Secret-Key Cryptography

A secure system draws on many areas: mathematics, physics, computer science, networking and law. Cryptography is the part this course treats, with physical security, governance and implementation quality built around it.

For most of its history cryptography was an art of clever designs. The Caesar cipher, ENIGMA and the one-time pad were each proposed and each measured by how long they resisted ad hoc attack. Modern cryptography, built from the 1980s on by Goldwasser, Micali, Goldreich and others, turned the subject into a science with a repeatable method:

• State a precise definition of what it means for the scheme to be secure.
• Propose a construction.
• Prove that any attack violating the definition would solve a problem assumed hard.

A scheme is accepted because an attack would solve a problem believed hard. When a scheme falls, the failure identifies a gap in the definition, which is then strengthened to exclude that attack.

The running setting of this chapter is secret-key encryption. Alice wants to send a message $m$ to Bob over a channel Eve can listen to, and later modify. Alice and Bob first share a secret key $k$. Encryption turns $m$ into a ciphertext $c = \Enc(k, m)$; decryption recovers $m = \Dec(k, c)$. Correctness requires

$$\Dec\big(k, \Enc(k, m)\big) = m \qquad \text{for every } m.$$

Kerckhoffs's principle fixes where the secrecy lives: the algorithms $\Enc$ and $\Dec$ are public, and security rests on the key alone. Algorithms are large, hard to keep secret and slow to change once leaked; a key is small and can be redrawn.

The adversary is modeled as a probabilistic polynomial-time machine: it flips coins. Its running time is bounded by a polynomial in the security parameter $\lambda$. The parameter indexes the key length and the adversary's budget at once. Success must be negligible:

$$\negl(\lambda) < \frac{1}{p(\lambda)} \quad \text{for every polynomial } p \text{ and all large enough } \lambda.$$

The function $2^{-\lambda}$ is negligible; $1/\lambda$ is not. An advantage of $1/\poly(\lambda)$ is a break. An advantage of $\negl(\lambda)$ is noise.

Security depends on the definition. Perfect secrecy, indistinguishability under chosen-plaintext attack, unforgeability and collision resistance are each a game with a winner. Each construction below is measured against its game. The sections follow the history: a weak definition is stated, a scheme satisfies it, an attack outside the definition appears and the definition is strengthened.

The strongest guarantee an encryption scheme can give makes no assumption about the adversary's computing power. Shannon stated it in 1949: the ciphertext reveals nothing about the plaintext.

The definition is information-theoretic and unconditional: it holds against an unbounded adversary. It is achievable. The cost is unconditional too.

No design choice evades the bound. Reusing a key adds another cost outside the theorem. Encrypting two messages under the same key leaks the relation between them (section 3 makes the leak explicit), so perfect secrecy demands one fresh key per message. Sending $n$ bits in confidence requires $n$ secret bits already shared over a confidential channel. Key distribution therefore becomes circular.

The escape is to weaken the guarantee in the controlled way of section 1: bound the adversary to polynomial time and ask that its advantage be negligible. One short key can then encrypt polynomially many messages, and security rests on a computational assumption.

Shannon's bound is tight: a scheme achieves perfect secrecy with a key exactly as long as the message. The scheme is the one-time pad, which predates the theorem.

Every ciphertext is consistent with every message of the same length, each under its own equally likely key. An unbounded adversary holding $c$ can do no better than sample from the prior, so the pad meets Shannon's bound with equality.

A block cipher is a family of permutations indexed by a key. For each $k \in \mathcal{K}$, the map $\Enc(k, \cdot)$ permutes the block space $\bits^n$, and $\Dec(k, \cdot)$ is the inverse permutation. The AES finalist Rijndael, standardized by The US National Institute of Standards and Technology (NIST) in 2001, fixes the block size at $n = 128$ bits and admits keys of 128, 192 or 256 bits, with 10, 12 or 14 rounds respectively. The state is viewed as a $4 \times 4$ matrix of bytes, filled column by column: $s_{r,c} = m_{r + 4c}$.

Common mistake. AES was designed in secret by the United States government. NIST ran an open worldwide competition from 1997 to 2000 and announced the winner, Rijndael by the Belgian cryptographers Joan Daemen and Vincent Rijmen, on October 2, 2000.

Each round applies four steps. SubBytes supplies confusion; ShiftRows and MixColumns supply diffusion; AddRoundKey mixes in key material:

• SubBytes substitutes every byte through the S-box, the only nonlinear step in the round.
• ShiftRows rotates row $r$ left by $r$ positions, moving bytes that shared a column into four different columns.
• MixColumns multiplies each column by the fixed polynomial $03\,X^3 + 01\,X^2 + 01\,X + 02$ modulo $X^4 + 1$, so one changed input byte changes four output bytes.
• AddRoundKey XORs a round key into the state.

ShiftRows and MixColumns together spread each byte's influence across the whole state. The initial round is key whitening. The final round omits MixColumns.

What went wrong. Software AES lookup tables leak key bytes through cache timing (Bernstein 2005; Osvik, Shamir and Tromer 2006). Ship constant-time code or hardware AES instructions such as AES-NI.

The S-box is derived. The lab below derives one entry live. Take the multiplicative inverse of the input byte in $\GF(2^8)$ modulo $X^8 + X^4 + X^3 + X + 1$, with $0$ mapped to $0$, then apply a fixed affine transformation over $\GF(2)^8$. The inverse supplies nonlinearity. The affine map removes the algebraic regularity that would make the inverse itself too structured. The round keys come from the key schedule: words $W[4i]$ are formed from $W[4i-4]$ and a function $g$ of $W[4i-1]$ consisting of a byte rotation, an S-box pass and a round constant, while the remaining words are XORs of the previous word and the word four positions back.

Worked number. The Data Encryption Standard (DES) of 1977 has $2^{56}$ keys: one trillion guesses per second exhausts them in about 20 hours. The same rate against $2^{128}$ AES keys needs about $1.1 \times 10^{19}$ years, roughly 800 million times the age of the universe.

AES has no proof of security. No practical attack on full-round AES is known. Its standing comes from public scrutiny and from the failure of proposed attacks to improve substantially on exhaustive search. The stage below steps through one full round on the FIPS-197 (Federal Information Processing Standard 197) test vector, with every byte computed from the field arithmetic.

Common mistake. AES-256 is always the sensible default because a longer key is always stronger. A 128-bit key already puts guessing beyond any plausible budget. Real safety depends on the mode, the randomness and the implementation.

A block cipher encrypts exactly one block. Messages are longer, variable and structured, so a mode of operation says how to chain the primitive. The mode is where many deployed systems fail, because the primitive's guarantee covers one block under one key, while the mode must extend that guarantee to a whole transcript.

ECB (Electronic Codebook) encrypts each block independently: $c_i = \Enc(k, m_i)$. It is deterministic and parallel. It leaks equality of plaintext blocks: $m_i = m_j$ gives $c_i = c_j$. The classic demonstration encrypts a bitmap image under ECB: runs of equal pixel blocks stay equal after encryption, so the outline of the picture survives in the ciphertext. ECB is unusable for anything with structure.

Common mistake. ECB is safe when the key is strong. ECB encrypts every block independently, so equal plaintext blocks give equal ciphertext blocks whatever the key. Use a mode with an initialization vector (IV) so identical blocks encrypt differently.

CBC (Cipher Block Chaining) feeds the previous ciphertext into the next XOR: $c_i = \Enc(k, m_i \oplus c_{i-1})$, with $c_0 = \mathrm{IV}$ a fresh random initialization vector. Equal plaintext blocks now enter the cipher with different masks. Encryption is strictly sequential, because block $i$ waits for $c_{i-1}$; decryption parallelizes, since $m_i = c_{i-1} \oplus \Dec(k, c_i)$ reads blocks in any order.

Worked number. Decryption computes $P_2 = D(C_2) \oplus C_1$. An attacker who XORs the second byte of $C_1$ with $\mathrm{0x01}$ flips the lowest bit of the second byte of $P_2$, while $P_1$ becomes garbage.

CFB (Cipher Feedback) and OFB (Output Feedback) turn the block cipher into a keystream generator. CFB encrypts the previous ciphertext and XORs the result with the next plaintext segment; OFB encrypts an internal state repeatedly and XORs the output with plaintext. Both allow segment sizes below one block. In CFB, later keystream segments depend on earlier ciphertexts; OFB's keystream depends only on the key and IV. CTR (Counter) is the cleanest of the group: it encrypts successive counters, $c_i = m_i \oplus \Enc(k, \alpha + i)$, for a fresh nonce $\alpha$. Every block is independent, so encryption and decryption parallelize fully, and any single block can be recovered alone.

Worked number. One keystream byte $K$ encrypts $\mathrm{0x41}$ to $C_1 = \mathrm{0x41} \oplus K$ and $\mathrm{0x00}$ to $C_2 = K$ under a reused nonce. The attacker computes $C_1 \oplus C_2 = \mathrm{0x41}$, the XOR of the two plaintexts.

The common failure across CBC, CFB, OFB and CTR is reuse of the IV or nonce under one key. The damage differs by mode:

• CTR and OFB generate a keystream that depends only on the key and the IV or nonce. If the same pair serves two messages, the XOR of the two ciphertexts cancels the keystream and leaves the XOR of the two plaintexts, the two-time pad of section 3. The break is total.
• CBC and CFB leak less: a repeated IV exposes the first block of each message and any common prefix, because equal plaintext blocks chain to equal ciphertext blocks until the messages first differ.
• CBC has a stronger requirement still. The IV must be unpredictable, because a predictable IV lets the adversary cancel the first block's mask inside the chosen-plaintext (CPA) game of section 6.

Freshness of the IV or nonce is part of the key discipline. The stage and lab below make the contrast visible.

Common mistake. The IV is part of the secret key material. IVs and nonces travel in the clear next to the ciphertext; counter mode demands uniqueness and CBC demands unpredictability. Secrecy applies to the key alone.

Eavesdropping is the weakest adversary. The standard confidentiality game gives Eve an encryption oracle: she may submit any plaintexts and receive their ciphertexts under the unknown key, before and after the challenge. This models known plaintext, chosen headers and any data the adversary can cause the system to encrypt.

Deterministic encryption fails the game immediately. If $\Enc$ is a function of $m$ alone, $\mathcal{A}$ queries the oracle on $m_0$, compares the answer with $c^*$ and wins with probability $1$. ECB fails for this reason, and so does any mode with a fixed IV. CPA security requires fresh randomness inside every encryption: the same plaintext must be able to produce many ciphertexts.

CBC with a fresh unpredictable IV and CTR with a fresh unique nonce both satisfy IND-CPA, assuming the underlying block cipher behaves as a pseudorandom permutation: with a random key, no polynomial-time test can tell it from a uniformly random permutation. The IV in CBC must be unpredictable, because a predictable IV lets the adversary cancel the first block's mask; the nonce in CTR must be unique, because reuse recreates the two-time pad.

What went wrong. BEAST (CVE-2011-3389, 2011) exploited predictable CBC IVs in Transport Layer Security (TLS) 1.0 to decrypt secret bytes. Random IVs remove the guessing channel.

Confidentiality hides content; authenticity detects modification. From this section on, Eve also writes: she can alter, replay or inject ciphertexts in transit. A message authentication code lets Bob check that the message he received is the one Alice sent. Alice and Bob share a key $k$; Alice appends a tag computed from the message and the key, and Bob recomputes it.

Encryption alone gives no authenticity. A ciphertext is malleable whenever decryption is linear in it: for the one-time pad, flipping bit $i$ of $c$ flips bit $i$ of the recovered plaintext, and Eve needs neither the key nor the plaintext. For CBC, modifying one ciphertext block corrupts the next plaintext block in a controlled way. A MAC makes such edits detectable.

Common mistake. Encryption also gives integrity, since tampering just turns the plaintext into garbage. Cipher block chaining (CBC) and counter (CTR) modes are malleable: flipping a ciphertext bit flips a predictable plaintext bit. Detect edits with a MAC.

The unforgeability game is existential: the adversary wins by forging a tag on any fresh message, even a meaningless one. The tag need not relate to any message the adversary understands. A verifier cannot tell meaningful forgeries from meaningless ones, so this is the right strength for composition. The tag oracle models all valid tags Eve can obtain by sending messages through the system or observing traffic. A secure MAC stays unforgeable after polynomially many such queries.

The block cipher already in hand can be turned into a MAC. CBC-MAC runs CBC encryption with a fixed zero Initialization Vector (IV) over the message blocks and outputs the final ciphertext block as the tag. For a one-block message, $\Tag(k, m) = \Enc(k, m)$; for two blocks, $\Tag(k, m_1 \| m_2) = \Enc(k, \Enc(k, m_1) \oplus m_2)$.

The security proof requires every message to have the same length. When messages of different lengths are accepted under one key, the chain becomes a tool for the adversary. Two tag-oracle queries set up a forgery on a message that was never queried:

Verification runs the two-block chain: the first block reproduces $\tau_1$. The second block feeds $\tau_1 \oplus m_2 = q$ into the cipher, so the final value is exactly $\tau_2$. The lab below runs the algebra with a live block cipher pass.

Two standard repairs exist. The first encrypts the final chaining value under an independent key, $\Tag(k, k', m) = \Enc(k', \mathrm{CBC\text{-}MAC}_k(m))$; the oracle no longer hands over raw intermediate values, and the two-query recipe cannot start. The second, Cipher-Based MAC (CMAC), derives two subkeys from the block cipher and treats the last block differently depending on whether it is full, which also fixes the padding ambiguity. Both keep the efficiency of CBC-MAC while restoring unforgeability for variable-length messages.

A hash function compresses arbitrary-length input to a fixed-length digest. Cryptography studies three common security properties.

Collision resistance implies second-preimage resistance: an algorithm that finds a second preimage for a given $x$ already outputs a colliding pair. The converse fails, because a collision finder may choose both inputs freely. The two notions have different costs. A preimage search over an $n$-bit digest takes about $2^n$ trials. A collision search takes about $2^{n/2}$ trials, by the birthday bound.

The bound sets digest lengths. A 128-bit digest gives about $2^{64}$ work to find a collision, which is within reach of a determined adversary; 256 bits pushes the cost to $2^{128}$. It also explains why collision resistance is the property used in signatures and commitments: the adversary gets to choose both colliding documents, so the defender must price the birthday attack. The price is the square root of the digest space.

Hashing is unkeyed. Anyone can compute $\Hash(x)$, so a bare digest binds nothing to anyone. The next sections add a key for authentication and a domain transform for arbitrary lengths.

Collision resistance was defined for a function on all bit strings, while the constructions in hand compress one fixed-size block. The Merkle-Damgard transform iterates a compression function $\mathbf{cmps} : \bits^\ell \times \bits^{\ell'} \to \bits^\ell$ over the message. Split the input into $\ell'$-bit blocks, start from a fixed initial value $z_0 = 0^\ell$ and compute $z_i = \mathbf{cmps}(z_{i-1}, x_i)$. A final block records the total message length. The digest is the last chaining value.

The length block is what makes the proof go through. Without it, two messages that share a prefix could collide at different stopping points; with it, a collision in $\Hash$ can be traced back through the chain to a collision in one call to $\mathbf{cmps}$. SHA-1 and SHA-2 (Secure Hash Algorithm versions 1 and 2) are built this way, with different compression functions and digest lengths. Collision attacks break SHA-1. SHA-2 uses a different compression function that has resisted practical collision attacks.

The same structure that gives the proof also gives the length-extension property. The digest is the final chaining value. The compression function is public. Anyone holding $\Hash(x)$ and the length of $x$ can continue the chain: start from the digest, absorb extra blocks and obtain $\Hash(x \| \mathrm{pad} \| x')$ without knowing anything about $x$. For a bare digest this is a curiosity. For the naive MAC $\Tag(k, m) = \Hash(k \| m)$ it is a forgery: Eve holds one valid tag, extends the message and computes the tag of the extended message herself. The stage below shows the chain being continued from the tag.

SHA-3, standardized by NIST in 2015 after the Keccak selection, replaces the Merkle-Damgard chain with a sponge. The state holds $b$ bits, split into a rate $r$ and a capacity $c$, with $b = r + c$. SHA-3 fixes $b = 1600$. Message blocks of $r$ bits are XORed into the rate. The whole state passes through a fixed permutation $\mathbf{f}$ after each absorption. When the message is exhausted, output bits are squeezed from the rate, applying $\mathbf{f}$ again whenever more output is needed.

The capacity is the security parameter. Message bits touch the rate alone, so the capacity stays hidden inside the state. Generic attacks on an ideal permutation succeed with probability about $q(q-1) \cdot 2^{-(c+1)}$ in $q$ calls, so $c = 512$ sets a $256$-bit capacity security bound. Output length can impose a lower bound, as it does for collision resistance of SHA-3-256. One construction serves several digest lengths by changing the rate: SHA-3-224, SHA-3-256, SHA-3-384 and SHA-3-512 use capacities $448$, $512$, $768$ and $1024$ respectively. The squeezing phase can produce any requested output length.

The hidden capacity removes the Merkle-Damgard extension property. A SHA-3 digest reveals only the rate portion of the final state; the capacity portion is never output, so there is no chaining value an adversary can continue from. The naive MAC $\Hash(k \| m)$ is still unwise, because other attacks exist, and section 12 gives the keyed construction to use. The permutation itself, Keccak-f[1600], is 24 rounds built from the steps $\theta, \rho, \pi, \chi, \iota$, using XOR, AND and NOT on a $5 \times 5$ array of 64-bit lanes.

Two naive ways to key a hash both fail:

• $\Tag(k, m) = \Hash(k \| m)$ falls to length extension (section 10). Eve holds one valid tag, extends the message and computes the tag of the extended message without knowing $k$.
• $\Tag(k, m) = \Hash(m \| k)$ falls to collisions. The hash is public, so a collision $m, m'$ found offline carries over to the keyed tag whatever the key: equal chaining values where $k$ is absorbed give equal tags.

HMAC is the standard repair, used in TLS (Transport Layer Security), IPsec (Internet Protocol security) and most protocols that need a symmetric authenticity tag from a hash function. It hashes the message with an inner key, then hashes the result with an outer key:

$$\mathrm{HMAC}(k, m) = \Hash\big((k \oplus \mathit{opad}) \,\|\, \Hash((k \oplus \mathit{ipad}) \,\|\, m)\big).$$

The key is first brought to the block size of the hash: keys longer than the block are hashed, shorter keys are padded with zeros. The constants $\mathit{ipad}$ and $\mathit{opad}$ are the bytes $0x36$ and $0x5c$ repeated across the block.

The double hash is what blocks extension. The inner digest $\Hash((k \oplus \mathit{ipad}) \| m)$ is exactly a Merkle-Damgard chaining value, so an adversary holding it could extend it if that were the tag. The outer hash consumes the inner digest as input, and its own chaining value starts from $k \oplus \mathit{opad}$, which the adversary does not know. Extending the final tag would require continuing a chain whose initial value is secret.

HMAC's security is analyzed as a pseudorandom function (PRF), a keyed family that no polynomial-time test can tell from a uniformly random function. If the compression function of the underlying hash is a good PRF, then HMAC is a PRF. A PRF with output length $n$ gives a MAC whose best forgery probability after $q$ attempts is about $q / 2^n$. The construction works with any Merkle-Damgard hash and with the sponge, where the extension problem never existed; the keyed sponge construction KMAC takes that route for SHA-3.

The strongest standard game adds a decryption oracle to the CPA game of section 6: Eve may submit ciphertexts of her choice and learn their plaintexts, with the single restriction that she may not submit the challenge ciphertext itself. This is IND-CCA. It models padding oracles, protocol endpoints that decrypt and react and any situation where Eve can observe the effect of a modified ciphertext.

The padding oracle is the concrete instance. CBC decryption checks padding only after decrypting, so a server that reports whether the padding is valid gives Eve one bit per query. She adjusts one ciphertext byte at a time until the check passes. Each pass reveals one plaintext byte: at most 256 tries per byte and 16 bytes per block, so at most $256 \times 16 = 4096$ oracle queries recover a whole block, against $2^{128}$ work for a key search. Authenticated encryption with associated data (AEAD) closes the hole by withholding plaintext until authentication succeeds.

What went wrong. POODLE (CVE-2014-3566, 2014) turned a padding validity signal into byte-by-byte CBC decryption, building on Vaudenay's 2002 attack. Verify a message authentication code before processing padding.

Authenticated encryption is the composition target: one scheme providing both IND-CPA confidentiality and ciphertext integrity. The composition that works is encrypt-then-MAC. Encrypt under one key, tag the ciphertext under a second key and send $(c, \tau)$. Verification rejects any ciphertext whose tag does not check, before decryption ever runs. The decryption oracle of the CCA game is then useless to Eve: any ciphertext she did not create herself carries a fresh valid tag with negligible probability, and the MAC's unforgeability is exactly the statement that she cannot create one. The theorem requires the MAC to be strongly unforgeable, so that even altering the tag on a seen ciphertext fails. IPsec uses this order.

The other two orders are fragile:

• MAC-then-encrypt hides the tag, so the receiver must decrypt before checking. The decryption step itself can leak through padding or timing. TLS used this order for its CBC suites, and padding-oracle attacks on the decrypt-then-check sequence were the result.
• Encrypt-and-MAC sends the tag of the plaintext, which may reveal plaintext information and does not cover the ciphertext. SSH uses this order.

Deployed schemes package the working order. GCM (Galois/Counter Mode) runs CTR (Counter) encryption with a universal hash authentication tag, and ChaCha20-Poly1305 does the same with a stream cipher and a one-time authenticator. Both are AEAD schemes, taking an associated data field that is authenticated in the clear. GCM limits each plaintext to about $2^{39}$ bits. Its safe per-key usage limit depends on tag length, message lengths and nonce generation. TLS 1.3 accepts only AEAD ciphers.

Worked number. GCM usually takes a 96-bit random nonce. By the birthday bound, $2^{32}$ messages (about 4.3 billion) under one key give a collision probability near $2^{-33}$, roughly one chance in 8.6 billion.

Every construction so far has rested on a block cipher assumed secure. The last step asks what the minimal assumption is and what it can build. The assumption is a one-way function: a polynomial-time computable function $f$ such that for every polynomial-time inverter, $\Pr[f(x') = f(x)]$ is negligible when $x \getsr \bits^\lambda$ and the inverter sees $f(x)$. Minicrypt is the world where one-way functions exist and public-key cryptography does not. Whether one-way functions imply public-key cryptography remains unknown.

One-way functions first yield pseudorandom generators. A PRG stretches a short seed into a longer string that no polynomial-time distinguisher can tell from uniform. The existence of one-way functions implies the existence of PRGs, by a theorem of Håstad, Impagliazzo, Levin and Luby. PRGs then yield pseudorandom functions. A PRF is a keyed function family $\PRF(k, \cdot)$ indistinguishable from a uniformly random function, given oracle access. The GGM (Goldreich-Goldwasser-Micali) construction, shown in the stage below, builds one from a length-doubling PRG by tree expansion: the input bits select a root-to-leaf path. The leaf is the output. Evaluation costs $\lambda$ PRG calls. The proof shows that any pattern of queried leaves looks random.

PRFs in turn yield pseudorandom permutations. A Feistel network builds a permutation from any function: split the block into halves, and in each round replace the right half by the left half XORed with a round function of the right half. Luby and Rackoff proved that three Feistel rounds with independent pseudorandom-function round functions give a PRP, and four rounds give a strong PRP, secure even when the adversary can query the inverse. AES is a substitution network with a similar goal. The Feistel theorem explains why a few rounds of a good keyed function suffice in principle.

One-way functions give PRGs, PRGs give PRFs and PRFs give PRPs. These primitives support encryption, modes and MACs. Collision-resistant hash functions require an additional assumption in general. The boundary of Minicrypt is the subject of Chapter 2, where public keys require assumptions believed stronger.

• Crypto 101. A free programmer-first course that builds to TLS and teaches by exploiting real flaws.
• CryptoHack Symmetric course. Interactive: rebuild AES from its parts, then attack ECB, CBC and stream misuse.
• The Joy of Cryptography (Rosulek). A free undergraduate textbook anchored in the one-time pad and game-based definitions.
• A Graduate Course in Applied Cryptography (Boneh and Shoup). Free PDF; a clean arc through stream ciphers, block ciphers, CPA, integrity and AEAD.
• Practical Cryptography for Developers (Nakov). Code-first AES, modes, AES-GCM, ChaCha20-Poly1305, Hash-Based Message Authentication Code (HMAC) and Key Derivation Functions (KDFs) with Python.
• NIST SP 800-38A, block cipher modes. The canonical definitions of ECB, CBC, CFB, OFB and CTR.
• Wikipedia: Block cipher mode of operation. Strong diagrams and per-mode property tables.
• Interactive AES pipeline (cryptii). Live in-browser AES with selectable mode, IV and padding.
• Cryptopals. Sets 2 to 4 for hands-on block and stream cipher attacks.

Further reading: Sweigart, Hacking Secret Ciphers with Python, Katz and Lindell (2015), Introduction to Modern Cryptography, Kościelny, Kurkowski and Srebrny (2013), Modern Cryptography Primer and Kotzanikolaou and Douligeris (2007), Cryptography Primer.