Move from why RSA falls to shipping the NIST replacements yourself, with benchmarks that show what the swap really costs.
Somebody may be recording your encrypted traffic today so they can decrypt it the day a large quantum computer exists. That harvest-now, decrypt-later problem is why NIST finalised new standards in 2024, and why every system still resting on RSA and elliptic-curve keys now has a migration deadline nobody has told you how to meet. This course starts from the physics. You build intuition for qubits and measurement, then work through Shor’s algorithm — the reason factoring collapses — and Grover’s, the reason symmetric keys only need doubling. From there you build the replacements: lattices and Learning With Errors (LWE), the noisy linear algebra underneath ML-KEM, the Module-Lattice Key Encapsulation Mechanism formerly called Kyber, and ML-DSA, formerly Dilithium. You also cover hash-based signatures, code-based schemes such as McEliece, and isogenies, including the 2022 attack that destroyed SIDH overnight. You write real code throughout — LLL reduction, Regev encryption, Lamport signatures, Vélu’s formulas — and the capstone benchmarks post-quantum algorithms against RSA-2048 and Ed25519, then turns the numbers into a migration guide you could hand to a team.
Built by Lakshya Kumar
We grant free access case-by-case — students, career-switchers, builders on a tight budget. Sign in to send us a note.
Sign in to applyFinished the tasks? Take the prompt to your AI and get tested on it. We copy the prompt and open the app — just paste it in.
See exactly why factoring collapses into period-finding, and why every RSA and ECC key you ship today has a quiet expiry date.
Learn why quantum search costs symmetric crypto only a doubling of key size, so you can put the panic where it belongs.
Build the picture of short vectors and bad bases that makes every hardness claim in the new standards feel obvious rather than assumed.
Understand why adding a little noise to linear algebra creates a problem nobody, classical or quantum, knows how to solve.
Follow one key encapsulation from keygen to shared secret, and measure what replacing elliptic-curve Diffie-Hellman actually costs.
See how rejection sampling turns a leaky proof into a safe signature, and what the size jump from ECDSA does to your certificates.
Trust nothing but your hash function: build signatures from Lamport keys up to SPHINCS+, and see first-hand why reusing one key is fatal.
Meet the 1978 scheme nobody has broken yet, and weigh its very large public keys against the lattice alternatives.
Study the family with the smallest post-quantum keys and the most spectacular collapse, so you can judge tomorrow’s new schemes yourself.
Complete all modules, then submit the required number of capstone projects. Each must earn a passing rating from an admin reviewer.
Using liboqs-python, implement and benchmark keygen + encapsulate + decapsulate for ML-KEM-768 and sign + verify for ML-DSA-65 and SLH-DSA-SHA2-128f. Compare key sizes, signature sizes, and operation latencies against RSA-2048 and Ed25519. Write a 6–8 page migration guide for a system currently using RSA-2048 + ECDSA.
Implement a hybrid handshake combining ML-KEM (Kyber) with X25519 in TLS 1.3 style. Verify the shared secret matches on both sides; benchmark vs pure X25519. Document the wire-format overhead and the recommendation for production deployment.
Paste this into any AI chat. Fill in the bracketed parts with your context — you'll get back a straight answer on whether this belongs on your plate.
I'm studying Advanced Cryptography focused on post-quantum security: quantum computing foundations, Shor's algorithm, Grover's algorithm, lattice theory (LWE, SIS, Module-LWE), CRYSTALS-Kyber (ML-KEM), CRYSTALS-Dilithium (ML-DSA), hash-based signatures (XMSS, SPHINCS+/SLH-DSA), code-based cryptography (McEliece, BIKE, HQC), and isogeny-based cryptography (SIDH break, CSIDH, SQISign). Context: 1. My goal: [e.g. "migrate my system to PQC", "research lattice cryptography", "understand the SIDH break"] 2. My background: [e.g. "completed the Cryptography module", "security engineer familiar with TLS"] 3. One concept needing intuition: [e.g. "why is LWE hard?", "how does Kyber's KEM work?"] Answer: - For (3): explain in 3 paragraphs — definition, why believed hard, best known attack complexity. - What is the migration priority for RSA-2048 + ECDSA + AES-256? - Which NIST PQC standard to deploy first and why?
Implement a simplified version of an isogeny-based protocol (SIDH or CSIDH-style on a small prime). Document the math, prove correctness on small parameters, and benchmark vs a lattice-based alternative.
Implement a simplified lattice attack against a deliberately-weak parameter set (small Ring-LWE). Use LLL or BKZ; recover the secret. Document the attack pipeline and the parameter conditions under which it succeeds.
Implement bootstrapping for a basic FHE scheme (TFHE or BFV) at toy parameters. Demonstrate the noise reduction and the ciphertext refresh. Benchmark the bootstrap cost; analyze its impact on practical FHE pipelines.
The official NIST evaluation. Read to understand why specific algorithms were chosen.