Cryptography Made Simple

What Hacker News says

1. pet_the_birdMay 2026
   "Cryptography Made Simple" By Nigel Smart and "A Graduate Course in Applied Cryptography" by Dan Boneh and Victor Shoup are excellent resources for people that have affinity with Math and CS. The second resource can be a tough read, and I would strongly recommend not skipping the first few chapters.
   thread
2. xoaOct 2025
   Whew, that's actually a hard one! It's been long enough since I was getting into it that I'm not really sure what's the best present path on it. In terms of books, JP Aumasson's "Serious Cryptography" got a 2nd edition not too long ago and the first edition was good. Katz & Lindell's "Modern Cryptography" and Hoffstein's "Introduction to Mathematical Cryptography" are both standard texts that I think a lot of courses still get started with. Finally I've heard good things about Esslinger's "Learning and Experiencing Cryptography with CrypTool and SageMath" from last year and Smart's "Cryptography Made Simple", which has a bunch of helpful visuals.

   For online stuff, man is there a ton, and plenty comes up on HN with some regularity. I guess I've been a fan of a lot of the work Quanta Magazine does on explaining interesting science and math topics, so you could look through their cryptography-tagged articles [0]. As I think about it more, honestly though it might almost seem cliche but reading the Wikipedia entries on cryptography and following that along with reference to the links if you want isn't bad either.

   Just keep in mind there's plenty of pieces that go into it. There's the mathematics of the algorithms themselves. Then a lot of details around the implementations of them into working software, with efforts like the HACL* project [1] at formal mathematical verification for libraries, which then has gone on to benefit projects like Firefox [2] in both security and performance. Then how that interacts with the messy real world of the underlying hardware, and how details there can create side channels can leak data from a seemingly good implementations of perfect math. But then also that such attacks don't always matter, it depends on the threat scenarios. OTP, symmetric and asymmetric/pub-key (all data preserving), and cryptographic hash functions (which are data destroying) are all very different things despite falling under the overall banner of "cryptography" with different uses and tradeoffs.

   Finally, there is lots and lots of history here going back to well before modern computers at all. Humans have always desired to store and share information with other humans they wish while preventing other humans from gaining it. There certainly have been endless efforts to try to subvert things as well as simple mistakes made. But we've learned a lot and there's a big quantitative difference between what we can do now and in the past.

   >My (rudimentary, layman) understanding is that encryption is almost like a last line of defense and should never be assumed to be unbreakable.

   Nope. "We", the collective of all humanity using the internet and a lot of other stuff, do depend on encryption to be "unbreakable" as a first and only line of defense, either truly and perfectly unbreakable or at least unbreakable within given specified constraints. It's the foundation of the entire the global e-commerce system and all the trillions and trillions flowing through it, of secure communications for business and war, etc.

   Honestly, I'm kind of fascinated that apparently there are people on HN who have somehow internalized the notion of cryptography you describe here. I don't mean that as a dig, just it honestly never occurred to me and I can't remember really seeing it before. It makes me wonder if that feeds into disconnects on things like ChatControl and other government backed efforts to try to use physical coercion to achieve what they cannot via peaceful means. If you don't mind (and see this at some point, or even read this far since this has turned into a long-ass post) could you share what you think about the EU's proposal there, or the UK's or the like? Did you think they could do it anyway so trying to pass a law to force backdoors to be made is a cover for existing capabilities, or what? I'm adamantly opposed to all such efforts, but it's not typically easy to get even the tech literate public on-side. Now I'm curious if thinking encryption is breakable anyway might somehow play a role.

   ----

   0: https://www.quantamagazine.org/tag/cryptography/

   1: https://github.com/hacl-star/hacl-star

   2: https://blog.mozilla.org/security/2020/07/06/performance-imp...

   Show morethread
3. jeroenhdJul 2022
   To use crypto right requires knowledge of crypto systems. You're not going to know how to use crypto schemes correctly without knowing about common flaws and a range of side channel attacks. The crypto code itself is usually relatively easy to use (OpenSSL may have a clunky interface, but there are tons of examples out there). The problem here, and I'd argue actually in most cases, isn't that the libraries don't exist or are hard to use. The problem is that the people using said libraries don't know what they're doing.

   There are great books out there that will tell you everything you need to know to understand and write safe crypto code. It's not some kind of closely guarded secret kept by an exclusive elite, it just requires reading. Pirate the books if you want to stop information hoarding among the rich, it's trivially easy to do with libgen.

   You can roll your own crypto if you're capable of doing so, and have someone as competent as you check your work.

   In this case, this tweet has listed the flaws that the custom crypto implementation has: https://mobile.twitter.com/gsuberland/status/153811763597137...

   Some of these flaws aren't that bad (== vs === shouldn't matter too much in this case, though it's a sign of bad PHP code when the types are supposed to be well known). Others are either bad code practice (allowing a variable to be uninitialized) or well-known cryptographic mistakes that you'll learn to catch after reading a book or two (timing attack, shared keys). I won't pretend I would've spotted all of those at a glance, but I can admit that my crypto course has been too long ago for me to write or review such code.

   I've got a basic grasp of electrical cirtuits but that doesn't mean I should be allowed to design highly secure electronic security circuits. I will miss important problems and dangerous flaws because I lack in-depth knowledge and experience. It's not because there's not an easy 1-2-3 guide on how to design safe circuits or because a cabal of academic elites are keeping this knowledge to themselves and pretending to do so just shifts the blame for my lack of effort to others.

   Feel free to do your own crypto. Tons of companies do. You'd better put in the work to make sure you're doing it right, though! If you're working on some kind of new cryptographic structure and an academic writes up a theoretical attack in a paper somewhere, you're doing it right, assuming that you extend your scheme to solve the problems discovered. If you make textbook mistakes in important code, you're clearly doing it wrong.

   If you're interested in learning cryptography so you can try to roll your own, I recommend starting with books like these:

   - Cryptography Made Simple by Nigel Smart

   - Applied Cryptography by Bruce Schneier

   - Cryptography Engineering: design principles and practical applications by Neil Ferguson, Bruce Schneier, and Tadayoshi Kohno

   These books require some prerequisite mathematical knowledge (like all crypto does) which you can probably pick up on Khan Academy. They go in depth into how common cryptography works, why these schemes are secure and how they can be broken (in theory and in practice). Some of them are getting old, though, so you may need to find some newer material if you're doing stuff like modern elliptic curve or post-quantum cryptography.

   Show morethread
4. aildoursMay 2022
   Here are some books that I've read with some remarks which you may find useful.

   - "Cryptography: A Very Short Introduction" by Piper and Murphy - This is a book in the Very Short Introduction series, so is a bit light on the math. If that's what you are looking for though, this is a good resource.

   - "Cryptography Made Simple" by Nigel Smart - The choice of topics is quite eclectic (in the best way possible!). For ex. it is the first general crypto book I've read which talks about lattices (most post-quantum world crypto schemes are lattice based) and things like commitments and zero-knowledge proofs. Develops just the right amount of math to talk about a lot of different things.

   - "Cryptography: Theory and Practice" by Stinson and Paterson - adequate, covers the usual topics (plus a chapter on post-quantum crypto).

   - "Introduction to Modern Cryptography" by Katz and Lindell - basically a reference for the theory side of crypto. Quite math heavy (or to be more accurate, notation heavy, like theoretical crypto tends to be).

   - "Real-World Cryptography" by David Wong - I have not read another crypto book which tackles as many topics, it has chapters on e2e encryption, cryptocurrency and hardware crypto. Is a bit too hand-wavey and doesn't properly explain the math sometimes, but it is great for self-learners and people who are looking for a book on topics not covered in other books.

   - "Serious Cryptography" by Jean-Philippe Aumasson - from the No Starch Press stable. The exposition is quite good, and finds a decent balance between making it approachable and getting the details right.

   - "Understanding Cryptography" by Paar and Pelzl - decent coverage of fundamental primitives (block/stream ciphers, public key encryption, hashes, signatures etc) but feels a bit outdated. For ex. there is a whole chapter on DES.

   Show morethread
5. zahllosAug 2021
   Here's a quick overview: We have what we call primitives that achieve a certain goal. For example AES on its own does a pretty good job of being a block cipher. However it doesn't fulfil all our expectations for actual secure communication alone and for this we need to use it as part of a slightly larger scheme.

   These are the constructions tptacek refers to. How we put together the bits we have in a way that meets our expectations, which we refer to as semantic security. This doesn't just apply to AES but also to public key crypto as well. This might seem quite abstract, so let me put it this way: AES alone doesn't know if the ciphertext you feed it has been modified by an attacker. It will simply process that data with a given key. The decrypting software might notice and report an error (the message will look garbled), and there are circimstances where this can actually be exploited to reveal information. This is not what we expected to happen.

   We've learned a lot about this since the early 90s. Many modern primitives actually come with all the parts we would call a construction built in, to avoid potential misuse (although these schemes are for the most part academic right now). Almost all modern systems combine primitives like AES in such a way as to meet our expectations. Except perhaps Telegram but nobody knows what they're smoking.

   If you want an actual textbook, Introduction to Modern Cryptography by Katz and Lindell, or Cryptography Made Simple by Nigel Smart will cover this in plenty of detail, and are also good all round introductions to most areas of cryptography by leading experts. I learn towards the book by Smart, but either will be perfectly fine.

   Show morethread
6. opus132May 2020
   Nigel Smart's Cryptography Made Simple is a great book which covers elliptic curve cryptography amougst many other topics; despite its name it's a very technical book, but it's easily accessible to anyone with a CS/EE/Maths/Physics degree.

   You can grab a copy from SpringerLink for free at the moment here: https://link.springer.com/book/10.1007%2F978-3-319-21936-3

   thread