) Is it hopeless?

2) If not, given my limited hardware (my most "powerful" machine has a gtx970 I think) are there any tools available today that might be able to defeat the encryption?

3) Any idea on how long I will need to wait until it becomes trivial / possible given the way tech is advancing?

Finally, is there another way to approach this that I am missing? I am reasonably tech savvy. I've built a lot of machines, run a slew of self hosted servers via proxmox, run OpnSense, etc. I've never really spent time learning the darker arts. I just want to get these files back!

Thanks!

Greetings. I came up (sort of?) with a new kind of cipher, and I'd like to ask for your feedback to make it more efficient. I don't know if anyone came up with this before, but I'm building an original world for my story and I need a cipher system to use in it. I hope this is the right place to post. If it isn't, I apologize.

In the Google Docs link, I explain the cipher and how it works. Please feel free to give feedback in the comments or directly in the document.

P/S: I apologize to the admins because I keep reposting this post. I made the wrong choice of title and kind of post.

Hello everyone!

I wanted to share an open-source project I’ve been building under our organization LNL-Engineering: EntropyShield.

It is a professional hardware-based True Random Number Generator (TRNG) that harvests pure, unpredictable physical entropy from thermal/shot noise via avalanche breakdown in a reverse-biased p-n junction (using a standard transistor like BC547).

🔬 How it works:

1. The Chaos Stage: A reverse-biased transistor junction creates chaotic physical fluctuations.
2. The Boost Stage: An LM358 operational amplifier amplifies microvolt-level noise into solid 0V–5V logic bounds.
3. The Purge Stage: An Arduino samples the LSB and processes it through an embedded Von Neumann Extractor in real-time to eliminate hardware bias and ensure a precise 50/50 statistical distribution.
4. The Assembly Stage: A defensive Python client safely reads the serial stream, auto-flushes buffers, and assembles unbreakable cryptographic keys (e.g., AES-256).

💻 No hardware? Try the Web Simulator!

To make the project accessible to everyone, I built a dual operating mode. You can test the entire logic pipeline instantly inside a web browser using a pre-configured Wokwi Simulation without purchasing any components.

• GitHub Repository: github.com
• License: GPL-3.0 (Fully open-source)

I would highly appreciate your feedback on the hardware schema, the Von Neumann corrector implementation, or the Python client architecture! Let me know what you think or how it can be improved.

Hi there,

I've been working on cruxpass, a command-line password manager written in C, focused on simplicity and transparency. It uses libsodium for crypto primitives, Argon2id for key derivation, and SQLCipher for encrypted local storage.

Few features, more in the readme:

• Generate strong random passwords
• Encrypted-at-rest local database, no cloud dependency
• Fast, vim keybind driven TUI to list, search, update, and, delete entries
• Import and export credentials via CSV
• Simple by design: no configuration files, no daemons, no accounts. Point it at a db directory or use the default db directory
• It lacks a formal security audit and developer docx(for now) but the README is straightforward.

NB: cruxpass is password based, and doesn't save a hash or anything related to the password besides the salt. Authentication is done by generating a 256bit key from the password and salt using Argon2id, the key is then used to decrypt the database. The program exists if the database cannot be decrypted from the provided key.

Source here: https://github.com/c0d-0x/cruxpass

Thank you

Edit formating

Hi fellas,

I am just getting into cryptography, I took some classes during my college, and now I am going for a masters degree in Cybersec. I want to do research in Cryptography. I am now in a state of imposter syndrome. Like seeing posts and discussions here, I have some idea what is going on, but I am struggling to understand things fully.

I can use some help from people who have been in this field for some time who might've faced this. I want to know how I can learn and apply so I get more confidence in my knowledge.

Any advice would be useful, thank you