Cryptography: Comprehensive Learning Roadmap

Phase 1: Mathematical Foundations

3-4 weeks

Building the Mathematical Foundation

Number Theory Fundamentals

Divisibility and prime numbers

Greatest Common Divisor (GCD) and Euclidean algorithm

Extended Euclidean algorithm

Modular arithmetic operations

Modular exponentiation (fast exponentiation)

Chinese Remainder Theorem (CRT)

Fermat's Little Theorem

Euler's Totient Function (φ)

Euler's Theorem

Quadratic residues and Legendre/Jacobi symbols

Abstract Algebra

Groups, rings, and fields

Finite fields (Galois fields GF(p) and GF(2^n))

Cyclic groups and generators

Group homomorphisms and isomorphisms

Polynomial arithmetic over finite fields

Irreducible and primitive polynomials

Probability and Information Theory

Basic probability concepts

Random variables and distributions

Birthday paradox

Entropy and information

Conditional entropy

Perfect secrecy (Shannon's theorem)

Computational Complexity

P vs NP problem understanding

Time complexity analysis

Hard problems: factorization, discrete logarithm

One-way functions

Trapdoor functions

Phase 2: Classical Cryptography

1-2 weeks

Understanding Historical Encryption Methods

Historical Ciphers

Caesar cipher and shift ciphers

Substitution ciphers (monoalphabetic, polyalphabetic)

Vigenère cipher

Playfair cipher

Hill cipher (matrix-based)

Transposition ciphers

Enigma machine principles

Cryptanalysis Basics

Frequency analysis

Kasiski examination

Index of coincidence

Known-plaintext attacks

Chosen-plaintext attacks

Ciphertext-only attacks

Phase 3: Symmetric Cryptography

3-4 weeks

Mastering Modern Block and Stream Ciphers

Block Cipher Fundamentals

Feistel networks

Substitution-Permutation Networks (SPN)

Confusion and diffusion principles

Block cipher modes of operation

Padding schemes (PKCS#7, zero padding)

Block Cipher Algorithms

DES (Data Encryption Standard) - structure, rounds, key schedule, weaknesses

AES (Rijndael) - SubBytes, ShiftRows, MixColumns, AddRoundKey

Blowfish and Twofish

IDEA

RC5/RC6

Serpent

Camellia

ChaCha20

Modes of Operation

ECB (Electronic Codebook) - weaknesses

CBC (Cipher Block Chaining) - IV requirements

CFB (Cipher Feedback)

OFB (Output Feedback)

CTR (Counter Mode) - parallelization advantages

GCM (Galois/Counter Mode) - authenticated encryption

CCM (Counter with CBC-MAC)

XTS - for disk encryption

Stream Ciphers

Linear Feedback Shift Registers (LFSR)

RC4 - structure and vulnerabilities

Salsa20/ChaCha20 - modern stream ciphers

A5/1, A5/2 - GSM encryption

Synchronous vs. self-synchronizing stream ciphers

Phase 4: Cryptographic Hash Functions

2 weeks

Understanding Message Digests and Authentication

Hash Function Properties

Preimage resistance

Second preimage resistance

Collision resistance

Avalanche effect

Birthday attack implications

Hash Algorithms

MD5 - structure and vulnerabilities

SHA-1 - design and collision attacks

SHA-2 family (SHA-224, SHA-256, SHA-384, SHA-512)

Merkle-Damgård construction

SHA-3 (Keccak) - sponge construction

BLAKE2/BLAKE3 - high-performance hashing

RIPEMD-160

Whirlpool

Message Authentication Codes (MAC)

HMAC - keyed-hash construction

CMAC - cipher-based MAC

GMAC - Galois MAC

Poly1305 - MAC for ChaCha20

CBC-MAC and its variants

Phase 5: Public Key Cryptography

4-5 weeks

Mastering Asymmetric Cryptography

RSA (Rivest-Shamir-Adleman)

Key generation algorithm

Encryption and decryption

Digital signatures with RSA

Padding schemes (PKCS#1 v1.5, OAEP, PSS)

Common attacks: small exponent, chosen ciphertext, timing

RSA key sizes and security levels

Diffie-Hellman Key Exchange

Basic DH protocol

Discrete logarithm problem

Man-in-the-middle vulnerability

Authenticated DH

Ephemeral DH (DHE)

ElGamal Cryptosystem

Encryption scheme

Digital signature scheme

Security analysis

Digital Signature Algorithm (DSA)

Key generation, signing, verification

ECDSA (Elliptic Curve DSA)

Security considerations

Nonce reuse vulnerabilities

Elliptic Curve Cryptography (ECC)

Elliptic curve mathematics

Point addition and doubling

Scalar multiplication

Elliptic Curve Discrete Logarithm Problem (ECDLP)

Standard curves: NIST P-256, P-384, P-521

Modern curves: Curve25519, Curve448

ECDH - Elliptic Curve Diffie-Hellman

EdDSA - Edwards-curve Digital Signature Algorithm

Pairing-based cryptography basics

Phase 6: Advanced Cryptographic Protocols

3-4 weeks

Advanced Protocols and Techniques

Key Exchange Protocols

Station-to-Station (STS) protocol

Internet Key Exchange (IKE)

MQV (Menezes-Qu-Vanstone)

HMQV (Hashed MQV)

SPEKE (Simple Password Exponential Key Exchange)

J-PAKE (Password Authenticated Key Exchange)

Zero-Knowledge Proofs

Interactive zero-knowledge proofs

Non-interactive zero-knowledge (NIZK)

zk-SNARKs

zk-STARKs

Sigma protocols

Schnorr protocol

Applications in authentication and blockchain

Secure Multi-Party Computation (MPC)

Secret sharing schemes

Shamir's Secret Sharing

Blakley's scheme

Threshold schemes

Oblivious transfer

Garbled circuits (Yao's protocol)

GMW protocol

Applications: secure voting, auctions

Homomorphic Encryption

Partially homomorphic encryption (RSA, ElGamal)

Somewhat homomorphic encryption

Fully homomorphic encryption (FHE)

Gentry's breakthrough

BGV, BFV, CKKS schemes

Applications in cloud computing and privacy

Commitment Schemes

Pedersen commitment

Hash-based commitments

Binding and hiding properties

Phase 7: Applied Cryptography & Protocols

3-4 weeks

Real-World Cryptographic Systems

Transport Layer Security (TLS/SSL)

TLS handshake protocol

TLS 1.2 vs TLS 1.3 differences

Cipher suites

Certificate validation

Perfect Forward Secrecy (PFS)

Common vulnerabilities: BEAST, CRIME, POODLE, Heartbleed

Virtual Private Networks (VPN)

IPsec architecture

AH (Authentication Header)

ESP (Encapsulating Security Payload)

IKE (Internet Key Exchange)

WireGuard protocol

OpenVPN architecture

Secure Email

PGP (Pretty Good Privacy)

S/MIME

End-to-end encryption

Web of Trust vs. PKI

Secure Messaging

Signal Protocol

Double Ratchet algorithm

Extended Triple Diffie-Hellman (X3DH)

Off-the-Record Messaging (OTR)

Matrix/Olm protocol

Forward secrecy and deniability

Blockchain and Cryptocurrencies

Bitcoin cryptographic foundations

Merkle trees

Proof of Work (PoW)

Digital signatures in blockchain (ECDSA, Schnorr)

Hash functions (SHA-256, RIPEMD-160)

Smart contract security basics

Phase 8: Public Key Infrastructure

2 weeks

Certificate Management and Trust

PKI Components

Certificate Authorities (CA)

Registration Authorities (RA)

Certificate Revocation Lists (CRL)

Online Certificate Status Protocol (OCSP)

X.509 Certificates

Certificate structure and fields

Certificate chains and path validation

Root certificates and trust anchors

Extended Validation (EV) certificates

Key Management

Key generation best practices

Key storage and protection

Key escrow and recovery

Key rotation policies

Hardware Security Modules (HSM)

Phase 9: Cryptanalysis

2-3 weeks

Breaking Cryptosystems

Attack Categories

Brute force attacks

Meet-in-the-middle attacks

Differential cryptanalysis

Linear cryptanalysis

Side-channel attacks

Timing attacks

Power analysis (SPA, DPA)

Cache-timing attacks

Acoustic cryptanalysis

Padding oracle attacks

Chosen-plaintext/ciphertext attacks

Breaking Weak Implementations

Poor random number generation

Weak key derivation

Implementation bugs

Protocol-level vulnerabilities

Phase 10: Quantum Cryptography & Post-Quantum

2-3 weeks

Preparing for the Quantum Era

Quantum Computing Threats

Shor's algorithm (breaks RSA, DH, ECC)

Grover's algorithm (reduces symmetric key strength)

Timeline and threat assessment

Post-Quantum Cryptography (PQC)

Lattice-based cryptography

Learning With Errors (LWE)

NTRU

Kyber (NIST PQC winner for KEMs)

Code-based cryptography

McEliece cryptosystem

Multivariate cryptography

Hash-based signatures (SPHINCS+, XMSS, LMS)

Isogeny-based cryptography

Quantum Key Distribution (QKD)

BB84 protocol

E91 protocol

Quantum entanglement

Practical implementations and limitations

Phase 11: Specialized Topics

2-3 weeks

Advanced Specialized Areas

Lightweight Cryptography

Constrained device requirements (IoT)

PRESENT cipher

SIMON and SPECK

Grain stream cipher

NIST lightweight cryptography standardization

Cryptographic Randomness

True Random Number Generators (TRNG)

Pseudo-Random Number Generators (PRNG)

Cryptographically Secure PRNG (CSPRNG)

/dev/random vs /dev/urandom

Intel RDRAND instruction

Testing randomness (NIST test suite, Dieharder)

Steganography

LSB insertion

Transform domain techniques

Steganalysis methods

Obfuscation

Code obfuscation techniques

Indistinguishability obfuscation (iO)

Major Algorithms, Techniques, and Tools Reference

Symmetric Encryption - Block Ciphers

AES - 128, 192, 256-bit keys

DES - 56-bit key (deprecated)

3DES - 112 or 168-bit security

Blowfish - Variable key (32-448 bits)

Twofish - 128, 192, 256-bit keys

Serpent - 128, 192, 256-bit keys

Camellia - 128, 192, 256-bit keys

IDEA - 128-bit key

Stream Ciphers

ChaCha20 - 256-bit key

Salsa20 - 256-bit key

RC4 - Variable key (deprecated)

Grain-128

Trivium

Hash Functions

SHA-256, SHA-384, SHA-512

SHA-3 (Keccak)

BLAKE2b, BLAKE2s

BLAKE3 - Parallelizable

MD5 - 128-bit (broken)

SHA-1 - 160-bit (deprecated)

RIPEMD-160

Public Key Algorithms

RSA - 2048, 3072, 4096-bit

Diffie-Hellman (DH)

ECDH - X25519, X448

ECDSA

EdDSA - Ed25519, Ed448

Schnorr signatures

BLS signatures

NIST PQC Selected Algorithms (2022)

CRYSTALS-Kyber - KEM

CRYSTALS-Dilithium - Signatures

FALCON - Signatures

SPHINCS+ - Hash-based signatures

Classic McEliece - Code-based

Key Derivation Functions (KDF)

PBKDF2

bcrypt

scrypt - Memory-hard

Argon2 - PHC winner

HKDF - HMAC-based KDF

Authenticated Encryption

AES-GCM

ChaCha20-Poly1305

AES-CCM

AES-SIV

AES-GCM-SIV

Cryptographic Tools and Libraries

Programming Libraries

C/C++

OpenSSL - Comprehensive cryptographic library
libsodium - Modern, easy-to-use crypto
Crypto++ - C++ class library
Botan - C++ crypto library
mbedTLS - Lightweight for embedded

Python

cryptography - Modern Python crypto
PyCryptodome - Python cryptographic toolkit
hashlib - Standard library hashing
PyNaCl - libsodium bindings

JavaScript/Node.js

Web Crypto API - Browser standard
Node.js crypto module - Built-in
TweetNaCl.js - Compact crypto library

Command-Line Tools

openssl - Swiss army knife of crypto

gpg/gpg2 - GNU Privacy Guard

age - Modern file encryption

john - Password cracker

hashcat - Password recovery

ssh-keygen - SSH key generation

Analysis and Testing Tools

Wireshark - Network protocol analyzer

testssl.sh - TLS/SSL testing

SSLyze - SSL/TLS scanning

CrypTool - Educational crypto tool

Sage - Mathematical software

Hardware Tools

YubiKey - Hardware authentication

Nitrokey - Open-source security key

TPM - Trusted Platform Module

HSM - Hardware Security Module

Ledger/Trezor - Crypto wallets

Cutting-Edge Developments

Post-Quantum Cryptography Migration

NIST PQC Round 4 evaluation

Hybrid approaches - classical + PQC

Migration timelines

Cryptographic agility

Homomorphic Encryption Advances

Microsoft SEAL - Open-source FHE

IBM HELib

Google Private Join and Compute

Concrete ML - ML on encrypted data

Zama.ai - FHE for AI

Zero-Knowledge Proof Systems

Groth16 - Compact proofs

PLONK - Universal setup

Halo/Halo2 - No trusted setup

zk-STARKs - Scalability

StarkWare - Production deployments

Quantum Key Distribution

ID Quantique - Commercial QKD

China's quantum network

Satellite-based QKD

Twin-field QKD - Extended distances

Threshold Cryptography

MPC wallets

Threshold signatures

Distributed key generation

FROST - Schnorr threshold

Privacy-Enhancing Technologies

Differential privacy

Secure Multi-Party Computation

Private Set Intersection (PSI)

Federated learning

Blockchain Cryptography Innovation

Proof of Stake (PoS)

BLS signature aggregation

VRF - Verifiable Random Functions

zk-Rollups

AI and Machine Learning in Cryptography

ML-based cryptanalysis

Side-channel analysis automation

Anomaly detection

Automated protocol verification

Side-Channel Attack Defenses

Constant-time implementations

Masking - Randomizing values

Secure enclaves (Intel SGX, ARM TrustZone)

Regulatory and Standardization

NIST Post-Quantum Standards

ISO/IEC crypto standards

GDPR and encryption

Quantum-safe TLS

Project Ideas by Difficulty Level

Beginner Level Projects

Project 1: Classical Cipher Implementation Suite

Implement Caesar, Vigenère, Playfair, Hill ciphers with encryption/decryption functions and basic frequency analysis tools.

Python JavaScript

Project 2: Password Strength Checker

Calculate password entropy, check against common password lists, implement strength estimation.

Python JavaScript

Project 3: Hash Function Visualizer

Implement educational hash function, visualize avalanche effect, compare with MD5, SHA-256.

Python JavaScript

Project 4: Simple File Encryptor

Encrypt/decrypt files using AES, implement proper key derivation (PBKDF2), password-based encryption.

Python cryptography

Project 5: Caesar Cipher Breaker

Implement brute force attack, add frequency analysis, automatic language detection.

Python

Intermediate Level Projects

Project 6: RSA Implementation from Scratch

Implement RSA key generation, encryption, decryption, proper padding (OAEP), signature generation.

Python Java

Project 7: Secure Chat Application

Implement end-to-end encrypted messaging with key exchange (X3DH), forward secrecy with Double Ratchet.

Python Node.js

Project 8: TLS/SSL Certificate Validator

Parse X.509 certificates, verify certificate chains, check revocation (CRL/OCSP), validate hostname matching.

Python OpenSSL

Project 9: Blockchain with Proof of Work

Implement basic blockchain, SHA-256 hashing, Merkle trees, PoW consensus, ECDSA signatures.

Python JavaScript

Project 10: Password Manager

Encrypt passwords with master password, use Argon2 for key derivation, implement encrypted database.

Python Electron

Advanced Level Projects

Project 12: Elliptic Curve Cryptography Library

Implement Ed25519 or secp256k1, ECDH key exchange, ECDSA and EdDSA signatures, constant-time operations.

C/C++ Python

Project 13: Homomorphic Encryption Demo

Implement Paillier or BGV scheme, perform operations on encrypted data, analyze performance overhead.

Python PySEAL

Project 14: Zero-Knowledge Proof System

Schnorr protocol implementation, zkSNARK circuit design, Sudoku ZK proof, authentication without password.

Python Circom

Project 15: Side-Channel Attack Demonstration

Timing attack on RSA/AES, power analysis simulation, cache-timing attack, implement countermeasures.

C/C++ Python

Project 16: Post-Quantum Crypto Implementation

Implement Kyber (lattice-based KEM) or NTRU, compare with RSA/ECC performance.

C/C++ Python

Research/Expert Level Projects

Project 21: Lattice-Based Signature Scheme

Implement CRYSTALS-Dilithium from specification, optimize polynomial operations, formal verification.

C/C++ Sage

Project 23: zk-SNARK Circuit Compiler

Design domain-specific language for circuits, compile to R1CS, implement proving/verification.

Rust Circom

Project 24: Quantum-Resistant Blockchain

Design blockchain with PQC signatures, implement quantum-resistant hash functions, hybrid schemes.

Go Rust

Project 27: Fully Homomorphic Encryption Compiler

High-level language to FHE operations, automatic circuit optimization, bootstrapping management.

C++ LLVM

Additional Learning Resources

Essential Textbooks

"Introduction to Modern Cryptography" - Katz & Lindell
"Applied Cryptography" - Bruce Schneier
"Cryptography Engineering" - Ferguson, Schneider, Kohno
"Serious Cryptography" - Jean-Philippe Aumasson
"The Joy of Cryptography" - Mike Rosulek (free online)
"A Graduate Course in Applied Cryptography" - Boneh & Shoup (free online)

Online Courses

Coursera: Cryptography I & II (Dan Boneh, Stanford)
MIT OCW: Network and Computer Security
Udacity: Applied Cryptography
Cryptopals: Practical cryptanalysis challenges
CryptoHack: Modern cryptography challenges

Practice Platforms

CryptoHack - Interactive cryptography challenges
Cryptopals Challenges - Practical attacks
OverTheWire: Krypton - War game
PicoCTF - CTF with crypto challenges

Standards and Specifications

NIST Publications - FIPS standards, SP 800 series
RFC Documents - Internet cryptographic protocols
ISO/IEC 18033 - Encryption algorithms
PKCS Standards - Public-Key Cryptography Standards

Career Paths in Cryptography

Industry Roles

Cryptographic Engineer - Implement and optimize crypto systems

Security Researcher - Discover vulnerabilities, design defenses

Protocol Designer - Create new cryptographic protocols

Blockchain Developer - Build decentralized applications

Security Consultant - Audit systems, recommend improvements

Applied Cryptographer - Integrate crypto into products

Recommended Learning Timeline

Months 1-4: Mathematical Foundations & Classical Cryptography

Months 5-8: Symmetric & Hash Functions, Public Key Cryptography

Months 9-12: Advanced Protocols, Applied Cryptography, PKI

Months 13-16: Cryptanalysis, Quantum & Post-Quantum, Specialized Topics

Months 17-20: Advanced Projects, Research, Career Preparation