Glossary
Post-quantum cryptography, defined
107 terms from the curriculum in plain English, each linked to the lesson that explains it properly.
No matching terms. Try a shorter word.
Algorithm identifier
A label stored or sent with a key, signature or ciphertext saying which algorithm produced it.
Introduced in Lesson 11: Crypto-agility: build to swapAmplitude
A number attached to each possible outcome of a quantum state. Squared, it gives that outcome's probability. Amplitudes can cancel each other out.
Introduced in Lesson 3: What a quantum computer is (and isn't)Amplitude amplification
Grover's technique of repeatedly flipping the answer's sign and reflecting about the average, which grows the answer's amplitude.
Introduced in Lesson 5: Grover's algorithm: why AES survivesAuthentication path
The sibling hashes from a leaf up to the root of a Merkle tree, enough to recompute the root and prove membership.
Introduced in Lesson 16: Winternitz chains and Merkle treesAvalanche effect
The property that changing one bit of a hash function's input flips about half of the output bits, unpredictably.
Introduced in Lesson 1: What cryptography actually doesBrute force
Attacking a cipher by trying every possible key. Key sizes are chosen to make it infeasible.
Introduced in Lesson 1: What cryptography actually doesCBOM
Cryptography Bill of Materials: a machine-readable list of the algorithms, keys, certificates and protocols in a product, added in CycloneDX 1.6.
Introduced in Lesson 10: Cryptographic inventory: find it before you fix itCentered binomial distribution
Noise sampled as (sum of η random bits) − (sum of η random bits). Cheap and easy to sample in constant time.
Introduced in Lesson 14: Inside ML-KEMCertificate chain
The sequence of certificates linking a server's own certificate to a trusted root, each signed by the one above it.
Introduced in Lesson 12: Migrating certificates, code signing and firmwareClientHello
The first TLS handshake message, sent by the client, listing supported options and carrying its key share.
Introduced in Lesson 8: Hybrid key exchange: post-quantum TLS todayCNSA 2.0
NSA's Commercial National Security Algorithm Suite 2.0 (September 2022): the required algorithms and transition dates for US national security systems.
Introduced in Lesson 9: The deadlines: who requires what, and whenComposite certificate
A certificate carrying both a classical and a post-quantum key or signature, so either kind of verifier can rely on it.
Introduced in Lesson 12: Migrating certificates, code signing and firmwareCompression
Keeping only the top d bits of each ciphertext coefficient. The rounding adds a little noise and saves a lot of bytes.
Introduced in Lesson 14: Inside ML-KEMConstant-time code
Code whose control flow, memory accesses and instruction timings don't depend on secret data.
Introduced in Lesson 17: Implementation pitfalls: timing, state and randomnessCRQC
Cryptographically relevant quantum computer: one large and reliable enough to break real-world public-key cryptography such as RSA-2048.
Introduced in Lesson 3: What a quantum computer is (and isn't)Crypto policy
A central configuration that decides which algorithms systems may use, so changes happen in one place.
Introduced in Lesson 11: Crypto-agility: build to swapCrypto-agility
The capability to replace and adapt cryptographic algorithms across protocols, software, hardware and infrastructure while preserving security and operations.
Introduced in Lesson 11: Crypto-agility: build to swapCryptographic inventory
A record of where and how an organization uses cryptography: algorithms, keys, purposes, owners and upgrade paths.
Introduced in Lesson 10: Cryptographic inventory: find it before you fix itData time to live
How long data must stay confidential or trustworthy. A key input to prioritizing post-quantum migration.
Introduced in Lesson 10: Cryptographic inventory: find it before you fix itDecoherence
The loss of a quantum state's delicate superposition through unwanted interaction with the environment.
Introduced in Lesson 3: What a quantum computer is (and isn't)Decryption failure
When accumulated noise in a lattice ciphertext pushes the value across a rounding boundary, so the wrong message comes out. Parameters make it astronomically rare.
Introduced in Lesson 13: Lattices and Learning With ErrorsDeprecated
In NIST usage, an algorithm that may still be used but whose use carries accepted risk; a signal to migrate.
Introduced in Lesson 9: The deadlines: who requires what, and whenDigital signature
A value made with a private key that anyone can check with the matching public key, proving who signed and that the content hasn't changed.
Introduced in Lesson 1: What cryptography actually doesDisallowed
In NIST usage, an algorithm that is no longer approved for a given purpose.
Introduced in Lesson 9: The deadlines: who requires what, and whenDiscrete logarithm
The problem of undoing modular exponentiation (or its elliptic-curve equivalent). Diffie-Hellman, ECDH and ECDSA rely on it being hard.
Introduced in Lesson 2: Public keys, private keys and the locked mailboxDowngrade attack
An attack that tricks two parties into negotiating a weaker algorithm or protocol version than both support.
Introduced in Lesson 11: Crypto-agility: build to swapElliptic-curve cryptography
Public-key cryptography built on elliptic curves, giving small keys and signatures. Includes X25519, ECDH, ECDSA and Ed25519.
Introduced in Lesson 2: Public keys, private keys and the locked mailboxEntanglement
A shared state of several qubits that produces correlated results. It can't be used to send messages.
Introduced in Lesson 3: What a quantum computer is (and isn't)Exclusive use
CNSA 2.0's term for the stage when only the new algorithms are used and classical ones are turned off.
Introduced in Lesson 9: The deadlines: who requires what, and whenFN-DSA
A forthcoming signature standard (FIPS 206) based on the Falcon submission, with smaller signatures than ML-DSA.
Introduced in Lesson 7: Meet the new standards: ML-KEM, ML-DSA and friendsFORS
Forest of Random Subsets: the few-time signature scheme at the bottom of SLH-DSA's hypertree.
Introduced in Lesson 16: Winternitz chains and Merkle treesFujisaki-Okamoto transform
A generic way to turn passively secure encryption into a chosen-ciphertext-secure KEM by deriving coins from the message and re-encrypting on decapsulation.
Introduced in Lesson 14: Inside ML-KEMGreatest common divisor
The largest number that divides two numbers exactly. Euclid's algorithm computes it quickly, even for huge numbers.
Introduced in Lesson 4: Shor's algorithm: why RSA and elliptic curves fallGrover's algorithm
A 1996 quantum algorithm by Lov Grover that finds a marked item among N unsorted items in about √N steps.
Introduced in Lesson 5: Grover's algorithm: why AES survivesHardware security module (HSM)
A tamper-resistant device that generates, stores and uses cryptographic keys without exposing them.
Introduced in Lesson 10: Cryptographic inventory: find it before you fix itHarvest now, decrypt later
Recording encrypted data today in order to decrypt it once a cryptographically relevant quantum computer exists. Also called "store now, decrypt later."
Introduced in Lesson 6: Harvest now, decrypt laterHash chain
A sequence where each value is the hash of the previous one. Easy to walk forward, infeasible to walk backward.
Introduced in Lesson 16: Winternitz chains and Merkle treesHash function
A function that turns any input into a short, fixed-size fingerprint. It's one-way and collision-resistant, and tiny input changes scramble the output.
Introduced in Lesson 1: What cryptography actually doesHQC
A code-based key-encapsulation mechanism NIST selected on 11 March 2025 as a backup to ML-KEM.
Introduced in Lesson 7: Meet the new standards: ML-KEM, ML-DSA and friendsHybrid key exchange
Combining a classical key exchange (such as X25519) with a post-quantum one (such as ML-KEM), so the result is secure if either one holds.
Introduced in Lesson 6: Harvest now, decrypt laterImplicit rejection
On a failed re-encryption check, decapsulation returns a pseudorandom key J(z‖c) instead of an error, so attackers learn nothing.
Introduced in Lesson 14: Inside ML-KEMInitial congestion window
How much data TCP may send before waiting for an acknowledgment; 10 segments (about 14 KB) per RFC 6928.
Introduced in Lesson 12: Migrating certificates, code signing and firmwareInterference
Amplitudes adding up or cancelling out, like waves. Quantum algorithms use it to make wrong answers unlikely.
Introduced in Lesson 3: What a quantum computer is (and isn't)K-PKE
The Module-LWE public-key encryption scheme inside ML-KEM. Secure only against passive attackers on its own.
Introduced in Lesson 14: Inside ML-KEMKey
A secret value that controls a cryptographic algorithm. The algorithm can be public; the key must not be.
Introduced in Lesson 1: What cryptography actually doesKey exchange
A protocol that lets two parties agree on a shared secret key over a public channel, such as Diffie-Hellman or ECDH.
Introduced in Lesson 2: Public keys, private keys and the locked mailboxKey pinning
Hard-coding which public key or certificate a client will accept for a server.
Introduced in Lesson 11: Crypto-agility: build to swapKey wrapping
Encrypting one key with another. If the wrapping uses RSA, the wrapped symmetric key inherits RSA's quantum vulnerability.
Introduced in Lesson 10: Cryptographic inventory: find it before you fix itKey-encapsulation mechanism
A public-key scheme whose only job is to deliver a fresh random shared secret: KeyGen, Encaps and Decaps.
Introduced in Lesson 14: Inside ML-KEMKey-encapsulation mechanism (KEM)
A public-key method where one side encapsulates a fresh secret to the other's public key, producing a ciphertext only the private-key holder can open.
Introduced in Lesson 7: Meet the new standards: ML-KEM, ML-DSA and friendsKyberSlash
Timing vulnerabilities (2023–24) from dividing secret values by q in several Kyber implementations, including the reference code; fixed with multiply-and-shift.
Introduced in Lesson 17: Implementation pitfalls: timing, state and randomnessLamport signature
A one-time signature from a hash function: reveal one of two secrets per bit of the message digest. Leslie Lamport, 1979.
Introduced in Lesson 15: Lamport signatures: hash-based signing from scratchLattice
The set of all integer combinations of some basis vectors: an infinite, regular grid of points in n-dimensional space.
Introduced in Lesson 13: Lattices and Learning With ErrorsLearning With Errors
Given A and b = A·s + e mod q with small random errors e, recover s (or distinguish b from random). Introduced by Oded Regev in 2005.
Introduced in Lesson 13: Lattices and Learning With ErrorsLMS
Leighton-Micali Signatures (RFC 8554): a stateful Merkle-tree signature built on Winternitz one-time keys; HSS is its multi-level form.
Introduced in Lesson 16: Winternitz chains and Merkle treesLong-exposure attack
A quantum attack on a public key that stays visible on chain while funds remain behind it, giving the attacker unlimited time.
Introduced in Lesson 18: Cryptocurrency in a post-quantum worldMeasurement
Reading a qubit. It returns one ordinary result and collapses the superposition to that result.
Introduced in Lesson 3: What a quantum computer is (and isn't)Mempool
The set of broadcast but not-yet-confirmed transactions that nodes hold while waiting for inclusion in a block.
Introduced in Lesson 18: Cryptocurrency in a post-quantum worldMerkle tree
A binary tree of hashes in which each parent is the hash of its two children; the root commits to every leaf.
Introduced in Lesson 16: Winternitz chains and Merkle treesMerkle Tree Certificates (MTC)
A proposed certificate design in which a CA signs one tree head covering many certificates and sites send a compact inclusion proof instead of a signature chain.
Introduced in Lesson 12: Migrating certificates, code signing and firmwareMiddlebox
A network device that inspects or modifies traffic in transit, such as a firewall, proxy or TLS-inspection appliance.
Introduced in Lesson 8: Hybrid key exchange: post-quantum TLS todayML-DSA
Module-Lattice-Based Digital Signature Algorithm, standardized in FIPS 204 (from CRYSTALS-Dilithium). The general-purpose post-quantum signature.
Introduced in Lesson 7: Meet the new standards: ML-KEM, ML-DSA and friendsML-KEM
Module-Lattice-Based Key-Encapsulation Mechanism, standardized in FIPS 203 (from CRYSTALS-Kyber). Used to agree on a shared secret key.
Introduced in Lesson 7: Meet the new standards: ML-KEM, ML-DSA and friendsModule-LWE
LWE where the secret is a vector of k ring elements and A is a k×k matrix of ring elements. The basis of ML-KEM and ML-DSA.
Introduced in Lesson 13: Lattices and Learning With ErrorsMosca's inequality
Michele Mosca's rule of thumb: if X (years data must stay secret) + Y (years to migrate) > Z (years until a CRQC), you're already late.
Introduced in Lesson 6: Harvest now, decrypt laterNIST IR 8547
A NIST draft report (November 2024) proposing to deprecate RSA-2048-class algorithms after 2030 and disallow quantum-vulnerable public-key algorithms after 2035.
Introduced in Lesson 9: The deadlines: who requires what, and whenNSM-10
US National Security Memorandum 10 (May 2022), which set the goal of mitigating quantum risk to the maximum extent feasible by 2035.
Introduced in Lesson 9: The deadlines: who requires what, and whenNumber-theoretic transform
A fast Fourier transform over integers mod q. It makes polynomial multiplication in ML-KEM fast.
Introduced in Lesson 14: Inside ML-KEMOne-time signature
A signature scheme whose key pair may sign only a single message. A second signature leaks enough of the private key to enable forgeries.
Introduced in Lesson 15: Lamport signatures: hash-based signing from scratchOracle
In a quantum algorithm, a circuit that recognizes correct answers (for example, by testing a candidate key) and marks them by flipping their sign.
Introduced in Lesson 5: Grover's algorithm: why AES survivesP2PKH
Pay-to-public-key-hash: a Bitcoin output that commits to HASH160 of a public key; the key appears only when spent.
Introduced in Lesson 18: Cryptocurrency in a post-quantum worldPeriod
The length of the repeating cycle in a sequence such as ax mod N. Finding it is the step Shor's algorithm needs a quantum computer for.
Introduced in Lesson 4: Shor's algorithm: why RSA and elliptic curves fallPolynomial ring
Here, Z_q[X]/(X^n + 1): polynomials with coefficients mod q where X^n is replaced by −1. One element acts like a structured n×n matrix.
Introduced in Lesson 13: Lattices and Learning With ErrorsPolynomial time
Running time that grows like a fixed power of the input size. Informally, "efficient": doubling the key size raises the cost by a modest factor.
Introduced in Lesson 4: Shor's algorithm: why RSA and elliptic curves fallPreimage resistance
Given a hash output, it's infeasible to find any input that produces it.
Introduced in Lesson 15: Lamport signatures: hash-based signing from scratchPrivate key
The half of a key pair only you hold. It decrypts what was sent to you and creates your signatures.
Introduced in Lesson 2: Public keys, private keys and the locked mailboxPrivate PKI
A certificate system an organization runs for its own internal servers, clients and devices.
Introduced in Lesson 12: Migrating certificates, code signing and firmwarePublic key
The half of a key pair you share with everyone. Others use it to encrypt to you or verify your signatures.
Introduced in Lesson 2: Public keys, private keys and the locked mailboxQuadratic speedup
Solving a problem in about the square root of the classical number of steps. Real, but far less dramatic than an exponential speedup.
Introduced in Lesson 5: Grover's algorithm: why AES survivesQuantum error correction
Spreading one reliable logical qubit across many noisy physical qubits and repeatedly detecting and fixing errors, so long computations can finish.
Introduced in Lesson 3: What a quantum computer is (and isn't)Quantum Fourier transform
A quantum operation that uses interference to reveal the frequencies, and so the period, hidden in a quantum state.
Introduced in Lesson 4: Shor's algorithm: why RSA and elliptic curves fallQubit
A quantum bit. Its state is described by amplitudes for 0 and 1, and measuring it gives a single 0 or 1.
Introduced in Lesson 3: What a quantum computer is (and isn't)Root of trust
A key or component that a system trusts unconditionally, such as the signature key a device's boot process checks. It's hard to replace once deployed.
Introduced in Lesson 6: Harvest now, decrypt laterRSA
A public-key system from 1977 whose security rests on the difficulty of factoring a large number into its two prime factors.
Introduced in Lesson 2: Public keys, private keys and the locked mailboxSecond preimage
A different input with the same hash as a given input. Forging a single Lamport signature requires one.
Introduced in Lesson 15: Lamport signatures: hash-based signing from scratchsecp256k1
The elliptic curve used for Bitcoin and Ethereum signatures. Like all elliptic curves used in cryptography, it is vulnerable to Shor's algorithm.
Introduced in Lesson 18: Cryptocurrency in a post-quantum worldSecurity category
NIST's 1-to-5 rating of a parameter set's strength, benchmarked against breaking AES-128, AES-192 or AES-256 or finding SHA-2 collisions.
Introduced in Lesson 7: Meet the new standards: ML-KEM, ML-DSA and friendsShelf life
How long data must stay confidential to avoid harm. It's the X in Mosca's inequality.
Introduced in Lesson 6: Harvest now, decrypt laterShor's algorithm
A 1994 quantum algorithm by Peter Shor that factors integers and computes discrete logarithms efficiently, breaking RSA, Diffie-Hellman and elliptic-curve cryptography.
Introduced in Lesson 4: Shor's algorithm: why RSA and elliptic curves fallShort-exposure attack
A quantum attack on a public key revealed in an unconfirmed transaction, racing to spend before confirmation.
Introduced in Lesson 18: Cryptocurrency in a post-quantum worldShortest Vector Problem
Find the shortest nonzero vector in a lattice. Easy in low dimension, believed hard in high dimension given only a bad basis.
Introduced in Lesson 13: Lattices and Learning With ErrorsSigned certificate timestamp (SCT)
A signed receipt from a Certificate Transparency log proving a certificate was publicly logged.
Introduced in Lesson 12: Migrating certificates, code signing and firmwareSLH-DSA
Stateless Hash-Based Digital Signature Algorithm, standardized in FIPS 205 (from SPHINCS+). Conservative, with small keys and large signatures.
Introduced in Lesson 7: Meet the new standards: ML-KEM, ML-DSA and friendsState rollback
Restoring a stateful signer to an earlier counter value (from a backup, snapshot or clone), causing one-time keys to be reused.
Introduced in Lesson 17: Implementation pitfalls: timing, state and randomnessStateful signature
A signature scheme, such as LMS or XMSS, where the signer must track which one-time keys are used and never reuse one.
Introduced in Lesson 12: Migrating certificates, code signing and firmwareSuperposition
A quantum state that combines several possibilities, each with an amplitude, until it's measured.
Introduced in Lesson 3: What a quantum computer is (and isn't)Symmetric encryption
Encryption where the same secret key locks and unlocks the data. AES is the standard example.
Introduced in Lesson 1: What cryptography actually doesTaproot
Bitcoin's SegWit v1 output type (BIP 341). Its output is a tweaked public key, so the key is visible on chain.
Introduced in Lesson 18: Cryptocurrency in a post-quantum worldTiming side channel
Leakage of secret information through how long an operation takes, recoverable by averaging many measurements.
Introduced in Lesson 17: Implementation pitfalls: timing, state and randomnessTLS handshake
The opening exchange of a TLS connection, where client and server agree on session keys and the server authenticates with its certificate.
Introduced in Lesson 8: Hybrid key exchange: post-quantum TLS todayTLS termination
The point where a TLS connection is decrypted, such as a CDN, load balancer or server. Each terminated hop negotiates its own keys.
Introduced in Lesson 8: Hybrid key exchange: post-quantum TLS todayTrapdoor function
A calculation that's easy to do and hard to undo, unless you know a secret shortcut (the trapdoor).
Introduced in Lesson 2: Public keys, private keys and the locked mailboxUnstructured search
Finding an item you can recognize when you see it, with no clues about where it is. Brute-forcing a key is an example.
Introduced in Lesson 5: Grover's algorithm: why AES survivesValue barrier
A coding trick that stops the compiler from reasoning about a value, so it can't turn constant-time arithmetic back into branches.
Introduced in Lesson 17: Implementation pitfalls: timing, state and randomnessWinternitz one-time signature
A one-time signature that signs base-w digits by revealing a position along a hash chain, plus a checksum. Credited to Robert Winternitz in Merkle's 1979 work.
Introduced in Lesson 16: Winternitz chains and Merkle treesX25519MLKEM768
The TLS 1.3 hybrid key-exchange group (code point 0x11EC) combining X25519 with ML-KEM-768. Default in major browsers and OpenSSL 3.5.
Introduced in Lesson 8: Hybrid key exchange: post-quantum TLS todayXMSS
eXtended Merkle Signature Scheme (RFC 8391): a stateful hash-based signature using WOTS+ and Merkle trees; XMSS^MT is multi-tree.
Introduced in Lesson 16: Winternitz chains and Merkle trees