Connect practical constructions to their security arguments. Read, predict an outcome, test it in a lab, then return to the assumptions and proof.
This draft has gaps: Chapters 1 and 17 are absent from the body, and §§20.5–20.7 are unfinished. Related activities are explicitly scoped below.
Find your chapter
23 chapter connections
0 of 23 explored · This browser only.
Chapter 1 · Introduction
Introduction
Supplementary exploration
Draft gap: the PDF’s contents are followed by the Part I divider on printed page 3. The introductory pages 1–2 are absent.
Learning focus: Describe the attacker before judging the cipher
Read: The contents list §§1.1–1.2, but the chapter body is absent in version 0.6. Use these labs as an optional orientation before Chapter 2. · See the contents (PDF)
Predict before opening a lab: Which patterns might survive encryption under a short repeating key?
Preview a challenger, an attacker and a precisely defined success condition.
Try this: Try a supplied Vigenère challenge. Write down what the attacker knows before the attack and what the recovered key lets the attacker do. Then inspect a security game in Hidden Bit.
Explain the result: How would you turn “this looks scrambled” into a claim someone could try to falsify?
Coverage boundary: These labs provide an independent orientation to the topics reserved in the contents. Hidden Bit previews later security definitions. A classical attack is not evidence about a modern cipher, and this entry is not a substitute for an absent chapter.
Chapter 2 · Secret key cryptography
Encryption
Direct connection
Learning focus: Separate perfect secrecy from computational evidence
Connect the bit-guessing viewpoint to executable distinguishing experiments.
Try this: In OTP Vault, keep a ciphertext fixed and compare keys consistent with two candidate messages. Reuse a pad for two messages and inspect the ciphertext XOR. State exactly which assumption changed.
Explain the result: What does a probability statement about every possible message require that a finite set of successful encryptions cannot establish?
Coverage boundary: Perfect secrecy requires a uniformly random, independent secret pad of sufficient length used once. Browser-generated bytes illustrate the arithmetic without certifying physical randomness. The pad alone does not authenticate messages; Hidden Bit is a bridge to computational games, not a proof of perfect secrecy.
Chapter 3 · Secret key cryptography
Stream ciphers
Direct connection
Learning focus: Watch repeated keystream cancel out
Distinguish an entropy source from deterministic expansion.
Try this: Run the nonce-reuse experiment in ChaCha20 Stream with two different messages. Compare its XOR relationship with the reused-pad experiment. Explain which inputs must be repeated for the same keystream bytes to recur.
Explain the result: Why can a deterministic generator be useful for encryption without creating new entropy?
Coverage boundary: ChaCha’s computational security is a different claim from information-theoretic OTP secrecy. Statistical appearance cannot prove PRG security. The next-bit theorem, generator-composition reductions and the DVD/RC4 case studies require separate reading.
Chapter 4 · Secret key cryptography
Block ciphers
Direct connection
Learning focus: Distinguish reversible rounds from a secure permutation
Predict before opening a lab: Can an invertible cipher with good-looking mean avalanche still admit recovery from one known pair? Which additional claim would be needed to call it a secure pseudorandom permutation?
Experiment with the PRP/PRF distinction at small teaching sizes.
Try this: Compare a reversible Feistel round with AES Anatomy’s full forward and inverse traces. In AES Anatomy, select AES-128, load the affine-only fixture in act 7 and run the attack. Compare held-out recovery and full-AES control rows before interpreting the avalanche mean. In AES Modes, inspect repeated-block leakage; use Hidden Bit’s collision experiment to return to the PRP/PRF distinction.
Explain the result: Why are invertibility, diffusion, mean avalanche and pseudorandomness different properties? Explain which layer the affine-only experiment removes and why neither successful decryption nor a failed particular attack proves security.
Coverage boundary: AES Anatomy implements full AES-128/192/256, but its ablation attacks target deliberately weakened AES-128 variants. They are not attacks on full AES or proofs in the PRP model. DES is historical; the switching lemma, GGM construction and ideal-cipher reductions remain reading work. The browser implementation is not constant-time or hardened.
Chapter 5 · Secret key cryptography
Chosen Plaintext Attack
Direct connection
Learning focus: Give the adversary an encryption oracle
Predict before opening a lab: Will re-encrypting a candidate message identify a deterministic challenge ciphertext as reliably when encryption uses fresh randomness?
Explore CBC and counter-mode behavior with IV and nonce choices.
Try this: Compare Hidden Bit’s re-encryption strategy on deterministic and randomized fixtures. Then try the chained-IV CBC fixture with the IV-predicting adversary. Record the information each strategy uses.
Explain the result: Does a weak adversary’s near-zero measured advantage say anything about a stronger adversary?
Coverage boundary: Finite trials test these strategies, not all efficient adversaries. CBC’s IV requirements and CTR’s nonce/counter requirements differ. The security reductions and multi-key bounds are not replaced by browser measurements.
Chapter 6 · Secret key cryptography
Message integrity
Direct connection
Learning focus: Ask what a valid tag authenticates
Compare MAC verification and inspect CMAC as a construction for variable-length messages.
Try this: Generate a CMAC tag in MAC Race, change the message while retaining the original tag, and verify again. Compare the key requirement with the HMAC example. Identify which bytes the verifier actually checks.
Explain the result: Why is replaying an authenticated message different from forging a new one?
Coverage boundary: The CMAC connection does not stand in for every CBC-MAC, ECBC, NMAC or PMAC construction and proof. Authentication does not imply confidentiality or replay protection.
Chapter 7 · Secret key cryptography
Message integrity from universal hashing
Direct connection
Learning focus: Expose the algebra behind one-time authentication
Compare Poly1305 and GHASH with keyed MAC constructions.
Try this: Use Poly1305 MAC’s polynomial stepper, then run its key-reuse experiment. Identify the polynomial accumulator and the masking value separately. Explain which secret values the repeated-key experiment holds fixed.
Explain the result: Why is a universal hash family different from an unkeyed collision-resistant hash function?
Coverage boundary: Poly1305 is a concrete related instantiation, not every construction in this chapter. Standalone GHASH is not a complete MAC. Reusing the whole Poly1305 one-time key is the failure being explored; universal-hashing bounds still require the text. Section 7.7 is unfinished in this draft.
Chapter 8 · Secret key cryptography
Message integrity from collision resistant hashing
Direct connection
Learning focus: Match the hash property to the task
Explore binding and hiding as separate commitment goals.
Try this: Hash two nearly identical messages, then verify a Merkle proof before and after changing the leaf. Inspect Commit Gate’s opening checks. For each result, name the property needed rather than saying only “the hash is secure.”
Explain the result: Which attacks concern collisions, preimages, length extension, or a commitment’s hidden value?
Coverage boundary: Avalanche behavior is not evidence of collision resistance. A Merkle proof depends on a trusted root and its encoding. Commitment hiding also needs suitable randomness. The HMAC and random-oracle arguments are reading work; a deployed hash is not literally a random oracle.
Chapter 9 · Secret key cryptography
Authenticated Encryption
Direct connection
Learning focus: Find out when decryption releases information
Explore the failures of RC4-based WEP with synthetic teaching data.
Try this: Recover bytes in Padding Oracle, then compare Protocol Compose’s padding-oracle experiment under MAC-then-encrypt and encrypt-then-MAC. Identify where the observable signal disappears. Compare a tampered GCM ciphertext’s outcome.
Explain the result: Which bytes need authentication, and what must the implementation withhold until verification succeeds?
Coverage boundary: The experiments cover specified attacks and implementations. They do not prove every use of a composition secure. AEAD nonce discipline, associated-data selection and replay handling are separate requirements. WEP is an obsolete case study, not a scheme to deploy.
Chapter 10 · Public key cryptography
Public key tools
Direct connection
Learning focus: Agree on bits without assuming an identity
Predict before opening a lab: If Euler’s theorem holds for a base modulo a prime, must that base generate a large subgroup? If Alice and Bob agree on a value, have they authenticated one another?
Replace public contributions in unauthenticated Diffie–Hellman.
Try this: Start in Clock Arithmetic with the whole-group, prime-order-subgroup and order-two examples modulo 23. Compare the computed orders, possible-secret counts and guesses actually used. Step a modular inverse before using Educational RSA’s key calculation. Then complete an honest exchange and enable the middle party in DH MITM; record who knows each resulting secret.
Explain the result: Separate an arithmetic precondition, a cryptographic hardness assumption and a mechanism that authenticates a peer. Why can all the toy theorem checks pass while the shared-secret space remains too small?
Coverage boundary: Clock Arithmetic is preparation in bounded integer arithmetic and a small finite-field DH model, not a production group or a discrete-log solver. DL, CDH and DDH remain different assumptions. A useful prime-order subgroup need not be the entire multiplicative group, and agreement alone does not establish peer identity.
Chapter 11 · Public key cryptography
Public key encryption
Direct connection
Learning focus: Recognize useful randomness and dangerous malleability
Explore private choice using a Chou–Orlandi teaching adaptation, a different OT construction.
Try this: Encrypt the same message twice in ElGamal Plain and compare the results. Apply its multiplicative ciphertext transformation and inspect the changed plaintext. In OT Gate, follow the selected and unselected message paths.
Explain the result: Why does encryption randomness help confidentiality while leaving integrity unresolved?
Coverage boundary: Plain ElGamal’s algebraic flexibility does not give CCA security. OT Gate is not the chapter’s exact protocol and carries its own KDF and point-validation limits. Both simulated parties and their secrets are visible in one browser.
Chapter 12 · Public key cryptography
Chosen ciphertext secure public key encryption
Direct connection
Learning focus: Challenge the scheme through related ciphertexts
Connect public-key encryption to a practical hybrid message-encryption workflow.
Try this: Run Hidden Bit’s CCA2 oracle game. Find the refusal of the exact challenge, then the related-ciphertext query. Compare the supplied RSA-OAEP experiment and explain the different outcome.
Explain the result: What must a reduction establish beyond the failure of this particular ciphertext modification?
Coverage boundary: Rejecting a test attack does not prove CCA security. The labs do not implement every Cramer–Shoup or generic-transform argument in this chapter. Public-key-plus-symmetric hybrid encryption is distinct from combining classical and post-quantum algorithms.
Chapter 13 · Public key cryptography
Digital signatures
Direct connection
Learning focus: Connect signature verification to a trusted key
Follow certificate verification to a configured trust anchor.
Try this: Sign a message, alter it and verify again in RSA Forge. Then trace a certificate chain in PKI Chain. State which checks concern the signature bytes and which concern trust in the signing key.
Explain the result: Why does accepting a signature under an attacker-selected key fail to identify the intended sender?
Coverage boundary: The signature proofs and their oracle models remain essential reading. A certificate walkthrough is not complete browser PKI validation. Signcryption and legal questions are outside this activity; §13.10 is unfinished in version 0.6.
Chapter 14 · Public key cryptography
Fast hash-based signatures
Modern counterpart
Learning focus: Treat one-time signing state as part of the key
Build intuition for authenticating one leaf under a public tree root.
Try this: Sign with successive leaves in LMS Ledger and inspect the state grid. Run its one-time-key reuse experiment. Explain why restoring old signing state differs from merely exhausting a tree.
Explain the result: What information must survive backups, crashes and concurrent signing to prevent reuse?
Coverage boundary: LMS is a related practical construction, not a verbatim implementation of the chapter’s Lamport framework. LMS Ledger’s HSS teaching transcript and small parameters are non-interoperable adaptations. A standalone Merkle membership proof is not a complete signature scheme.
Chapter 15 · Public key cryptography
Elliptic curve cryptography and pairings
Direct connection
Learning focus: Use a pairing, then inspect who holds the master secret
Run Boneh–Franklin BasicIdent and inspect its key-escrow consequence.
Try this: Begin with a small curve calculation. In Pairing Gate, compare a single BLS signature with aggregation. Then encrypt to an identity in IBE Gate, extract its key and inspect the authority’s escrow capability.
Explain the result: Which new capability does a pairing add, and which trust obligation does the identity authority introduce?
Coverage boundary: The BLS12-381 instantiations have concrete group and encoding choices beyond the abstract presentation. IBE Gate demonstrates BasicIdent with a CPA scope, not a CCA-secure FullIdent deployment. Functional encryption, multilinear maps and the full chapter’s proofs are not covered by this route.
Chapter 16 · Public key cryptography
Attacks on number theoretic assumptions
Direct connection
Learning focus: Measure an attack and identify its structural advantage
Explore a small classical simulation of period finding and factoring.
Try this: Compare a smooth-order discrete-log instance with a prime-order one in Log Forge. Verify each recovered exponent. Then compare factoring methods in Factor Forge and identify the period-finding step in Shor.
Explain the result: Which measurements concern the supplied small instance, and which asymptotic claims need a separate analysis?
Coverage boundary: The browser does not factor production RSA keys or run a quantum computer. Log Forge’s finite-field solver is not the general number field sieve and does not apply to its toy curve. Budget exhaustion establishes no hardness result; generic-group bounds apply within their stated model.
Chapter 17 · Public key cryptography
Post-quantum cryptography from lattices
Supplementary exploration
Draft gap: the PDF goes from printed page 711 to the Part III divider on page 714. The contents reserve pages 712–713 for this chapter.
Learning focus: Explore the lattice topics reserved in the draft
Read: Chapter 17 is listed in the contents; its body is absent in version 0.6. These are supplementary lab activities. · See the contents (PDF)
Predict before opening a lab: How can adding small errors turn exact linear equations into a different recovery problem?
Explore standardized ML-DSA as further reading beyond this draft.
Try this: Follow Lattice Gentle’s small-noise examples and compare its toy parameters with a real KEM’s displayed sizes. In Kyber Vault, complete encapsulation and decapsulation; compare that task with signing and verification in Dilithium Seal.
Explain the result: What is the difference between agreeing on key material and signing a message, and what can neither experiment establish about quantum resistance?
Coverage boundary: These labs supplement an absent chapter; they are not implementations of unwritten textbook constructions or proofs. ML-KEM and ML-DSA’s final standards postdate version 0.6. Small lattice puzzles and a successful round trip do not establish the hardness assumptions or reductions for deployed parameters.
Chapter 18 · Protocols
Protocols for identification and login
Direct connection
Learning focus: Separate password storage from a login protocol
Preview challenge-response identification before the formal Sigma-protocol treatment.
Try this: In Bcrypt Forge, compare equal passwords under different salts and increase the cost factor. Inspect the synthetic breach example. Then list the differences between storing a verifier, limiting online attempts and authenticating a session.
Explain the result: Which defense increases the cost of each offline guess, and which defense depends on controlling the online service?
Coverage boundary: Local timings do not predict an attacker’s hardware throughput. A strong password hash does not prevent phishing or bind a login to a secure channel. KDF Arena adds practical counterparts; §18.8 is unfinished in this draft and is not the source of this activity.
Chapter 19 · Protocols
Identification and signatures from Sigma protocols
Direct connection
Learning focus: Follow the commitment, challenge and response
Recover a signing key in the deliberately reused-nonce experiment.
Try this: Run Schnorr identification and then the Fiat–Shamir exhibit in ZK Proof Lab. Identify the public statement and challenge inputs. Compare the altered-message verdict with the displayed challenge values. Then inspect nonce reuse in ECDSA Forge.
Explain the result: Why must the Fiat–Shamir challenge bind the intended statement and context? What is the difference between verifying a transcript and proving knowledge?
Coverage boundary: ZK Proof Lab uses tiny groups and a reduced challenge space: different messages can produce the same toy challenge without a SHA-256 collision. BIP-340 has its own encoding and rules. The labs do not establish the chapter’s extraction, simulation, composition or multi-extractability theorems.
Chapter 20 · Protocols
Proving properties in zero-knowledge
Direct connection
Draft gap: the Bulletproofs, SNARKs and general zero-knowledge sections on printed page 842 are marked unfinished. Their labs below are supplementary exploration.
Learning focus: Identify the statement a proof actually establishes
Explore proof systems and setup assumptions; supplements the unfinished §20.6.
Try this: In Threshold Decrypt, inspect a valid partial-decryption proof, then select a corrupted partial and attempt recovery. Name the public relation checked by the proof. As an optional extension, verify a range proof in Bulletproofs and inspect its tamper verdict.
Explain the result: Which value remains hidden, which claim becomes public, and what assumptions are needed for the verifier to trust that claim?
Coverage boundary: A passing verifier equation does not establish zero knowledge or soundness against every adversary. These are selected constructions with different setup and transcript requirements. Supplementary proof-system labs do not fill in the draft’s missing proofs; they carry their own implementation limits.
Chapter 21 · Protocols
Authenticated Key Exchange
Direct connection
Learning focus: Bind the session key to the intended peer
Connect tickets to key distribution through an online trusted service.
Try this: Contrast DH MITM with the authenticated steps in TLS Handshake. Identify the peer identity, transcript and session-key derivation. In PAKE Gate, compare an honest exchange with a wrong-password attempt.
Explain the result: Which long-term secret compromise could expose a past session, and when does ephemeral key erasure matter?
Coverage boundary: These walkthroughs are not interoperable network deployments or complete proofs of AKE security. Forward secrecy, identity protection and channel binding are different goals. PAKE does not eliminate online guessing; Kerberos introduces trust in a central service.
Chapter 22 · Protocols
Threshold cryptography
Direct connection
Learning focus: Use a shared key without collecting it in one place
Compare threshold decryption with a practical threshold-signing protocol.
Try this: Compare Shamir reconstruction with Threshold Decrypt’s combination of partial decryptions. Include one invalid selected partial and inspect the rejection. In DKG Gate, introduce a bad share and follow the complaint and qualification outcome.
Explain the result: What changes when no trusted dealer is allowed, and which failure can a valid-share check detect?
Coverage boundary: All participants share one browser, so there is no real party isolation. DKG Gate’s bias/fix experiment is not a full GJKR implementation. FROST is a different concrete signing construction. These activities do not establish network robustness, all access structures, gap security or election security.
Chapter 23 · Protocols
Secure multi-party computation
Direct connection
Learning focus: Specify what remains private when parties compute together
Compare arithmetic sharing with authenticated openings and Beaver multiplication.
Try this: Follow a private comparison in Garbled Gate and record what the output reveals. In SPDZ Forge, tamper with a share and compare the semi-honest result with the authenticated opening. Reuse a Beaver triple and inspect the exposed relationship.
Explain the result: How do privacy, correctness, detection with abort and guaranteed output delivery differ?
Coverage boundary: Garbled Gate’s core teaching model is semi-honest. SPDZ Forge uses a trusted preprocessing dealer and local simulated parties, not a complete distributed SPDZ deployment. Base OT is not OT extension. No browser trace substitutes for the chapter’s simulation-based or universal-composability arguments.
No chapters match. Clear the filters or try a broader term.
About this reading path
Start with the listed sections in the authors’ free PDF. The chapter links open the pinned version 0.6; PDF viewers may handle page anchors differently. Write down a prediction before opening a lab, run the experiment, then explain what you observed and which assumptions mattered. Each activity ends with the limits of that connection.
Read → predict → experiment → explain
An independent educational companion by Paul A. Clark, unaffiliated with Dan Boneh, Victor Shoup or Stanford University. No author endorsement is implied. The practice prompts are original; no textbook passages or exercises are reproduced. Experiments illustrate security ideas; they do not replace proofs.
Optional checkmarks record exploration, not mastery. They stay in this browser when local storage is available and are separate from both the Schneier and Katz–Lindell paths.
What the connection labels mean
Direct connection A lab addresses a selected concept in that chapter. This is a connection to part of the chapter, with its scope stated in the lab note and activity boundary.
Modern counterpart A different practical construction or a later standard explores a related idea. Read the lab note for how it differs from the book’s example.
Introductory bridge A partial bridge or intuition builder. Formal definitions, reductions and unimplemented constructions remain reading work.
Supplementary exploration Labs for a topic whose chapter or section is unfinished in the pinned draft. These are independent extensions, not coverage of unwritten text.
Each lab has its own label. The chapter label describes the overall connection and is used by the filter. None of the labels implies complete chapter coverage.
1: Introduction
2–9: Secret key
10–17: Public key
18–23: Protocols
Before you begin: Expect modular arithmetic, probability and mathematical arguments. The labs make selected operations inspectable; they cannot supply every prerequisite or replace working through the text. Read each lab’s own sources and teaching limits.
Book, version and sources
Dan Boneh and Victor Shoup. A Graduate Course in Applied Cryptography. Version 0.6, January 2023.
Version note: Checked on 20 October 2026. The official site identifies version 0.6 as its latest release and gives a posting date of 14 January 2023. This guide pins its chapter references to that file. A future draft may change the numbering; use the official version history when comparing copies.
Draft boundaries: Chapters 1 and 17 are present in the contents but their bodies are absent from this PDF. Sections 20.5–20.7 are unfinished, as are several other sections identified in individual activities. Chapter 14’s heading here follows the PDF; the website’s abbreviated outline uses different wording. No complete chapter-coverage claim is made.
The book is linked from its authors’ site, not rehosted here. The activity prompts and lab connections are original. Publicly available reading access is not a claim that the book is public domain or covered by this repository’s MIT license.
Explore earlier constructions and protocol ideas with Schneier’s Applied Cryptography (1996), a historical reading companion with explicit modern connections and coverage limits.