Bruce Schneier · Second edition (1996) · 25 chapters
Historical and protocol reading. This route explores the book’s earlier constructions and enduring protocol ideas. Use current standards and implementation guidance when choosing cryptography for new systems.
New readers can begin with Understanding Cryptography (2024), then choose Katz–Lindell for formal foundations or Boneh–Shoup for graduate study.
25 chapter connections
0 of 25 explored · This browser only.
Chapter 1 · Foundations
Try this: Reuse a one-time pad, then inspect what the two ciphertexts reveal together.
Coverage boundary: Selected foundations; historical ciphers are not recommendations for protecting current data.
Chapter 2 · Protocols
Try this: Change one signed byte. Separate the hash comparison from signature verification.
Coverage boundary: Covers selected primitives; composing them into a secure protocol needs additional analysis.
Chapter 3 · Protocols
Try this: Intercept an unauthenticated key exchange, then compare key agreement with authentication.
Coverage boundary: A shared secret does not by itself identify the peer. The formal checker explores its stated model.
Chapter 4 · Protocols
Try this: Commit to a bit, then compare a forged opening, a leaked nonce and a withheld reveal.
Coverage boundary: Sections 4.1, 4.2, 4.9–4.13 have different coverage depths. Mental Poker introduces committed shuffling; full private dealing is outside that game.
Chapter 5 · Protocols
Try this: Trade a message for a receipt. Stop after the first direct delivery, then compare the intermediary-assisted run.
Coverage boundary: IBE Gate uses a later Boneh–Franklin construction. OT Gate is a simplified Chou–Orlandi illustration. The exchange workshop models an ideal intermediary, not a full optimistic protocol.
Chapter 6 · Protocols
Try this: Trace what each party learns in a private computation and compare it with the final output.
Coverage boundary: Modern counterparts to selected voting, multiparty-computation and anonymous-communication themes; no claim of complete election-system security.
Chapter 7 · Techniques
Try this: Increase the shortened hash width and compare observed collision work with its birthday model. In Log Forge, compare field and curve cost discussions before exploring the later migration scenarios.
Coverage boundary: Direct connections to birthday costs and public-key strength; the SHA-256, current key-length tables and post-quantum tools are later examples. Browser timings are not production-key break estimates. Quantum timelines are scenarios, not forecasts.
Chapter 8 · Techniques
Try this: Rotate, re-encrypt, then discard the old local key. Test the attacker’s archived copy again.
Coverage boundary: Guided decisions connect generation, transfer, use, backup, compromise and destruction. The incident experiment is real local AES-GCM, not an operational key-management service.
Chapter 9 · Techniques
Try this: Reuse a nonce and compare what ordinary GCM and a misuse-resistant construction expose.
Coverage boundary: Selected modes and modern authenticated-encryption comparisons; old confidentiality-only modes are shown in context.
Chapter 10 · Techniques
Try this: Compress a chosen guess beside a secret and measure the encrypted length. Then separate the compression contexts.
Coverage boundary: Strong coverage of composition and length leakage. Hardware selection, ciphertext detection and media sanitization are not fully covered by these exhibits.
Chapter 11 · Algorithms
Try this: Begin with Clock Arithmetic: step a modular inverse, compare powers and orders, and recombine 1 modulo 6 with 3 modulo 8. Check the CRT substitutions and combined modulus. In Prime Witness, compare Fermat and Miller–Rabin on 561; in Log Forge, recover a small finite-field exponent and verify it by exponentiation.
Coverage boundary: Direct connections to modular arithmetic, Euclid, CRT, prime generation and discrete logarithms. Clock Arithmetic extends the coprime CRT example to compatible noncoprime moduli. The small DH search is not a discrete-log solver, and probable-prime evidence is not a certificate. The FIPS-shape panel is a later extension; selected experiments do not cover the entire mathematical chapter.
Chapter 12 · Algorithms
Try this: Compare a differential observation with a linear bias and identify the data each attack needs.
Coverage boundary: Educational parameters and selected attack paths; consult each exhibit for round counts and implemented scope.
Chapter 13 · Algorithms
Try this: Pick a historical design and identify its block size, key size and present-day status.
Coverage boundary: The museum and linked labs cover a selection, not every algorithm named in this chapter.
Chapter 14 · Algorithms
Try this: Compare a historical design with a later cipher and separate design structure from security claims.
Coverage boundary: A historical bridge plus later counterparts; neither link reproduces the complete chapter.
Chapter 15 · Algorithms
Try this: Name the separate security goal of each component before combining them.
Coverage boundary: Composition principles are related, but hybrid KEMs are not the book’s double/triple block-encryption constructions. Dedicated cascade coverage remains a gap.
Chapter 16 · Algorithms
Try this: Recover structure from a linear generator and compare a real protocol’s misuse of a stream cipher.
Coverage boundary: Selected stream-generator mechanisms and failures; many historical generators are outside these labs.
Chapter 17 · Algorithms
Try this: Compare statistically plausible output with a generator whose internal state is exposed.
Coverage boundary: Modern generator practice and a historical backdoor example. Passing statistical tests is not a security proof.
Chapter 18 · Algorithms
Try this: Find two inputs with the same shortened digest, then transfer a tag between the meaningful letters. Verify that the full digests differ and that a modified tag fails.
Coverage boundary: The deliberately shortened SHA-256 example and rainbow chains are later teaching counterparts. The forgery breaks an insecure hash-then-MAC composition, not full SHA-256 or HMAC; historical hash coverage remains selective.
Chapter 19 · Algorithms
Try this: In Residue Gate, compare Rabin’s four roots and its canonical decryption rule, then use the root oracle to seek factors and check their product. Compare that oracle contract with a padded construction.
Coverage boundary: The Rabin connection covers selected square-root constructions and a chosen-ciphertext reduction. The one-bit variant has a separate scope; successful decryption is not CCA security. Log Forge’s Pohlig–Hellman is a discrete-log solver, not the identically named encryption scheme in this chapter.
Chapter 20 · Algorithms
Try this: Reuse a signing nonce where the lab permits it and observe what becomes recoverable.
Coverage boundary: Later elliptic-curve counterparts to signature themes; these are not implementations of every historical algorithm in the chapter.
Chapter 21 · Algorithms
Try this: Identify the commitment, challenge and response in a Schnorr proof, then compare a signature transcript.
Coverage boundary: Selected identification and proof-to-signature ideas. Interactive proofs and Fiat–Shamir transformations have different assumptions.
Chapter 22 · Algorithms
Try this: Compare an unauthenticated exchange with a password-authenticated or identity-authenticated flow.
Coverage boundary: Includes later protocol families; agreement on bits alone does not authenticate the peer.
Chapter 23 · Algorithms
Try this: For probabilistic encryption, encrypt the same bit twice in Residue Gate and compare the ciphertexts, then try its algebraic bit flip. For ANDOS, privately choose one message and test why the same receiver key cannot open the other.
Coverage boundary: Goldwasser–Micali is a direct probabilistic-encryption connection; several other linked constructions are later counterparts. Randomized ciphertexts do not imply integrity. ANDOS concerns private selection among secrets, distinct from all-or-nothing transforms and exchanging both parties’ secrets.
Chapter 24 · Systems
Try this: Trace an authentication ticket or certificate chain and name the authority each step trusts.
Coverage boundary: Selected systems and trust models. Clipper and Capstone do not yet have a dedicated historical walkthrough here.
Chapter 25 · Systems
Try this: Compare deliberate key-space reduction, a generator backdoor and a key-escrow authority. Who gains power in each design?
Coverage boundary: Technical case studies support the discussion. A full crypto-wars timeline and current legal guidance are outside this path.
No chapters match. Clear the filters or try a broader term.
Pick a chapter, make a prediction, then change something and inspect the result. You do not need to read the book in order to use this path.
Independent and unaffiliated with the author or publisher. These original exercises link to the book’s topics; they do not reproduce its text or imply endorsement. Chapter connections were reviewed on 20 October 2026.
Optional checkmarks record exploration, not mastery. They stay in this browser when local storage is available.
Direct coverage A linked experiment addresses a selected chapter concept. It does not promise complete chapter coverage.
Modern counterpart A later construction explores a related goal; the implementation differs from the book.
Introductory coverage Builds intuition or offers a partial bridge. Read the boundary before treating it as a protocol implementation.
Start with the author’s official table of contents. Follow each exhibit’s sources and implementation limits. Historical coverage is not current deployment advice, and a passing experiment is not a security proof.
The Cipher Museum supplies additional historical context. For a deeper modern path, continue to post-quantum cryptography.