◈ crypto::compare ← Algorithm Reference

Interactive Labs

228 hands-on crypto-lab demos linked from the algorithm reference — run them in the browser to see encryption, signatures, attacks, and post-quantum schemes in action. Full catalog ↗

Search labs

Showing 228 of 228 labs

Ablation Wire A layered protocol built on X-Wing (X25519 + ML-KEM-768) and AES-256-GCM with every layer independently switchable, so turning one off shows which was load-bearing.

Linked from ML-KEM-768 (Kyber)Accumulator An RSA accumulator committing a growing set to one fixed-size digest, with short membership and non-membership witnesses under strong RSA and a trapdoor forgery.

Linked from RSA-OAEP-2048 Adaptor Gate BIP-340 adaptor signatures: one click turns a pre-signature the real verifier rejects into a valid signature, and subtracting the two reads the secret back out — the fact atomic swaps and PTLC routing are built on.

Elliptic Curves

Linked from secp256k1 AEGIS Gate AEAD walkthrough comparing nonce handling and throughput tradeoffs in modern authenticated encryption.

Linked from AES-256-GCM AES Modes Compares ECB, CBC, CTR, GCM, and CCM with attack demos and mode visualizations.

Linked from AES-256-GCM Agreeing in Public Real X25519 and RFC 7748 checks introduce key agreement, then a substituted peer produces matching secrets without authenticating who answered. The paint analogy is explicitly reversible.

Elliptic Curves

Linked from Curve25519 / X25519 Air Stream Generates 128-EEA1, 128-EEA2 and 128-EEA3 keystream from one key, COUNT, bearer and direction, checking SNOW 3G, AES-CTR and ZUC against the test vectors in each specification.

Linked from SNOW-V Ascon Lightweight cryptography lab covering AEAD, hashing, and constrained-device design tradeoffs.

Linked from ChaCha20-Poly1305 Attestation Gate TPM quote signatures as ECDSA P-256, deterministic per RFC 6979, with restricted-key TPM_RC_TICKET enforcement and RATS/EAT appraisal.

Elliptic CurvesHash

Linked from P-256, SHA-256 Attribute Gate FAME CP-ABE over BLS12-381 pairings, with a collusion attempt that splices two real keys and shows the term that refuses to cancel.

Elliptic Curves

Linked from BLS12-381 Babel Hash Hash family explorer with sponge-vs-Merkle-Damgard mental models.

Linked from SHA-3-256 (Keccak)BB84 Quantum key-distribution intuition and where it differs from software KEM deployment.

Linked from ML-KEM-768 (Kyber)bcrypt Forge Work-factor and migration walkthrough for legacy-compatible password hashing.

Linked from bcrypt Beacon Lock Timelock encryption to a future drand round, where the beacon's BLS12-381 signature becomes the Boneh-Franklin IBE decryption key — a clock in place of an authority.

Elliptic Curves

Linked from BLS12-381 Biham Lens Classical cryptanalysis intuition builder for block-cipher style systems.

Linked from AES-256-GCM BIKE Vault Code-based BIKE internals, parameter intuition, and attack surface overview.

Linked from BIKE Bitcoin Script Steps a real P2PKH spend through the Bitcoin Script stack machine with secp256k1 ECDSA and HASH160, covering wrong-key, forged-signature, and tampered scenarios.

Elliptic Curves

Linked from secp256k1 Bitcoin Wallet secp256k1 key derivation to P2PKH and P2WPKH addresses via HASH160, with BIP-39 mnemonics, PBKDF2 seed stretching, and BIP-32 hardened child derivation.

Elliptic Curves

Linked from secp256k1 Blind Hello Encrypted Client Hello (ECH) built on HPKE over X25519, hiding the SNI from on-path network observers.

Elliptic Curves

Linked from Curve25519 / X25519 Blind Oracle Browser-to-server demo for encrypted computation with TFHE-style operations.

Linked from TFHE Blind Relay Oblivious HTTP relay/gateway split using HPKE so no single party sees both client identity and request content.

Elliptic Curves

Linked from Curve25519 / X25519 Blind Sign Privacy-preserving signing flow and unlinkability intuition.

Elliptic Curves

Linked from Ed25519 Broken Trust Shows how leaking one bit of ML-DSA's per-signature masking randomness enables hill-climbing secret-key recovery without lattice reduction.

Linked from ML-DSA-44 (Dilithium), ML-DSA-65 (Dilithium)Bulletproofs ZK range proofs on ristretto255 — 64-bit Pedersen commitments, aggregate proofs, and the inner-product argument.

Linked from Bulletproofs Card Trick den Boer's five-card trick: two players compute the AND of their secret bits from a shuffle alone, with information-theoretic security no computing power can buy through.

Linked from Yao's Garbled Circuits ChaCha20 Stream Quarter-round stepper, keystream visualizer, nonce-reuse demo, and encrypt/decrypt playground.

Linked from ChaCha20-Poly1305, XChaCha20-Poly1305 Chain of Trust Builds and validates X.509 chains by hand on a cross-signed ECDSA P-256 hierarchy, showing that path building and RFC 5280 path validation are different problems and that cryptographically valid signatures can still be correctly rejected.

Elliptic Curves

Linked from P-256 Ciphertext Mirror ML-KEM side-channel walkthrough across the Fujisaki-Okamoto transform, LDPC decoder behavior, and NTT blinding countermeasures.

Linked from ML-KEM-1024 (Kyber), ML-KEM-768 (Kyber)CKKS Lab Approximate arithmetic under encryption with scale/noise budgeting intuition.

Linked from CKKS Collision Vault Verifies real published MD5 and SHA-1 collision pairs (SHAttered, chosen-prefix) in-browser and shows SHA-256 resisting the same attack.

Linked from SHA-256, SHA-3-256 (Keccak), SHA-512 Commit Gate Commitment scheme semantics and binding/hiding tradeoffs in protocol design.

Linked from Bulletproofs Context Ward Ed25519 tool-call attestations over a sealed agent context window — every signature verifies while injected content still steers the agent.

Elliptic CurvesHashKDFMAC

Linked from Ed25519, HKDF, HMAC-SHA-256, SHA-256 Corrupted Oracle Entropy failure scenarios and state compromise impact in randomness pipelines.

Linked from HMAC-DRBG Covert Channel Studio LSB image embedding with a bit-plane view and the chi-square steganalysis attack, set beside ten other carriers for the same bits — DNS labels, ICMP echoes, timing gaps, packet order, cache lines — each scored by a cited detector.

Linked from LSB Substitution Credential Veil BBS+ anonymous credentials over BLS12-381 with selective disclosure, unlinkable presentations, and an over-18 range proof.

Elliptic Curves

Linked from BLS12-381 Curve Lens Interactive point addition, scalar multiplication, and ECDH exploration across major curves.

Elliptic Curves

Linked from Curve25519 / X25519 Curve448 High-security curve walkthrough for X448 and Ed448 style key agreement and signatures.

Elliptic Curves

Linked from Ed448 / Curve448 Dead Sea Cipher Historical cipher lab for context on modern symmetric design goals.

Linked from AES-256-GCM DH MITM Classic Diffie-Hellman key exchange with a live man-in-the-middle attack on the unauthenticated channel, and an ECDSA-signed fix that fails closed.

Elliptic Curves

Linked from Curve25519 / X25519 Dilithium Reject ML-DSA internals lab focused on rejection sampling and signing-loop behavior.

Linked from ML-DSA-44 (Dilithium), ML-DSA-65 (Dilithium)Dilithium Seal Demonstrates ML-DSA signing and verification flow with lattice-based signatures.

Linked from ML-DSA-44 (Dilithium), ML-DSA-65 (Dilithium)DKG Gate Pedersen/GJKR dealerless key generation where n parties Feldman-deal to each other, complaints disqualify cheating dealers, and the sharings sum into a t-of-n key nobody held.

Linked from Feldman VSS DNSSEC Chain DNSSEC algorithm 15 (Ed25519) verification, using RFC 8080's Errata 4935 text because the published Section 6 examples do not check out.

Elliptic Curves

Linked from Ed25519, P-256 Downgrade Wire Downgrade attack on hybrid post-quantum key exchange that strips the PQ half back to classical-only.

Linked from ML-KEM-768 (Kyber)DP Noise Laplace and Gaussian differential-privacy mechanisms over a twelve-person payroll, protecting the released statistic the way MPC protects the inputs, until the budget runs out.

Linked from SPDZ DRBG Arena State evolution, reseeding, and backtracking-resistance comparison across DRBGs.

Linked from ChaCha20-DRBG, CTR-DRBG (AES-256), Fortuna, Hash-DRBG, HMAC-DRBG Drift Key A code-offset secure sketch over hand-built BCH codes feeds HKDF-SHA-256, turning a noisy reading that never repeats into the same key every time, and prices the entropy the public helper data costs.

Linked from HKDF E91 Entanglement-based quantum key distribution using the CHSH Bell test, where an eavesdropper is caught by collapsing the Bell inequality.

Linked from ML-KEM-768 (Kyber)ECDSA Forge ECDSA signing and verification flow with nonce-discipline and verification-failure intuition.

Elliptic Curves

Linked from P-256, secp256k1 Ed25519 Forge Key generation, signing, verification, and deterministic nonce handling.

Elliptic Curves

Linked from Ed25519 Educational RSA Textbook RSA key generation, encryption, and signatures on small numbers, factoring a weak key and contrasting deterministic textbook ciphertext with RSA-OAEP.

Linked from RSA-OAEP-2048 ElGamal Plain Public-key encryption walkthrough for multiplicative homomorphism and ciphertext expansion tradeoffs.

Linked from ElGamal Encrochat A real Double Ratchet exchange over X25519 whose wire stays opaque while a modelled endpoint implant reads the plaintext anyway.

Elliptic Curves

Linked from Curve25519 / X25519 Enigma Forge Full mechanical Enigma with rotors, plugboard, and reflector, plus the crib-based Bombe break exploiting the no-letter-maps-to-itself flaw.

Linked from AES-256-GCM Entropy Collapse Seed-provenance and RNG state-duplication failures against a correct HMAC_DRBG (NIST SP 800-90A/B/C).

Linked from HMAC-DRBG Envelope KMS RFC 3394/5649 AES key wrap with DEK/KEK hierarchy, KMS-style rotation, and a hash-chained audit log.

Linked from AES-256-GCM Export Grade Runs real TETRA TEA1, traces its 80-bit key into a 32-bit working register, then extrapolates the rate your browser measured out to 2^80 and 2^128 beside the published attacks on full-round AES.

Linked from AES-256-GCM Factor Forge Seven classical factoring methods on a real BigInt modulus, each waiting for a different key-generation mistake — a small factor, a narrow |p - q|, a smooth p-1 or p+1 — with every claimed factor multiplied back and primality-tested before it is shown.

Linked from RSA-OAEP-2048, RSA-OAEP-4096 Falcon Seal Lattice signature demo focused on compact signatures and implementation caveats.

Linked from FALCON-512 Feistel Forge Real DES stepped round by round to show a Feistel round function need not be invertible, plus 2DES meet-in-the-middle and a Sweet32 birthday collision.

Linked from AES-256-GCM FHE Arena Compares bootstrapping-heavy and leveled FHE workflows on practical tasks.

Linked from BFV, BGV, CKKS, TFHE Fold Gate Nova's non-interactive folding scheme: combining two satisfying R1CS instances leaves a computable cross term, and relaxing the system with a slack scalar and an error vector lets one folded instance stand in for all of them.

Linked from Groth16 (zk-SNARK)Format Ward Format-preserving encryption playground for structured fields and tokens.

Linked from AES-256-GCM Frodo Vault Learning-focused module for FrodoKEM design and deployment tradeoffs.

Linked from FrodoKEM-976 FROST Threshold Threshold signing workflow built on Ed25519.

Elliptic CurvesThreshold Sigs

Linked from Ed25519, FROST Frozen Heart Weak Fiat-Shamir "Frozen Heart" forgeries that fake zero-knowledge proofs when the challenge omits public inputs.

Linked from Bulletproofs Function Key ABDP15 inner-product functional encryption over ristretto255: a key answers one weighted-sum question about an encrypted vector and nothing else, until enough colluding keys hand over the master secret.

Linked from ElGamal Garbled Gate Yao-style garbled circuit construction and secure evaluation walk-through.

Linked from Yao's Garbled Circuits GG20 Wallet Threshold ECDSA signing with coordinator flow and abort handling.

Linked from GG20 GGH Trapdoor A lattice trapdoor is a good basis, and Nguyen's mod-2 sigma reduction breaks GGH because every error entry shares one residue — the structure ML-KEM's centered-binomial errors do not have.

Linked from FALCON-512, ML-KEM-768 (Kyber)Ghost Commit Git adds objects and never edits them, so a committed API key keeps its name and contents two commits after deletion — then a Shannon-entropy scanner finds it in seconds.

Linked from SHA-256 Glass Box Chow-style white-box AES-128 built from your key as 2,032 encoded lookup tables, then attacked twice: differential computation analysis recovers the key from execution traces, and BGE step A1 strips the table encodings.

Linked from AES-256-GCM Good Randomness A beginner compares WebCrypto keys with a real ChaCha20 stream seeded by a four-digit PIN, then exhausts the 10,000 seeds. Passing four output checks does not establish an unpredictable seed.

Linked from ChaCha20-Poly1305 Grover Symmetric-key security scaling under quantum search assumptions.

Linked from ML-KEM-768 (Kyber)Harvest Timeline Migration-planning view for harvest-now decrypt-later risk and post-quantum rollout timing.

Linked from ML-KEM-768 (Kyber)Harvest Vault Data minimization and encrypted retention patterns for privacy-sensitive workloads.

Linked from TFHE Hash Zoo Comparative hashing lab for collision and preimage intuition.

Linked from SHA-256, SHA-512 HAWK Alternative post-quantum signature lab for compact-signature tradeoffs and deployment comparisons.

Linked from FALCON-512 Hidden Bit Runs the IND-CPA and CCA games against textbook RSA, RSA-OAEP, RSA-PSS and AES modes: a rising advantage proves a scheme broken, a flat one proves only that these adversaries failed, which is why security needs a reduction.

Linked from RSA-OAEP-2048 HPKE Envelope RFC 9180 HPKE hybrid public-key encryption with X25519, HKDF, and an AEAD envelope.

Elliptic Curves

Linked from Curve25519 / X25519 HQC Timing Timing leak in HQC's BCH decoder and how constant-time mitigations reshape the attack surface against the code-based KEM.

Linked from HQC HQC Timing Break Side-channel demo showing timing-sensitive failure modes in post-quantum KEM implementations.

Linked from HQC HQC Vault Code-based KEM flow and tradeoff walkthrough for HQC.

Linked from HQC HTTPS Padlock Captured X.509 chains verified with WebCrypto ECDSA introduce trust, names and expiry under a stated RFC 5280 teaching subset. Encodes ClientHello bytes only; no live TLS handshake or encryption observation.

Elliptic Curves

Linked from P-256 Hybrid Guide Guide to hybrid post-quantum key exchange where a KEM combiner pairs X25519 with ML-KEM-768 so the session key holds if either half survives.

Linked from ML-KEM-768 (Kyber)Hybrid PQC Compares classical, post-quantum, and hybrid key exchange with X25519 and ML-KEM-768 behind an HKDF combiner, breaking one half to show the hybrid survive.

Linked from ML-DSA-65 (Dilithium), ML-KEM-768 (Kyber)Hybrid Sign Composite-signature workflow combining classical and post-quantum authenticity guarantees.

Linked from ML-DSA-44 (Dilithium), ML-DSA-65 (Dilithium)Hybrid Wire Shows X25519 plus ML-KEM hybrid key exchange as deployed in modern TLS experiments.

Linked from ML-KEM-768 (Kyber)IBE Gate Identity-based encryption walkthrough rooted in pairing-based public-key constructions.

Elliptic Curves

Linked from BLS12-381 Icy DVRF A t-of-n distributed VRF whose partial evaluations are proven with Chaum-Pedersen DLEQ under one shared challenge, aggregating to a constant-size 128-byte proof.

Linked from FROST Iron Letter Applied public-key encryption workflow and envelope-encryption intuition.

Linked from RSA-OAEP-2048 Iron Serpent Applied symmetric-encryption lab for key/nonce discipline in real workflows.

Linked from AES-256-GCM Isogeny Atlas Supersingular isogeny graph over GF(431²) computed live from modular polynomials, mapping the open problems of isogeny crypto as paths, cycles, and endomorphisms.

Elliptic Curves

Linked from Curve25519 / X25519 Isogeny Gate Post-quantum key-exchange history and assumptions in context with modern curves.

Elliptic Curves

Linked from Curve25519 / X25519 J-UNIWARD JPEG-domain steganography lab with distortion-aware embedding intuition.

Linked from Adaptive Steganography (WOW), DCT-Domain (JPEG F5)Jevil Hash-based few-time signature scheme over the Goldilocks field using Lagrange interpolation for bounded-use signing with reusable verification keys.

Linked from SLH-DSA (SPHINCS+)JWT Forge Tamper with JWT claims and swap algorithms to watch alg:none and HS/RS key-confusion attacks succeed against a vulnerable verifier and fail against a correct one.

Linked from HMAC-SHA-256 KDF Arena Memory-hard tuning lab for practical parameter choices.

Linked from Argon2 (KDF mode), Argon2id, Balloon Hashing, Balloon Hashing, PBKDF2, PBKDF2, scrypt, scrypt KDF Chain Derivation-chain demo for context binding, domain separation, and key expansion.

Linked from HKDF KEM Trap Shows FIPS 203 implicit rejection — a bit-flipped ML-KEM-768 ciphertext still returns 32 bytes, and a caller that drops the return code or skips key confirmation turns silent decapsulation failure into a plaintext-checking oracle.

Linked from ML-KEM-768 (Kyber)Kerberos v5 RFC 4120 AS/TGS/AP exchange walkthrough with AES-256-CTS-HMAC-SHA1-96 ticket encryption and the Lowe attack.

Linked from AES-256-GCM Key Exchange Walkthrough of key exchange from Diffie-Hellman to modern hybrid post-quantum handshakes, with assumptions and threat models per era.

Elliptic Curves

Linked from Curve25519 / X25519 Key Mirror Key transparency with a Merkle-tree append-only log and consistency/inclusion proofs for auditable key directories.

Linked from SHA-256 KMAC Gate SHA3-256, SHAKE, cSHAKE and KMAC driven by one hand-rolled Keccak-f[1600] permutation — step the sponge block by block, then tamper with a signed message and watch the real verifier reject it.

Linked from SHA-3-256 (Keccak)KpqC Pair NTRU+ from the older NTRU line beside historical AIM2-based AIMer signing, both KpqC candidates. Honest round trips do not establish signature security.

Linked from HAETAE, SMAUG-T Kyber Vault Hands-on ML-KEM / Kyber encapsulation and decapsulation walkthrough.

Linked from ML-KEM-1024 (Kyber), ML-KEM-768 (Kyber)KyberSlash Side-channel walkthrough showing why constant-time ML-KEM implementations matter.

Linked from ML-KEM-768 (Kyber)Lattice Builder Two dials straighten a scrambled lattice until its shortest vector is readable by eye, then a real Module-LWE instance with ML-KEM's shape shows that guessing seven of eight secret coefficients leaves an error no smaller than guessing none.

Linked from ML-KEM-768 (Kyber)Lattice Fault Implementation-fault and decryption-failure intuition for lattice systems.

Linked from ML-KEM-768 (Kyber)Lattice Gentle The lattice picture underneath ML-KEM and ML-DSA: SVP and CVP on draggable bases, Gauss and LLL stepped by hand, then toy Kyber and Dilithium end to end.

Linked from ML-KEM-768 (Kyber)LFSR Forge Stream-generator contrast: binary LFSRs, Berlekamp–Massey recovery and a tiny Geffe combiner broken from known keystream. Implements neither ChaCha20 nor an attack on it; recovered states are checked against separately held ground truth.

Linked from ChaCha20-Poly1305 LLL Break Lattice reduction intuition and parameter-safety implications.

Linked from ML-KEM-768 (Kyber)LMS Ledger Stateful hash-based signatures with Merkle authentication path intuition.

Linked from LMS / HSS LMS/XMSS Stateful hash-based signature comparison centered on XMSS and LMS lifecycle management.

Linked from LMS / HSS, XMSS Locks and Keys A beginner uses one real 2048-bit RSA pair with WebCrypto RSA-OAEP and RSA-PSS, distinguishing a message that opens from an authenticated sender and a matching signature from a known identity.

Linked from RSA-OAEP-2048 LWE Hints Approximate-hint LWE secret recovery on sparse ternary secrets, counting how many hints collapse the underlying lattice problem.

Linked from ML-KEM-768 (Kyber)MAC Race Compares HMAC, CMAC, Poly1305, and GHASH with common failure modes.

Linked from CMAC-AES-256, HMAC-SHA-256, Poly1305 Masked Core First-order Boolean masking of AES-128 flattens CPA, then a second-order centred product recovers the key byte anyway.

Linked from AES-256-GCM Matsui Line Matsui's Algorithm 2 linear cryptanalysis of a toy SPN, counting bias in known-plaintext traffic until one subkey candidate separates and the piling-up lemma's prediction misses.

Linked from AES-256-GCM MAYO Seal Real MAYO keygen, signing, and verification over GF(16), showing how an oil space too small to invert becomes solvable once k copies of the map are whipped together.

Linked from ML-DSA-65 (Dilithium)McEliece Gate Code-based encryption and key-size tradeoff visualized for Classic McEliece.

Linked from Classic McEliece Merkle Proofs Builds Merkle trees on SHA-256, generates inclusion proofs, and replays the RFC 6962 second-preimage and CVE-2012-2459 attacks with domain-separation defenses.

Linked from SHA-256 Merkle Vault Merkle tree commitments and authentication path mechanics for hash-based signatures.

Linked from LMS / HSS MGM Mode MGM, the GOST AEAD mode of RFC 9058, over Magma and Kuznyechik: a distinct authentication coefficient per block against GCM's single H, every RFC test value checked, nonce reuse, and why 64-bit blocks re-key sooner.

Linked from Kuznyechik Misty Lens MISTY1 beside KASUMI, the 3GPP variant derived from it, with the design changes mapped and the seven-round related-key sandwich distinguisher executed in the page.

Linked from SNOW-V MLS Group RFC 9420 Messaging Layer Security with TreeKEM ratchet tree, epoch key schedule, and group forward secrecy.

Elliptic Curves

Linked from Curve25519 / X25519 Model Breach Leakage and inference-risk demonstration motivating encrypted-compute designs.

Linked from TFHE MPCitH Sign Post-quantum signature design intuition from MPC-in-the-head constructions.

Linked from ML-DSA-65 (Dilithium), SLH-DSA (SPHINCS+)Multivariate UOV Real Unbalanced Oil-and-Vinegar signatures over GF(256), showing the MQ trapdoor and the 2022 Beullens attack that broke Rainbow.

Linked from ML-DSA-65 (Dilithium)MuSig Gate MuSig2 (BIP-327) key and nonce aggregation producing a single secp256k1 Schnorr signature, plus the Wagner and ROS forgeries the scheme defends against.

Elliptic Curves

Linked from secp256k1 Noise Pipe Noise-pattern handshake lab for modern transport protocol design.

Elliptic Curves

Linked from Curve25519 / X25519 Noise to Numbers NIST SP 800-90B min-entropy from pinned runs of the real assessment tool: a modelled Infinite Noise TRNG scores 0.37 bits per bit, a SHA-256 counter scores 0.92. Entropy belongs to the source, not the bytes.

Linked from Hash-DRBG Nonce Collision Reuses one nonce under one key across AES-CTR, AES-GCM, ChaCha20-Poly1305, and AES-CBC, crib-dragging plaintext from XORed keystreams and running the GHASH forbidden attack to forge tags the real verifier accepts.

Linked from AES-256-GCM, ChaCha20-Poly1305 Nonce Guard Demonstrates nonce-misuse failures and how modern AEAD usage avoids them.

Linked from ChaCha20-Poly1305 Nonce Lattice ECDSA nonce-bias lattice attack on P-256 — Hidden Number Problem, in-browser LLL reduction, private-key recovery.

Elliptic Curves

Linked from P-256, secp256k1 NTRU Classic Lattice-encryption intuition builder for NTRU-style designs and their deployment tradeoffs.

Linked from SMAUG-T Oblivious Shelf Private retrieval and access-pattern leakage intuition.

Linked from Computational PIR, Information-Theoretic PIR Opaque Gate Password-authenticated key exchange walkthrough with transcript-hardening patterns.

Elliptic Curves

Linked from Curve25519 / X25519 ORAM Vault Access-pattern privacy walkthrough showing where PIR and ORAM solve different leakage problems.

Linked from Computational PIR, Information-Theoretic PIR Order Leak A column you can still sort or match on has published the shape of its answers: BCLO OPE and CLWW ORE beside AES-SIV, where equality, order and a public distribution hand back plaintext cell by cell without the key being touched.

Linked from AES-256-GCM-SIV OT Gate Oblivious transfer foundations used in private protocols and MPC.

Linked from Base Oblivious Transfer, OT Extension OTP Vault One-time pad with provable perfect secrecy, then the two-time-pad break recovering both plaintexts from a reused keystream.

Linked from ChaCha20-Poly1305 Padding Oracle Shows why authenticated encryption closes oracle-style decryption side channels.

AsymmetricSymmetric

Linked from AES-256-GCM, RSA-OAEP-2048 Paillier Gate Additive homomorphic encryption walkthrough for the Paillier building blocks used in threshold ECDSA systems.

Linked from DKLS23, GG20 Pairing Gate Pairing-friendly curve intuition and protocol use in advanced signatures.

Elliptic CurvesThreshold Sigs

Linked from BLS Threshold, BLS12-381 PAKE Gate Side-by-side tour of the SRP-6a, J-PAKE, CPace, and Dragonfly PAKEs, deriving a strong shared key from a low-entropy password that never crosses the wire.

Elliptic Curves

Linked from Curve25519 / X25519 Patron Shield Privacy-preserving analytics and encrypted processing intuition.

Linked from TFHE Phantom Vault Hashing and key-derivation pitfalls visualized in a practical data-protection workflow.

Linked from SHA-256 PKI Chain Certificate-chain and trust-anchor mechanics for signature verification workflows.

Elliptic Curves

Linked from Ed25519 Point Arithmetic Interactive elliptic-curve point addition and scalar multiplication over both the reals and a finite field, building the ECDLP intuition beneath ECDH and ECDSA.

Elliptic Curves

Linked from Curve25519 / X25519 Point Ledger Quantum resource estimates for secp256k1 beside a classical multiplication dialog, and where fuzz-test evidence stops supporting a Fiat-Shamir soundness claim.

Elliptic Curves

Linked from secp256k1 Poly1305 MAC One-time authenticator intuition and key/nonce handling discipline.

Linked from Poly1305 Polynomial Forge KZG on BLS12-381 with a real multi-party powers-of-tau ceremony, a toxic-waste forgery that passes the transcript audit, and an unenforced degree bound.

Linked from Bulletproofs, PLONK (zk-SNARK), zk-STARK Power Trace Recovers an AES-128 key byte with CPA/DPA power side-channel analysis against a correct, constant-time cipher.

Linked from AES-256-GCM PQ Chooser Set what constrains you and get a shortlist of two or three post-quantum schemes, built from sizes it derives by running ML-KEM, ML-DSA, Falcon and SLH-DSA in your browser rather than quoting a table.

Linked from ML-DSA-87 (Dilithium), ML-KEM-512 (Kyber)PQ Families Guided tour of the five post-quantum families — lattice, code-based, hash-based, multivariate, and isogeny — with assumptions and standardization status.

Linked from ML-KEM-768 (Kyber)PQ Rotation Operational rotation planning for moving production key exchange and data protection to PQ-safe systems.

Linked from ML-KEM-768 (Kyber)PQ TLS Handshake Hybrid TLS handshake walkthrough showing where ML-KEM fits into post-quantum transport migration.

Linked from ML-KEM-768 (Kyber)PQXDH Wire One ML-KEM-1024 secret added to the X3DH transcript is what survives a future curve break. The prekey signature and the ratchet after it are untouched, so Bob can still be impersonated with every check green.

Linked from ML-KEM-1024 (Kyber)Privacy Pass A VOPRF over P-384 with a DLEQ proof (RFC 9578): the token proves the issuer authorised someone without the issuer, the origin, or the two colluding learning who. Remove the client's blind and nothing on the wire changes.

Elliptic Curves

Linked from P-384 Proof Tally Prio3: additive shares hide a measurement and will happily add a lie to the total, until a fully linear proof carried in the same shares lets two aggregators reject a malformed report neither of them can read.

Linked from Additive Sharing Protocol Checker Dolev-Yao symbolic model checker that rediscovers the Diffie-Hellman MITM and Lowe's Needham-Schroeder attack, then closes each with one fix.

Elliptic Curves

Linked from Curve25519 / X25519 Protocol Compose Composability failure modes and safe protocol-combination patterns.

Linked from Yao's Garbled Circuits PSI Gate Private set intersection workflow built from practical two-party secure computation patterns.

Linked from ABY Pulse Chain Verifies drand rounds with a BLS12-381 pairing and recomputes real NIST Beacon 2.0 pulses byte by byte, then shows what no check proves: whether the operator knew first.

Linked from BLS Threshold Quantum Entropy Beam-splitter QRNG with min-entropy accounting, von Neumann debiasing, and a Toeplitz extractor feeding a DRBG seed per NIST SP 800-90B/C.

Linked from Fortuna Quantum Vault KPQC Interactive post-quantum KEM comparison and security intuition builder.

Linked from ML-KEM-768 (Kyber), SMAUG-T Ratchet Wire Double-ratchet style key update and session-forward-secrecy walkthrough.

Elliptic Curves

Linked from Curve25519 / X25519 Regex Veil — FTE Format-transforming encryption: compiles a regex to a minimal DFA, counts its length-n language exactly, and enciphers AES-256-CTR bytes into that slice with FF1 — plus the substitution attack proving nothing is authenticated.

Linked from AES-256-GCM Rekey Relay BBS98 proxy re-encryption is ElGamal with the ciphertext components swapped — shown here beside AFGH on the same curve.

AsymmetricElliptic Curves

Linked from BLS12-381, ElGamal Reshare Circle Proactive secret sharing that reshares Shamir shares to refresh them without changing the underlying secret.

Linked from Shamir's Secret Sharing Return Path Impossible differentials and the boomerang attack on a toy SPN, with DDT and BCT tables computed live and an adaptive chosen-ciphertext oracle.

Linked from AES-256-GCM Ring Sign Signer anonymity and ring-formation tradeoffs in signature protocols.

Elliptic Curves

Linked from Ed25519 RSA Forge RSA encryption/signature behavior, padding pitfalls, and parameter intuition.

Linked from RSA-OAEP-2048, RSA-OAEP-4096 RSA Small Roots Textbook-RSA contrast: exact integer lattices recover a known-prefix exponent-3 message suffix or larger-prime high bits, with finite bounds, norm certificates and public verification. Does not implement or attack RSA-OAEP; incomplete searches remain inconclusive.

Linked from RSA-OAEP-2048 S-Cloud+ Vault Post-quantum KEM workflow for long-lived cloud storage and envelope-encryption planning.

Linked from ML-KEM-1024 (Kyber)Salamander Invisible-salamanders key-commitment attack: one AES-GCM ciphertext that opens to two valid plaintexts under two keys.

Linked from AES-256-GCM SAT Break Structural cryptanalysis contrast: a real CaDiCaL WASM solver enumerates keys fitting public pairs for an 8-bit toy SPN, with direct withheld checks and exhaustive-set comparison. Implements neither AES nor an attack on AES; caps and cancellations remain incomplete.

Linked from AES-256-GCM Schnorr Forge BIP-340 Schnorr signing and verification on secp256k1, with the step-by-step signing equation, nonce-reuse key recovery, and the linearity behind multisig.

Elliptic Curves

Linked from secp256k1 Search Vault An encrypted inverted index the server searches without a key, then the count and IKK leakage-abuse attacks turn the observed access pattern back into the queries.

Linked from Computational PIR Sector Vault XTS-AES as full-disk encryption actually uses it, and the three attacks it silently returns plaintext for — then AES-GCM added to show which two that stops.

Linked from AES-256-GCM Shadow Vault Applies XChaCha20-Poly1305 in a deniable-encryption workflow.

Linked from XChaCha20-Poly1305 Shamir Gate Threshold splitting and reconstruction flow with share-loss failure modes.

Linked from Shamir's Secret Sharing Shamir vs FROST Contrasts Shamir secret-sharing reconstruction, which forms the key in memory, against FROST threshold signing, which never reconstructs it.

SharingThreshold Sigs

Linked from FROST, Shamir's Secret Sharing Shelf Oracle Hand-rolled BFV over Z_q[X]/(X^n+1) driving single-server PIR, with parameters checked against the HomomorphicEncryption.org 128-bit row and a noise budget you can exhaust.

Linked from BFV, Computational PIR Shor Quantum attack intuition motivating migration from classical public-key systems.

Linked from ML-KEM-768 (Kyber)Signed Bytes Signs JSON with Ed25519 to show a signature binds exact bytes, not meaning — breaking key order, Unicode, and duplicate-key parsing, then applying JCS (RFC 8785) canonicalization to see which failures it fixes and which it refuses.

Elliptic Curves

Linked from Ed25519 Silent Tally Secure tallying flow and privacy-preserving aggregation intuition.

Linked from SPDZ Simon's Period Exact statevector Simon's algorithm recovering a hidden XOR period in O(n) queries, then using it to predict an Even-Mansour ciphertext and forge a CBC-MAC tag.

Linked from CMAC-AES-256 Sleeve Check GOST published Kuznyechik's 256-byte S-box as a bare table. It falls out of four small constants and field arithmetic — evidence about how it was designed, which is not by itself an attack.

Linked from Kuznyechik, Streebog SM2 Forge Reads the SM3 identity digest that precedes every SM2 signature, signs and encrypts under GB/T 32918, compares both deployed ciphertext orders, then recovers a key from a reused nonce.

Linked from SM2 Encryption, SM3 SM9 Forge SM9 identity-based signatures, key exchange and encryption over a BN256 pairing curve, run against the standard's own worked examples — with key escrow by construction and a nonce-reuse recovery.

Elliptic Curves

Linked from BN254 SNARK Arena Groth16 and PLONK trusted-setup workflow, proof generation, and verification comparison.

Linked from Groth16 (zk-SNARK), PLONK (zk-SNARK)SPAKE Gate SPAKE2 balanced PAKE that establishes a shared key from a low-entropy password without leaking it.

Elliptic Curves

Linked from Ed25519 SPDZ Forge Malicious-secure SPDZ with Beaver triples and information-theoretic MACs that abort on a tampered share under a dishonest majority.

Linked from SPDZ SPHINCS+ Ledger Hash-based signature workflow with larger signatures and conservative assumptions.

Linked from SLH-DSA (SPHINCS+)Sphinx Mix Sphinx mix-network packets over ristretto255 — per-hop blinding, a fixed-length header, a LIONESS payload — then traffic analysis that traces a sender anyway.

Elliptic Curves

Linked from Curve25519 / X25519 Split Point Secret-share a function rather than a value: two DPF keys each evaluate to shares of one-at-alpha and zero everywhere else, so two non-colluding servers fold 65,536 records and neither learns which one you read.

Linked from Information-Theoretic PIR SSH Handshake SSH transport handshake with ephemeral X25519/ECDH, Ed25519 signatures over the exchange hash, and TOFU host-key pinning.

Elliptic Curves

Linked from Curve25519 / X25519, Ed25519 STARK Tower Transparent zk-STARK proving flow with AIR and FRI components explained.

Linked from zk-STARK Stego Suite Steganography tradeoffs, payload limits, and detection-risk intuition.

Linked from LSB Substitution Stream Ward Streaming AEAD over large files with XChaCha20-Poly1305 secretstream, showing how per-segment tags still verify after reorder, drop, or truncation until a chained state binds them.

Linked from XChaCha20-Poly1305 Syndrome Drain How code-based KEMs erode below NIST Level 1 when one key derives many session keys, with DOOM decoding one of D syndromes √D faster.

Linked from BIKE, HQC Syndrome Hints Information-set decoding (Prange and Stern) against syndrome decoding over F₂, with leaked side-channel hints sliding the work factor from exponential toward polynomial.

Linked from Classic McEliece TC26 Pair Hypericum, a stateless hash-based TC26 proposal built over Streebog, beside code-based Shipovnik.

Linked from SLH-DSA (SPHINCS+), Streebog Threshold Decrypt Distributed decryption workflow with quorum requirements and availability tradeoffs.

MPCSharingThreshold Sigs

Linked from GG20, Shamir's Secret Sharing, SPDZ Threshold ML-DSA Threshold post-quantum signing walkthrough for distributed ML-DSA key ownership.

Linked from ML-DSA-44 (Dilithium), ML-DSA-65 (Dilithium)Time Trust Drives real Ed25519 certificate and token verification from one movable clock, showing which security decisions silently depend on time — an input a signature cannot authenticate — while the signature itself verifies at every clock position.

Elliptic CurvesMAC

Linked from Ed25519, HMAC-SHA-256 Time-Lock Puzzle RSW time-lock puzzle sealing a message behind fixed sequential squaring work, with a fail-closed cheat check and the creator's instant factorization trapdoor.

Linked from HMAC-DRBG Timing Oracle Side-channel timing intuition and constant-time verification discipline.

Linked from HMAC-SHA-256 Timing Side-Channel Recovers a secret one byte at a time from an early-exit comparison, then flattens the leak with a constant-time compare — the discipline behind MAC verification.

Linked from HMAC-SHA-256 TLS Handshake Full TLS 1.3 handshake with X25519 key exchange, Ed25519 authentication, the HKDF key schedule, and AES-GCM records, including a blocked man-in-the-middle.

Elliptic Curves

Linked from Curve25519 / X25519 Token Tell Runs the real SynthID-Text keyed detector over watermarked text, then signs the same words with ECDSA P-256: change only the key and the statistical evidence vanishes; change one byte and verification fails outright.

Elliptic Curves

Linked from P-256 Traitor Trace NNL subset-cover broadcast encryption with AES-256-GCM key wraps, revocation without rekeying, and black-box traitor tracing.

Linked from AES-256-GCM VDF Verifiable Delay Function via repeated modular squaring with a Wesolowski proof — slow sequential evaluation, instant verification, for randomness beacons.

Linked from HMAC-DRBG Vector Gate Five RFC 8032 vectors pass while a pinned Wycheproof S + L signature is still accepted, until the canonical scalar range check is restored — what a green known-answer test does and does not establish.

Elliptic Curves

Linked from Ed25519 Vigenère Break Recovers a repeating-key Vigenère cipher with Kasiski examination, the index of coincidence, and per-column frequency analysis.

Linked from AES-256-GCM VRF Gate Verifiable randomness and unpredictability guarantees in distributed systems.

Linked from HMAC-DRBG VSS Gate Verifiable sharing workflow with commitments and complaint handling.

Linked from Feldman VSS, Pedersen VSS Web of Trust PGP-style trust graph for signing keys and walking introduction chains, showing how trust flows without a central authority.

Elliptic Curves

Linked from Ed25519 WebAuthn Passwordless FIDO2/WebAuthn authentication with ES256 (P-256) keys, covering attestation, assertion, and platform vs cross-platform authenticators.

Elliptic Curves

Linked from P-256 WEP Crack Historical stream-encryption contrast: generated WEP protected bodies show RC4 nonce reuse, CRC-32 forgery and bounded PTW key recovery. Implements WEP, not ChaCha20-Poly1305; no real-network capture intake.

Linked from ChaCha20-Poly1305 What Is PQC A beginner runs real ML-KEM-768 beside X25519, derives wire sizes and sees that post-quantum key agreement still does not authenticate its peer. No current X25519 break or stronger-lock claim.

Linked from ML-KEM-768 (Kyber)World Ciphers Cipher family comparison with design and deployment tradeoff context.

Linked from AES-256-GCM World Hashes Cross-standard hash overview and algorithm family context.

Linked from BLAKE2b, BLAKE3, SHA-256 X3DH Wire Signal-style asynchronous key agreement built on Curve25519.

Elliptic Curves

Linked from Curve25519 / X25519 ZK Arena Side-by-side comparison of zk-SNARK and zk-STARK proof systems across setup phases, proving overhead, and verification cost.

Linked from Groth16 (zk-SNARK), PLONK (zk-SNARK), zk-STARK ZK Proof Lab Zero-knowledge construction walkthrough spanning commitments and proof mechanics.

Linked from Bulletproofs