Predict before opening a lab: Which patterns do you expect a short repeating key to leave in the ciphertext, and what evidence would make you revise that prediction?
Preview the challenger, adversary and success condition that later chapters make precise.
Try this: Use a supplied challenge encrypted under a short repeating key. Before opening Hidden Bit, write down what the attacker sees, what the attacker may do, and what would count as success.
Explain the result: Why is “I cannot read this ciphertext” a weaker claim than a definition covering every efficient adversary?
Coverage boundary: The classical attack motivates formal definitions. A successful round trip or a ciphertext that looks scrambled establishes neither secrecy nor a proof.
Chapter 2 · Foundations
Perfectly Secret Encryption
Direct connection
Learning focus: Find the assumptions behind perfect secrecy
Read: §§2.1–2.3; §2.4 for Shannon’s theorem
Predict before opening a lab: For one fixed ciphertext, can two equal-length candidate messages both have consistent keys, and what do you expect to become visible when a pad is reused?
Separate a source of unpredictability from deterministic expansion and statistical appearance.
Try this: Keep a ciphertext fixed and derive keys for two different candidate messages of the same length. Then reuse a pad for two messages and inspect the ciphertext XOR.
Explain the result: Which claim fails when the pad is reused? Which assumptions concern the key distribution rather than the XOR operation?
Coverage boundary: Perfect secrecy requires an independent, uniformly random secret pad of the required length, used only once. OTP Vault uses browser-generated bytes to demonstrate the arithmetic; it does not certify perfect physical randomness. The pad alone supplies no message authentication.
Chapter 3 · Symmetric cryptography
Private-Key Encryption
Direct connection
Learning focus: Give the attacker an encryption oracle
Read: §§3.4.2, 3.5.1 and 3.6.3; §3.6.4 for nonce-based encryption
Predict before opening a lab: Which supplied strategies do you expect to distinguish deterministic encryption, randomized encryption and chained-IV CBC, and why?
Inspect generated keystream and the consequence of repeating a nonce with the same key.
Try this: In Hidden Bit, compare re-encryption against deterministic encryption with randomized encryption. Then select the chained-IV CBC fixture and compare the weak adversaries with the IV predictor.
Explain the result: What changed in the adversary’s information or strategy? Why does a near-zero measured advantage for one strategy leave other attacks open?
Coverage boundary: These experiments address selected chosen-plaintext attacks and mode behavior. Finite trials do not prove computational indistinguishability. The EAV/CPA definitions, negligible functions and PRG/PRF-based reductions still require the reading.
Chapter 4 · Symmetric cryptography
Message Authentication Codes
Direct connection
Learning focus: Try to make a changed message verify
Read: §§4.1–4.2 and 4.5; §4.6.2 for one-time authentication
Predict before opening a lab: Will the original tag verify after the message changes, and will reusing the entire Poly1305 one-time key give the attacker a new way to produce a valid tag?
Step through polynomial authentication and examine one-time-key reuse.
Try this: Generate a tag, keep it fixed, change the message and check verification. In Poly1305 MAC, reuse the one-time key and follow the resulting algebraic attack.
Explain the result: What must a forgery achieve beyond replaying a previously authenticated message? Why does a valid MAC reveal nothing by itself about confidentiality?
Coverage boundary: MAC Race’s CMAC is a related construction, not the chapter’s basic CBC-MAC verbatim. Domain-extension proofs, universal-hashing bounds and information-theoretic authentication are only partly illustrated. Key requirements differ between MAC families.
Chapter 5 · Symmetric cryptography
CCA-Security and Authenticated Encryption
Direct connection
Learning focus: Turn decryption feedback into an attack
Read: §§5.1.1–5.1.2 and 5.3.1; §5.4 for communication sessions
Predict before opening a lab: Will checking the MAC before CBC decryption remove the padding signal used by the attacker, and which result in the trace would support your prediction?
Extend the discussion to misuse resistance by comparing GCM and GCM-SIV.
Try this: Recover bytes in Padding Oracle. Next run Protocol Compose’s padding-oracle panel with MAC-then-encrypt, then encrypt-then-MAC. Identify whether authentication happens before decryption and how that changes the result.
Explain the result: What information does the oracle reveal? Which assumptions make the generic construction secure, and which implementation choices can violate them?
Coverage boundary: A demonstrated implementation attack is evidence of a failure under its stated conditions. It is not a proof about every implementation of that composition. Authentication, nonce requirements and session replay handling remain distinct obligations.
Chapter 6 · Symmetric cryptography
Hash Functions and Applications
Direct connection
Learning focus: Name the hash property you actually need
Read: §§6.1.1–6.1.2, 6.3.1, 6.4.1–6.4.3 and 6.6.2–6.6.4; Appendix A.4; §§6.5 and 6.6.5 for commitments
Predict before opening a lab: If two different letters have the same shortened digest, will a valid MAC over that digest distinguish them? What changes when a fresh salt is chosen after an inversion table was built?
Run birthday and small-space collision searches, transfer a tag in a deliberately insecure hash-then-MAC construction, and compare actual chain precomputation with fresh salts.
Compare password derivation with extracting and expanding existing key material.
Try this: In Hash Hunt, find a collision at a small output width and independently compare the displayed inputs and digests. Run Meaningful forgery, then the chain-table and salt experiments; separate endpoint matches from verified preimages. For the Merkle-tree connection, retain an original inclusion proof, use Tamper Leaf, and compare its reconstructed root with the changed tree’s root.
Explain the result: How do a collision, a preimage and a second preimage differ? Why must a verifier obtain the expected Merkle root from a trusted source? What role does unpredictable opening randomness play in a hash commitment?
Coverage boundary: Hash Hunt attacks deliberately shortened outputs and an insecure hash-then-MAC composition, not full SHA-256 or HMAC. Its rainbow chains are a later extension to the Hellman connection; probability models and measured outcomes remain separate. A concrete hash is not literally an ideal random oracle, and an avalanche picture is not a collision-resistance proof. Revised-edition §6.1.2 qualifies the implication from second-preimage resistance to preimage resistance: the hash must also be sufficiently compressing.
Chapter 7 · Symmetric cryptography
Practical Constructions of Symmetric-Key Primitives
Direct connection
Learning focus: Inspect the machinery inside the primitive
Read: §§7.2.1–7.2.2, 7.2.5–7.2.6 for SPNs, Feistel networks, AES and cryptanalysis; §§7.1 and 7.3 for the other labs
Predict before opening a lab: Can a Feistel network with a constant round function remain invertible? Can an AES variant with an affine data path have a good-looking mean avalanche and still be broken by one known pair?
Compare compression-based hashing with the sponge construction.
Try this: In Feistel Forge, use the supplied constant-output round function and undo a round. In AES Anatomy, trace a full AES-128 encryption and its inverse, then load the act-7 affine-only fixture and run its recovery. Compare the held-out attack rows with the full-AES controls. Use Biham Lens or Matsui Line to distinguish this affine recovery from differential or linear statistical evidence.
Explain the result: Why are invertibility, mean avalanche and pseudorandomness different claims? Identify the nonlinear AES layer removed by the fixture, and explain what the failed attack on full AES does and does not establish.
Coverage boundary: AES Anatomy connects directly to the AES construction and its layers. Its four ablation attacks target deliberately weakened AES-128 variants, not full AES, and do not establish a general security proof. DES and reduced-parameter cryptanalysis remain scoped teaching examples. The linked activities cover selected constructions rather than the entire chapter.
Chapter 8 · Symmetric cryptography
Theoretical Constructions of Symmetric-Key Primitives
Introductory bridge
Learning focus: Follow a reduction beyond the experiment
Read: §§8.1–8.8; experiment background: §3.5.1 and Appendix A.4; later reduction: §12.4.1
Predict before opening a lab: At a fixed output length, how do you expect more distinct oracle queries to affect the chance of distinguishing a random function from a random permutation?
Review round reversibility before reading the distinct theorem about pseudorandom permutations.
Try this: In Hidden Bit, vary the query count in the switching game and inspect the collision bound. Then trace what the live reduction forwards to its adversary and how it translates the answer.
Explain the result: Which object is an assumption, which is a construction, and which is an adversary? What must a reduction preserve about runtime, query access and success probability?
Coverage boundary: Reading-led chapter. The linked labs do not implement the full one-way function → hard-core predicate → PRG → GGM PRF → strong PRP construction chain or its proofs. The DDH reduction is an analogy to the method; DES reversibility is not the Luby–Rackoff theorem.
Chapter 9 · Public-key cryptography
Number Theory and Cryptographic Hardness Assumptions
Direct connection
Learning focus: Separate arithmetic from a hardness assumption
Read: §§9.1.2–9.1.5, 9.2.1–9.2.5 and 9.3.1–9.3.4; Appendix B.1.2, B.2.1–B.2.3 and B.3 for arithmetic algorithms
Predict before opening a lab: Does every nonzero residue have an inverse? If Euler’s theorem holds, must the base generate the whole multiplicative group? Would a passing primality test settle either question for every input?
Inspect finite-group encryption and the discrete-log relation behind its keys.
Try this: In Clock Arithmetic, compare inverses for 5 and 13 modulo 26 and check the Bézout rows. Recombine 1 modulo 6 with 3 modulo 8, then inspect the order-two example modulo 23. Separate the theorem checks from the possible-secret count. In Prime Witness, compare Fermat and Miller–Rabin on 561. Connect these arithmetic observations to the distinct inverse problems illustrated by RSA and ElGamal.
Explain the result: Which conclusions follow from gcd, CRT compatibility or a computed order, and which require a cryptographic hardness assumption? Explain why factoring, RSA inversion, discrete logarithms, CDH and DDH are different questions.
Coverage boundary: Clock Arithmetic’s bounded BigInt calculations teach the algebra; generalized noncoprime CRT extends the standard coprime example, and the toy shared-secret search is not a discrete-log algorithm. Probable-prime evidence is not a primality certificate, and fixed-base guarantees require their stated bounds. None of these small computations establishes production-size hardness or standards-conformant key generation. RSA inversion is not known in general to be equivalent to factoring, and DLP hardness alone does not establish DDH in every group.
Chapter 10 · Public-key cryptography
Algorithms for Factoring and Computing Discrete Logarithms
Direct connection
Learning focus: Measure how an attack uses structure
Read: §§10.1.1–10.1.3, 10.2.1–10.2.3 and 10.3; §10.4 and Figure 10.1 for parameter choices
Predict before opening a lab: Will equal-size groups have equal attack costs if one order is smooth? Can a field precomputation be reused for a second target, and does the same method apply to a toy curve?
Compare generic solvers, lift Pohlig–Hellman digits, reuse safe-prime index-calculus relations and independently verify each recovered exponent.
Try this: Keep Factor Forge’s integer attacks separate from Log Forge’s exponent recovery. In Log Forge, compare methods under the displayed equal budgets, inspect Pohlig–Hellman’s prime-power digits, then reuse an index-calculus precomputation for another target. Change to the toy curve and inspect which methods remain applicable; check every reported answer against the independent verifier.
Explain the result: Which feature of an instance helps each algorithm? Why can two instances of the same bit length have different observed attack costs?
Coverage boundary: Log Forge executes Pohlig–Hellman, collision-based discrete-log methods and safe-prime index calculus at bounded teaching sizes. Large digit problems can leave only a partial congruence; a budget stop proves no hardness claim. Its curve is a verified toy fixture, and the field-specific index solver does not apply to it. Number-field-sieve material remains a cost model. Browser timings and key-length tables do not demonstrate a break of deployed keys.
Chapter 11 · Public-key cryptography
Key Management and the Public-Key Revolution
Direct connection
Learning focus: Agree on a key and identify the peer
Read: §§11.2–11.4; §11.1 for the key-management problem
Predict before opening a lab: Can both endpoints complete a key exchange while each shares a different secret with the attacker?
Extend the chapter’s management problem to rotation, compromise and recovery decisions.
Try this: Complete an honest key exchange, then let the middle party replace both public contributions. Compare what each endpoint believes with the secrets the attacker actually holds.
Explain the result: Which authority is trusted in the key-distribution-center model? What additional mechanism must bind a public key to the intended peer?
Coverage boundary: Agreement on shared bits does not authenticate an identity. The Kerberos and lifecycle examples add practical context; neither is a complete organizational key-management system or a proof of the chapter’s models.
Chapter 12 · Public-key cryptography
Public-Key Encryption
Direct connection
Learning focus: Challenge public-key encryption after seeing the ciphertext
Read: §§12.2.3, 12.4.1 and 12.5.4 for the activity; §§12.3–12.5 for the other labs
Predict before opening a lab: Does refusing the exact challenge ciphertext also prevent the attacker from learning its plaintext through a modified ElGamal ciphertext?
Connect ECIES/RSA-OAEP examples with the separation of public-key and symmetric encryption work.
Try this: Run Hidden Bit’s ElGamal CCA2 oracle game. Inspect the trace showing refusal of the exact challenge and the related-ciphertext query. Repeat with RSA-OAEP and compare the information returned.
Explain the result: Why does forbidding only the exact challenge leave a malleable scheme vulnerable? Which assumptions belong to the KEM and which belong to the symmetric data-encryption component?
Coverage boundary: A rejected OAEP modification defeats that supplied attack; it does not prove CCA security. Hybrid encryption here means public-key protection combined with symmetric encryption, not a classical-plus-post-quantum combiner. The labs do not reproduce every construction or reduction in the chapter.
Chapter 13 · Public-key cryptography
Digital Signature Schemes
Direct connection
Learning focus: Distinguish a valid signature from a trusted identity
Read: §§13.2, 13.5.3 and 13.6 for the activity; §§13.4–13.7 for the other labs
Predict before opening a lab: Does a different valid ECDSA signature on an already signed message win each of the two forgery games?
Connect signatures and certificates to an authenticated channel.
Try this: In Hidden Bit, create the ECDSA alternate signature for an already signed message and compare the two forgery goals. Then trace a certificate chain back to the root the verifier trusts.
Explain the result: Why is another valid signature on an old message different from signing a new message? What does verification establish about a person if the public key has no trusted binding?
Coverage boundary: Schnorr Forge uses BIP-340 rather than the book’s exact generic encoding. Signatures do not encrypt messages. Certificate and TLS walkthroughs illustrate selected checks; signcryption (§13.8) and complete protocol proofs are not covered by this route.
Learning focus: Change the attacker’s computational model
Read: Chapter 14 introduction; §§14.1.1, 14.2–14.3 and 14.4.2–14.4.3; chapter references for the NIST standards
Predict before opening a lab: Which hard problems does Shor’s algorithm threaten, and what could go wrong if a one-time signing key signs two different messages?
Connect the revision’s Dilithium/FIPS 204 discussion to ML-DSA, a lattice-based counterpart to the chapter’s hash-based signature constructions.
Try this: Compare Grover’s search behavior with Shor’s period-finding route. Then inspect the one-time signing-state experiment in LMS Ledger before comparing a lattice-based signature.
Explain the result: Why are symmetric-key search and public-key factorization different migration problems? What state must a tree-based one-time signature scheme protect?
Coverage boundary: The quantum demos run on classical hardware. The revised chapter discusses the 2024 standards corresponding to Kyber, Dilithium and SPHINCS+ (FIPS 203–205), while teaching simplified constructions. ML-KEM and ML-DSA remain practical counterparts rather than implementations of those textbook constructions. LMS Ledger’s small-tree/HSS teaching adaptation is not interoperable HSS. The chapter’s Lamport proofs and quantum collision analysis still need the reading.
Chapter 15 · Public-key cryptography
Advanced Topics in Public-Key Encryption
Direct connection
Learning focus: Compute on ciphertexts and distribute decryption
Read: §§15.2.2–15.2.3, 15.3.1–15.3.3 and 15.4–15.5; §15.1 remains reading-led
Predict before opening a lab: Does a Jacobi symbol of +1 tell you which values are squares modulo a hidden-factor modulus? If Rabin decryption returns a square root, what extra power could that give a chosen-ciphertext attacker?
Compute public Jacobi symbols, encrypt bits with Goldwasser–Micali, inspect Rabin roots and turn a precisely defined root oracle into verified factors.
Connect threshold ElGamal to a local ElGamal/AES-GCM demonstration that also checks partial-decryption proofs.
Try this: In Residue Gate, compare the public symbol with the private CRT classification, encrypt the same bit again, and try the ciphertext flip. Run the canonical root-oracle attack and verify any recovered factors, then compare the redundancy rule. For the other connections, add encrypted values in Paillier Gate and test an invalid selected partial in Threshold Decrypt.
Explain the result: Why can homomorphic malleability be useful for computation yet dangerous for integrity? How does reconstructing a secret differ from decrypting without rebuilding the whole private key?
Coverage boundary: Residue Gate now executes Goldwasser–Micali and restricted Rabin constructions; it does not make them CCA-secure or supply generic trapdoor-permutation proofs. The attack depends on the stated root-oracle contract. Redundancy can refuse a query or accidentally admit a root, and the one-bit Rabin construction has a separate CPA scope. Pedersen commitments and proof-checked partial decryptions extend the chapter’s presentation. VSS Gate deliberately exposes a generator relation that defeats Pedersen binding. All threshold parties share one browser; these labs do not establish distributed-system or election security.
No chapters match. Clear the filters or try a broader term.
About this reading path
Start with the listed sections in your copy of the book. Write down a prediction before opening a lab, run the experiment, then explain what you observed and which assumptions mattered. Each activity ends with the limits of that connection.
Read → predict → experiment → explain
An independent educational companion by Paul A. Clark, unaffiliated with the authors or publisher. The practice prompts are original; no textbook passages or exercises are reproduced. Experiments illustrate security ideas; they do not replace proofs.
Optional checkmarks record exploration, not mastery. They stay in this browser when local storage is available and are separate from the Applied Cryptography path.
What the connection labels mean
Direct connection A lab addresses a selected concept in that chapter. This is a connection to part of the chapter, with its scope stated in the lab note and activity boundary.
Modern counterpart A different practical construction or a later standard explores a related idea. Read the lab note for how it differs from the book’s example.
Introductory bridge A partial bridge or intuition builder. Formal definitions, reductions and unimplemented constructions remain reading work.
Each lab has its own label. The chapter label describes the overall connection and is used by the filter. None of the labels implies complete chapter coverage.
1–2: Foundations
3–8: Symmetric cryptography
9–15: Public-key cryptography
Book, edition and sources
Jonathan Katz and Yehuda Lindell. Introduction to Modern Cryptography. Revised third edition. CRC Press, 2025.
Edition note: Chapter titles and the listed section references were checked directly against the 2025 revised third edition. References use chapter and section numbers, not PDF viewer page numbers. The 2021 third edition has the same 15-chapter sequence, but Chapter 14 was titled “Post-Quantum Cryptography.” The revision incorporates corrections and updates the discussion of NIST standards; the author-hosted 2021 contents and errata remain linked for comparison.
Reading references checked against the revised edition on 21 October 2026. The linked labs may evolve; their own sources and stated limits remain part of each activity.
Follow each exhibit’s own sources and implementation limits. Statistical success, a failed attack attempt or a successful encryption round trip cannot establish a security proof.
General zero-knowledge and multiparty-computation exhibits are further exploration in the full catalog; they are not presented as numbered chapters of this book.
Historical further reading
Explore earlier constructions and protocol ideas with Schneier’s Applied Cryptography (1996), a historical reading companion with explicit modern connections and coverage limits.