Applied Cryptography: From Definitions to Computing on Secrets

A six-part series. Start with what "secure" even means, then build a secure channel, authenticate the other end, prove statements without revealing them, compute jointly on private inputs, and finally compute on data no one can see.

This is a series outline, not a finished set of posts.

Each page contains a throughline, section bullets, examples, assumptions, and references. The finished prose has not been written.

There are two questions you can ask about any cipher. How does it work: how RSA multiplies, how AES moves bytes around, how Diffie-Hellman lands on the same number twice. And what are we actually claiming when we call it secure.

The second one is the whole subject.

Cryptography is not about secrets. It is about writing down exactly what an attacker must not be able to do, and then building something that provably stops them.

Every post here starts from one informal wish — nobody can read this, I know who I'm talking to, prove it without telling me, let's compute this together — and turns it into a definition precise enough to build against. The definitions are the point. The schemes fall out of them.

The series starts where every cryptography course starts, with hiding a message from someone who shouldn't read it. It ends with a server computing on your data while being mathematically unable to see it.

Before you start

You'll need modular arithmetic, a little group theory, and enough probability to read an expectation. You don't need any prior cryptography.

If generator of a cyclic group or $\mathbb{Z}_n^*$ makes you pause, Bits, Math, Hashes, Streams covers the modular arithmetic, group theory, and hashing this series leans on. Start there.

Read the posts in order. Each one uses the primitives the previous one built, and Part 1 is the one the other five depend on.

The arc

Three acts. The first builds the vocabulary, the second builds the thing you already use every day, and the third stops treating encrypted data as inert.

The posts

Part 1 — Cryptography is about definitions, not secrets

Define the scheme and its security parameter first, then move from perfect secrecy to semantic security and its IND-CPA game.

Part 2 — Building a secure messenger from scratch

What happens, cryptographically, when you send a text? Diffie–Hellman, key derivation, authenticated encryption, and the double ratchet.

Part 3 — Who are you talking to?

Part 2's channel is perfectly secure — possibly with an attacker. Man-in-the-middle, signatures, certificate chains, passwords, and second factors.

Part 4 — Proving without revealing: anonymous voting

How do you convince someone of a fact while telling them nothing else? Sigma protocols, Schnorr, Fiat-Shamir, and a voting system assembled one attack at a time.

Part 5 — Computing on secrets together

Two parties, two private inputs, one shared answer and nothing more. Oblivious transfer, Yao's garbled circuits, GMW, and privacy-preserving machine learning.

Part 6 — Computing on encrypted data

Can a server compute on data it cannot read? Thirty-one years said probably not. Somewhat-homomorphic encryption, learning with errors, bootstrapping, and private information retrieval.

Assumption tracker

Reference, not required reading

Nothing here is needed to start Part 1. Each post ends with its own copy of this table, grown by whatever that post introduced. This is the finished ledger, kept on the hub so you can see the whole foundation at once.

Exactly one construction in this series is unconditionally secure, the one-time pad, and Part 1 explains why that's what makes it useless. Everything else rests on a small pile of problems we believe are hard and can't prove are. The whole pile is here so you can see what the rest of it stands on.

Assumption	Introduced in	Informally	If it falls
One-way functions exist	Part 1	Easy to compute, hard to invert	All of modern cryptography
Pseudorandom permutations exist	Part 1	AES is indistinguishable from a random permutation	Every block cipher, every mode
Discrete logarithm	Part 2	Given $g^a$ , recover $a$	Diffie-Hellman, Schnorr, ElGamal
Computational Diffie-Hellman	Part 2	Given $g^a, g^b$ , compute $g^{ab}$	Key exchange
Decisional Diffie-Hellman	Part 2	Distinguish $g^{ab}$ from random	ElGamal, oblivious transfer, the voting system
Factoring / RSA	Part 3	Recover $p, q$ from $N = pq$	RSA signatures, most of the web's PKI
Collision resistance	Part 3	Find $x \neq x'$ with $H(x) = H(x')$	Hash-and-sign, certificates, Merkle trees
Random oracle model	Part 4	Treat $H$ as a truly random function	Fiat-Shamir, non-interactive proofs
Learning with errors	Part 6	Solve noisy linear equations	Lattice cryptography, FHE, post-quantum

Read the table as a timeline

Shor's algorithm breaks the discrete-log and factoring families used in Parts 2–4. It does not generically eliminate collision resistance or the random-oracle model. No polynomial-time quantum attack is known for the LWE families introduced in Part 6.

Go deeper

Katz and Lindell, Introduction to Modern Cryptography — the standard reference for Parts 1 through 3
Boneh and Shoup, A Graduate Course in Applied Cryptography — free, and stronger on practical constructions
Evans, Kolesnikov and Rosulek, A Pragmatic Introduction to Secure Multi-Party Computation — free, and the best single reference for Part 5
Scribed applied cryptography lecture notes — a compact treatment covering roughly this same arc