Follow the algorithms from their arithmetic to the choices that make a cryptographic system work. Read, predict an outcome, try it in a lab, then explain what the experiment establishes.
Edition and numbering: Checked against the full 2024 second edition (eBook ISBN 978-3-662-69007-9) and the authors’ errata. The book has 14 numbered chapters. SHA-3 is §11.5 within Hash Functions; it gets a separate study stop here. Post-Quantum Cryptography is Chapter 12. The published Chapter 14 is titled Key Management; the authors’ website calls it Key Establishment. Check the edition sources.
Predict before opening a lab: If you replace a Caesar shift with a longer repeating Vigenère key, which visible patterns do you expect to disappear, and which might still help an attacker?
Explore periodicity and frequency evidence in a different historical cipher.
Experiment: In Clock Arithmetic, reduce a negative integer modulo 12 and compare the addition and multiplication tables. In Dead Sea Cipher’s Caesar panel, open the affine card, keep b fixed and compare a = 5 with a = 2. Inspect the inverse check and letter collisions, then restore a valid multiplier and try recovery from known letters. Compare with a Vigenère challenge’s periodicity and frequency evidence.
Explain the result: Why must an affine multiplier be coprime to 26, and how do 12 admissible multipliers and 26 offsets give 312 keys? Explain why a larger key space can defeat exhaustive search while a structural attack still succeeds. Which security service is missing if a receiver cannot detect an altered ciphertext?
Coverage boundary: The affine card directly covers §1.4.4; Vigenère remains a related historical comparison. Known-letter recovery may leave several keys, so inspect the candidate set rather than assuming a unique answer. Clock Arithmetic uses bounded teaching inputs; an arithmetic identity or a successful round trip does not establish cipher security.
Chapter 2 · Symmetric cryptography
Stream Ciphers
Direct connection
Learning focus: Separate a reusable algorithm from a single-use keystream
Read: §§2.1–2.3; §§2.4.2–2.4.3. Salsa20 in §2.4.1 remains a comparison in the reading. · Publisher’s chapter 2 page
Predict before opening a lab: If two equal-length messages use exactly the same keystream bytes, can changing the generator from a pad to ChaCha20 prevent the ciphertext XOR from revealing a message relationship?
Follow a ChaCha20 quarter round and compare fresh-nonce and repeated-nonce encryption.
Experiment: Use two different equal-length messages in the OTP reuse experiment and in ChaCha20 Stream’s nonce-reuse experiment. Write down which key, nonce and byte positions were repeated. Next fit an LFSR recurrence, freeze its forecast, and reveal the withheld output; compare fitting the observed prefix with predicting new bits.
Explain the result: Explain the common XOR failure and the different security assumptions behind the two generators. Why does matching a short prefix establish less than an accurate unseen forecast, and why does neither establish a general security theorem?
Coverage boundary: Perfect secrecy requires an independent, uniformly random secret pad of sufficient length used once. Browser randomness does not certify that physical assumption. Small LFSR attacks do not break ChaCha20 or full Trivium. Salsa20 is referenced but has no catalogued stream-cipher implementation. Trivium and the perfect-secrecy extension are existing commissioned work, not new gaps.
Chapter 3 · Symmetric cryptography
The Data Encryption Standard (DES) and Alternatives
Direct connection
Learning focus: Explain reversibility separately from resistance to attack
Read: §§3.2–3.5 and §3.7; Serpent connects to §3.7.1 and the PRESENT-80 tab directly supports §3.7.3. · Publisher’s chapter 3 page
Predict before opening a lab: DES uses S-boxes that map more input bits to fewer output bits. Can its whole encryption still be reversible without inverting those S-boxes?
Its separate PRESENT tab runs full PRESENT-80: the S-box, bit permutation, 80-bit key schedule, all 31 rounds and inverse decryption.
Experiment: In Feistel Forge, pause after a DES round and work backwards using XOR and the retained half. In Biham Lens’s PRESENT tab, follow one bit through the permutation and step the 80-bit key register. Trace an encryption through round 31 and locate the final K32 addition. Compare how the Feistel structure and PRESENT’s invertible layers permit decryption.
Explain the result: Which values make the backwards step possible even though the round function loses information? Explain why demonstrating reversibility does not establish sufficient key size, block size or resistance to cryptanalysis.
Coverage boundary: DES is historical. Biham Lens’s toy-SPN attack and its full PRESENT-80 engine are separate. PRESENT-128 is not implemented. The round-key recovery exercise assumes K32 is already known; it does not obtain K32 or break full PRESENT. Serpent covers one AES finalist. Exact triple-DES and DESX execution is not established by these connections.
Chapter 4 · Symmetric cryptography
The Advanced Encryption Standard (AES)
Direct connection
Learning focus: Build the AES layers, then test what each one contributes
Read: §§4.2–4.6, especially field arithmetic (§4.3), the round layers and key schedule (§4.4), and decryption (§4.5) · Publisher’s chapter 4 page
Predict before opening a lab: Could a reversible cipher change about half its output bits when one input bit flips and still be recoverable from one known plaintext–ciphertext pair? Which AES operation prevents the data path from being affine?
A full AES-128 implementation supports white-box experiments; the teaching focus is implementation exposure and attacks.
Experiment: In AES Anatomy, follow one field inverse and the S-box construction, then inspect the expanded keys. Load the AES-128 FIPS example and trace the whole cipher and its inverse; locate the final round’s omitted MixColumns. Switch to AES-256 to find its extra SubWord in key expansion, then return to AES-128. In act 7, load the affine-only fixture and run the attack. Compare its avalanche and held-out recovery with the same attack on full AES.
Explain the result: Explain why invertibility, diffusion and a good-looking mean avalanche do not imply resistance to attack. Which nonlinear operation did the fixture remove from the data path, and why do the full-AES control rows matter? Distinguish AES itself from a mode using it and from AEGIS using an AES round.
Coverage boundary: AES Anatomy now supplies the field-arithmetic, S-box, key-expansion, full-cipher and inverse route for AES-128/192/256. Its attack experiments run on deliberately weakened AES-128 variants, not on real AES. The equivalent inverse cipher, general security proofs, hardened implementations and side-channel resistance are outside that lesson. AEGIS is a different authenticated cipher, and modes are studied separately.
Chapter 5 · Symmetric cryptography
More About Block Ciphers
Direct connection
Learning focus: Ask what changes when the primitive stays the same and the construction changes
Read: §5.1, including OFB (§5.1.3), CFB (§5.1.4) and XTS-AES (§5.1.6); §§5.2–5.3 on search and repeated encryption. Authenticated modes return in §13.3. · Publisher’s chapter 5 page
Predict before opening a lab: Will a secure block cipher hide the positions of repeated plaintext blocks if each block is encrypted independently? Will a disk-encryption mode also detect an attacker’s edits?
Use double DES to connect composition with the meet-in-the-middle search strategy.
Experiment: In AES Modes, encrypt repeated blocks with ECB and compare a mode that varies the block input. Open the OFB and CFB panels and identify what feeds the next AES evaluation. In CFB’s bit-flip comparison, inspect the changed plaintext bytes for CFB, OFB and CBC. In Sector Vault, distinguish decryption output from authentication, then explore double encryption in Feistel Forge.
Explain the result: Why can OFB generate its keystream before the plaintext arrives, while CFB encryption depends on ciphertext feedback? Distinguish hiding repeated structure, binding a block to its position and authenticating a message. Why does double encryption not automatically double the attacker’s work exponent?
Coverage boundary: OFB and CFB provide confidentiality without authentication; error propagation is not tamper detection. CBC IV requirements differ from CTR nonce/counter requirements. XTS also does not authenticate data. CFB-8 extends the book’s full-block feedback example. A complete triple-encryption trace and a DESX/key-whitening experiment remain outside these selected connections.
Chapter 6 · Public-key cryptography
Introduction to Public-Key Cryptography
Direct connection
Learning focus: Connect the two key roles to the arithmetic and the identity assumption
Read: §§6.1–6.2 and §6.3, particularly extended Euclid (§6.3.2) and Euler’s theorem (§6.3.4) · Publisher’s chapter 6 page
Predict before opening a lab: If someone sends you a public key, does a successful encrypt/decrypt round trip establish who owns it? For an RSA teaching key, when can the chosen public exponent have a multiplicative inverse?
Inspect small-number key generation, phi, the private inverse and the visible square-and-multiply trace.
Experiment: In Clock Arithmetic, compute the inverse of 5 modulo 26. Step Euclid and check the displayed Bézout identity before verifying the normalized inverse. Change 5 to 13 and explain the refusal. Compare unit counting with the prime-factor formula for Euler φ. In Educational RSA, connect the inverse of e modulo phi to d. In Locks and Keys, try the wrong decryption key and an altered signed message.
Explain the result: Why does gcd(a,n)=1 determine whether multiplication by a can be undone modulo n? Explain what the Bézout coefficients establish, then separate that arithmetic fact from evidence binding a public key to its intended owner.
Coverage boundary: Clock Arithmetic now exposes quotient/remainder and Bézout steps, unit counts and Euler preconditions; Educational RSA applies the inverse in a toy key pair. These are bounded arithmetic lessons, not production key generation or a proof of a hardness assumption. Successful arithmetic does not authenticate a public key.
Chapter 7 · Public-key cryptography
The RSA Cryptosystem
Direct connection
Learning focus: Keep correctness, prime generation and secure encoding as separate questions
Read: §§7.2–7.7 and §§7.8–7.9: arithmetic, fast exponentiation, CRT, primes, padding, encapsulation and attacks · Publisher’s chapter 7 page
Predict before opening a lab: If raw RSA encryption always decrypts correctly, what information can repeated encryption of a short message still reveal? Would a probable-prime result alone settle the security of the resulting system?
Practice CRT recombination and verify the consistency condition before applying it to RSA; compatible noncoprime moduli are an additional arithmetic comparison.
Connect small composite structure to factor-search methods and their measured work.
Experiment: As arithmetic preparation in Clock Arithmetic, solve x ≡ 1 (mod 6), x ≡ 3 (mod 8). Substitute the result into both equations and inspect the combined modulus. Change the first residue to 0 and explain the refusal. Then compare repeated textbook-RSA encryption with OAEP in RSA Forge. Use Educational RSA’s per-bit exponentiation trace to explain why a short public exponent reduces work without supplying padding.
Explain the result: Why does compatible noncoprime CRT use the lcm rather than the product of the moduli? How does the coprime case support RSA recombination? Explain why correctness of an arithmetic step, primality evidence and secure encryption are separate questions.
Coverage boundary: Clock Arithmetic teaches generalized CRT, including cases beyond RSA’s usual distinct-prime setting; it does not implement an RSA private operation or hardened CRT. Tiny keys and restricted attacks are teaching targets, not evidence against correctly parameterized RSA-OAEP. RSA/CRT fault and oracle extensions remain separate lessons.
Chapter 8 · Public-key cryptography
Cryptosystems Based on the Discrete Logarithm Problem
Direct connection
Learning focus: Use group structure to connect agreement, encryption and attack cost
Read: §§8.1–8.5: DH, groups and subgroups, discrete logs, authentication and ElGamal encryption · Publisher’s chapter 8 page
Predict before opening a lab: Modulo 23, will bases 5, 2 and 22 generate equally many possible shared secrets? If both DH participants reach the same value, what have they established about group size and peer identity?
Compare actual discrete-log searches on bounded teaching groups.
Experiment: In Clock Arithmetic’s generators act, compare the whole-group, prime-order-subgroup and order-two examples modulo 23. Record each base’s order, possible-secret count and actual guess count. Explain why the theorem checks can pass for the order-two example. Then compare the unauthenticated exchange in Agreeing in Public, fresh-randomness ElGamal encryption and the bounded searches in Log Forge.
Explain the result: Why is a proper prime-order subgroup useful while an order-two base is too small? Distinguish subgroup size from guesses actually used, and explain why a shared value alone establishes neither peer identity nor message integrity.
Coverage boundary: Clock Arithmetic adds exact small finite-field DH and group enumeration; X25519 in Agreeing in Public remains a modern counterpart. Neither a theorem check nor a small search proves DLP, CDH or DDH hardness. The toy search checks possible shared secrets and is not a discrete-log solver. Authentication, subgroup-leakage attacks and static-DH oracles are separate lessons.
Chapter 9 · Public-key cryptography
Elliptic Curve Cryptosystems
Direct connection
Learning focus: Move from the geometric picture to the exact finite-field group
Read: §§9.1–9.4: point operations, the elliptic-curve discrete log, ECDH and security · Publisher’s chapter 9 page
Predict before opening a lab: If P and −P have the same x-coordinate, what should their sum be? Should a finite-field group operation resemble drawing an ordinary straight line without modular wraparound?
Connect small-curve arithmetic to a toy ECDH exchange and to real curve operations.
Experiment: In Point Arithmetic, switch to a finite field, choose a point and its inverse, then inspect their sum. Step a small scalar multiplication and check one doubling and one addition independently. In Curve Lens, follow the two toy ECDH lanes and identify why they reach the same point; then compare the format of the real exchange output.
Explain the result: Explain the role of the point at infinity and distinguish the field modulus from the subgroup order. What does the real-coordinate drawing help you understand, and which calculation must happen over the finite field?
Coverage boundary: The geometric drawing is an intuition aid. Exhaustive searches use small teaching groups and do not measure security at production sizes. Raw ECDH output still needs appropriate derivation and authentication in a protocol. Curve-validation and twist-attack work is already in flight; neither these experiments nor a standard curve name establishes constant-time behavior.
Chapter 10 · Public-key cryptography
Digital Signatures
Direct connection
Learning focus: Follow the verification relation and identify what a reused nonce exposes
Read: §§10.1–10.3 and §10.5; finite-field DSA (§10.4) has a separate coverage gap. · Publisher’s chapter 10 page
Predict before opening a lab: If two valid signatures use the same secret nonce, can a verifier’s public transcript reveal more than it was meant to? Does a valid signature establish the signer’s real-world identity by itself?
Inspect ECDSA verification and the reused-nonce private-key recovery experiment.
Experiment: Sign a short, self-written message and verify it before changing one character. Run the reused-nonce experiment in ECDSA Forge, record the two public transcripts and test the recovered-key result. Compare with ElGamal Plain’s signature exhibit, noting that encryption’s ephemeral exponent and signing’s nonce serve different equations even though both require care.
Explain the result: Explain why a repeated nonce creates an extra algebraic relation. Distinguish verification of signed bytes from trust in a named person, and explain why someone holding a shared MAC key has a different ability from a public signature verifier.
Coverage boundary: ElGamal signatures are already implemented and are not a new gap. Finite-field DSA is a distinct algorithm with no catalogued experiment; ECDSA and ML-DSA do not fill that exact section. A successful toy attack or a deterministic-nonce option does not establish general implementation safety. Existing RSA signature-parsing and threshold-signature extensions remain outside the new recommendations.
Chapter 11 · Hashing and authentication
Hash Functions
Direct connection
Learning focus: Choose the attacker’s objective before interpreting a hash experiment
Read: §§11.1–11.4: security goals, construction choices and SHA-256. Section 11.5 has its own focus stop next. · Publisher’s chapter 11 page
Predict before opening a lab: If you can choose both messages, should finding a collision require the same work as matching a digest selected in advance? Does an avalanche display distinguish those tasks?
Run generic searches against deliberately truncated outputs and inspect independently checked collision results.
Experiment: Write down a collision objective and a fixed-target preimage objective. In Hash Hunt, run supported searches at a small displayed output width and record both successful results and the work budget. Verify the two full input messages differ. In Hash Zoo, flip one input bit, then run the length-extension example; state which observable belongs to diffusion and which demonstrates a construction-level failure.
Explain the result: Explain why two different messages agreeing on a truncated prefix do not constitute a full SHA-256 collision. Why does making a hash output appear well mixed fail to establish preimage or collision resistance?
Coverage boundary: The chapter’s formal security arguments and a complete SHA-256 message-schedule/compression-round lesson remain reading work. Generic reduced-output searches do not break the full digest. Length extension is different from collision finding and does not break HMAC. Generic attacks, Davies–Meyer and multicollisions are already in the prior batches.
Section 11.5 · SHA-3 focus · Hashing and authentication
SHA-3 — focused study within Hash Functions
Direct connection
Learning focus: Observe the boundary between message framing, absorption and output
Read: §11.5, especially §§11.5.1–11.5.4. This is a section focus, not chapter 12. · Publisher’s chapter 11 page
Predict before opening a lab: For SHA3-256’s 136-byte rate, will messages of 135 and 136 ASCII bytes need the same number of padded input blocks? If you request a longer SHAKE output, will its shorter prefix change?
Stage 1 exposes SHA3-256 padding, the rate/capacity split and the state after each permutation; Stage 2 shows SHAKE squeezing. The keyed KMAC stages are additional study.
Experiment: In KMAC Gate’s SHA3-256 stage, compare messages of 135 and 136 copies of one ASCII character, using the displayed byte count to check the inputs. Locate the suffix and final padding marker, then step the absorb blocks. In the SHAKE stage, keep the message fixed, request a longer output and use the prefix comparison to test your second prediction.
Explain the result: Explain why an exactly full rate block still needs framing and padding. Why are the capacity bits, which are not directly absorbed into or squeezed from, relevant to the construction? Why is extending SHAKE output a different operation from extending a message?
Coverage boundary: This is substantial existing SHA-3 coverage, not a missing sponge lab. The state grid follows full Keccak-f permutations; it is not a complete lane-by-lane walkthrough of every theta, rho, pi, chi and iota step. SHAKE, cSHAKE and KMAC have distinct framing and output rules; the later keyed stages should not be described as ordinary SHA3-256 hashing.
Chapter 12 · Post-quantum cryptography
Post-Quantum Cryptography
Direct connection
Learning focus: Compare three hard-problem families without treating every model as a standard
Read: §§12.1–12.5: the quantum threat, lattice-based, code-based and hash-based constructions, and standardization · Publisher’s chapter 12 page
Predict before opening a lab: Can adding more noise make a toy lattice encryption harder to inspect yet eventually prevent its intended recipient from decrypting? Does replacing a classical key exchange automatically authenticate the peer?
Explore real SLH-DSA alongside explicitly simplified WOTS+ and Merkle views.
Experiment: Use the seeded fresh toy experiment in Lattice Gentle. Increase the error setting and record where correct recovery stops; identify the decoded message and the lab’s noise-budget calculation separately. Then explore one code-based path in McEliece Gate and one state-use experiment in LMS Ledger. Finish with What Is PQC: compare the actual exchange artifacts and inspect what they establish about the peer’s identity.
Explain the result: For each family, name the hard problem or hash-based assumption and the job the construction performs. Explain why a toy noise threshold is not a security estimate for ML-KEM, and why a post-quantum KEM still needs an authenticated protocol around it.
Coverage boundary: Small LWE/ring examples, Goppa-code experiments and shortened hash-signature views are teaching models. McEliece Gate does not implement the submitted KEM API. LMS Ledger teaches real LM-OTS and Merkle operations; its small HSS transcript is non-interoperable. What Is PQC, Dilithium Seal and SPHINCS+ Ledger have separate real ML-KEM, ML-DSA and SLH-DSA paths. The selected labs do not reproduce every derivation or parameter choice in the chapter. Legacy Kyber, Dilithium and SPHINCS+ names are not automatic conformance claims. The name LMS/XMSS is not evidence of an XMSS implementation.
Chapter 13 · Hashing and authentication
Message Authentication Codes (MACs)
Direct connection
Learning focus: Identify which secret an attacker would need to create an accepted tag
Predict before opening a lab: If an attacker changes a message and can recompute its checksum, can the receiver still detect the forgery? What changes when generating a valid tag requires a shared secret?
Connect authentication to encryption with actual GCM and CCM operations.
Experiment: In MAC Race’s checksum-versus-MAC panel, alter a message and repair the checksum. Compare the HMAC receiver with the key-leak option disabled and enabled. Follow the HMAC inner/outer construction, then use AES Modes’ authenticated-encryption comparison to observe rejection after the protected data changes. Record who knew the authentication key in each experiment.
Explain the result: Why does a checksum fail against an intentional editor who can recompute it? Explain why a MAC provides neither confidentiality nor public third-party verification, and why GHASH alone is not an authenticated GCM tag.
Coverage boundary: Apply the authors’ April 2025 erratum to §13.3.4 (p. 477): the final GHASH multiplication uses the hash subkey H; the encrypted initial counter block then masks the result with XOR. The GHASH teaching view has explicit framing and masking limits. GMAC is not separately established by the catalog, and a bare GHASH calculation must not be labelled GMAC. Finite demonstrations do not replace tag-forgery bounds or prove constant-time verification.
Chapter 14 · Key management
Key Management
Direct connection
Learning focus: Track the trust decision from key derivation to an accepted identity
Read: §§14.2–14.6. The authors’ website calls this chapter “Key Establishment”; the published heading is “Key Management”. · Publisher’s chapter 14 page
Predict before opening a lab: Will a valid mathematical signature make a certificate acceptable if its issuer is not trusted? Can two equal derived keys by themselves establish who supplied the original secret?
Inspect certificate signatures, trust anchors and explicitly scoped local revocation scenarios.
Experiment: In PKI Chain, compare a valid chain with the trust-root mismatch scenario, then use the CRL/OCSP controls to examine the local revocation result. In KDF Chain, hold the input secret and salt fixed while changing the HKDF info string. Relate the two observations: identify the check that binds a key to an identity and the input that separates derived-key uses. Use Kerberos to locate the KDC’s role in its ticket exchanges.
Explain the result: Explain how correct cryptographic calculations can coexist with a failed trust decision. Distinguish key derivation, key agreement, identity authentication and revocation, then identify which state each depends on.
Coverage boundary: Kerberos models a practical KDC protocol. Its separate Lowe-attack lesson concerns the public-key Needham–Schroeder protocol and must not be presented as the book’s symmetric-key Needham–Schroeder construction. PKI Chain implements a defined validation subset with local revocation fixtures, not an operating public CA ecosystem. TLS resumption, authenticated-exchange attacks and protocol-composition extensions are already in the earlier batches.
No study stops match. Clear the filters or try a broader term.
About this reading path
Read the indicated section in your own copy of the book. Before opening a lab, record your prediction. Change the named inputs, inspect the outcome, and explain both the result and the experiment’s limits. Publisher links identify the reading; access to the complete book may require purchase or institutional access.
Read → predict → experiment → explain
This is an independent educational companion by Paul A. Clark, unaffiliated with Christof Paar, Jan Pelzl, Tim Güneysu or Springer Nature. No author or publisher endorsement is implied. All activity prompts are original. No book text, figures, exercises or solutions are reproduced or rehosted.
What the connection labels mean
Direct connection A lab addresses a selected idea or construction in the reading. Its note and activity boundary state which part.
Modern counterpart A different construction or a later standard illustrates a related idea. The lab note explains the distinction.
Introductory bridge An intuition builder or partial connection. The missing operations, assumptions or reasoning remain reading work.
Each lab has its own connection label. The study-stop label describes its overall connection and controls filtering. None of these labels means complete chapter coverage. A successful experiment does not prove a scheme secure, and toy parameters do not provide deployment security.
Optional checkmarks record exploration, not mastery. Progress is separate from the other reading paths and stays in this browser when storage is available. If storage is unavailable, checkmarks still work for the current visit.
Before you begin: Use the book for definitions, arithmetic and derivations. Read each lab’s own teaching limits. Modern implementation names and standards can differ from the book’s 2024 publication context.
Book, edition and sources
Christof Paar, Jan Pelzl and Tim Güneysu. Understanding Cryptography: From Established Symmetric and Asymmetric Ciphers to Post-Quantum Algorithms. Second edition. Springer, 2024. DOI: 10.1007/978-3-662-69007-9.
Edition check: On 21 October 2026, the chapter order and section references were checked against the complete second-edition PDF supplied for review: three authors, 2024 copyright, eBook ISBN 978-3-662-69007-9. Selected readings were also checked for the affine cipher (§1.4.4), PRESENT (§3.7.3), feedback modes (§§5.1.3–5.1.4) and GCM (§13.3.4). This verifies the reading map; it is not an exhaustive review of every page or exercise. Chapter and section numbers keep the references usable across print and digital copies.
Read with the errata: The authors’ April 2025 corrections cover Salsa20/ChaCha notation, the DES initial permutation, an LWE example and GCM’s tag calculation. Follow the official second-edition errata alongside the book; Chapter 13’s coverage note calls out the GCM correction.
Post-quantum standards: The book predates the final August 2024 publications of FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA). Use each lab’s documented implementation and limits when connecting a book example to a current standard.
The book remains the work of its authors and publisher. Links to official reading resources do not place the book under this repository’s MIT license.
Other current companions: Boneh–Shoup and Katz–Lindell. Each follows its own source and states its coverage limits.
Historical further reading
Explore earlier constructions and protocol ideas with Schneier’s Applied Cryptography (1996), a historical reading companion with explicit modern connections and coverage limits.