The Book of PQC course
41 chapters 7 parts 386 functions to implement 2,326 tests 214 runnable listings
What this is
You can read FIPS 203 end to end and still not be able to write ML-KEM. Implementation is where the misunderstandings surface, and a wrong implementation looks like a correct one until a test runs it.
This is the Encryptorium Book of Post-Quantum Cryptography with that test wired in. The chapters are the book’s own text, not a rewrite. What the course adds is the work around them: 386 functions taken out of the book’s reference implementations and handed back to you as stubs, and the book’s own pytest suites running in your browser to say whether what you wrote is correct.
What you build
One member of each of four post-quantum families, from scratch: lattice-based, hash-based, code-based, and isogeny-based. The lattice Part builds two, ML-KEM and ML-DSA. Those two and SLH-DSA are checked against the official NIST vectors. The code-based and isogeny-based builds are pedagogical toys, and each chapter states how its code differs from the scheme it models. Multivariate signatures get a chapter and a worked toy UOV rather than a from-scratch implementation.
Past the implementations, you work through why each scheme exists, what its assumptions are, which attacks it resists, how to plan the migration of a real system, and which layers of a zero-knowledge system must change to stay secure against a quantum adversary. Who this is for and the background it assumes are on About this course and Prerequisites.
How a chapter goes
- Read it. The prose, the mathematics and the figures are the book’s, and they are the same text the free site serves.
-
Run the listings where they are printed. Each Python block with a Run control executes on the
page, and its output appears at the
# ==>markers the book already checks it against. Edit a block and run it again to see what breaks. - Pick up the functions the section just taught. At the close of each of the 153 sections that carry them, one line names the section and how many functions it covers.
- Write them. The chapter’s own suite runs, and each function comes back passing, failing, or blocked.
- Mark the chapter read. That is the one thing the course never infers for you, because a tick that is not true costs more than a chapter you forgot to tick.
What the free book already gives you
Most of it, and that is worth saying before you decide anything.
The book is free and complete at
book.encryptorium.com: 41 chapters, seven Parts, four
appendices, 291 verified code blocks, and 426 cited sources. The companion code repository is
public, with the code under MIT. It carries each chapter’s reference implementation under
solutions/, the same package with the taught functions stubbed under
exercises/, every printed listing as a runnable file under
chapter-code/, and the test suites that prove either tree. Each stub already states
what it owes its caller, which chapter section specifies it, and which tests prove it. Clone the
repository, run PQC_IMPL=exercises pytest tests/ch14, and you can work the whole
rebuild track on your own machine for nothing.
Nothing has been removed from the free book to make this one worth having, and nothing here is withheld from it. The chapters are the book’s own text apart from three deliberate changes: one rewritten paragraph on the chapters that print Python, because the code runs here in place; the numbered exercises lifted out of the chapter and onto their own pages; and the closing pointer paragraphs cut, because the Appendix D entries and the rebuild track they point to arrive here inside the exercises. The worked answers you reveal inside an exercise are the same Appendix D that is published over there, free, with no attempt required. What you are paying for is the environment, not access.
What the course adds
No new chapters and no new prose. It adds the environment, the ordering, and the verdict.
- Nothing to install. Python, NumPy and pytest run in the browser tab, so a chapter’s suite runs on the page you already have open. There is no virtualenv and no Python version to argue with.
- A verdict per function, not per suite. Passing, failing, or blocked. Blocked is the one
that keeps the display honest: write
k_pke_encryptbeforesample_matrix_nttand the test that fails is not your code, so the course says that rather than marking you wrong. - An order to write in. Each of the 386 functions was hollowed out on its own and its suite re-run, so the course knows which tests each one reaches. 180 can be written with nothing else written first, and 68 come in sets whose tests only pass together. The course tells you which, chapter by chapter.
- Listings that run where they are printed. All 214 of them, across the 40 chapters that print Python.
- Exercises that arrive while you read, at each of the 153 sections that teach a function and again at every chapter close. The reading column carries nothing else.
- Your own selection of chapters. Not everyone wants all 41. Pick the ones you want and the counts, the dashboard and the next-chapter handoff narrow to your selection, pulling in whatever it depends on unless you have said you are here to read rather than to write. 39 of the 41 stand alone; Chapter 27 needs Chapter 11, and Chapter 29 needs Chapters 11, 15 and 27.
- Progress that counts functions, never tests. 716 of the 2,326 tests pass before you write a line, so a suite-level count would tell you nothing. The dashboard shows functions written, a streak wall, and where you are in the book, every number of it from a real pytest verdict.
- Three figures that step through their own construction: the ML-DSA signing loop in Chapter 12, the Merkle authentication path in Chapter 14, and the WOTS+ chain in Chapter 15.
Contents
Seven Parts and 41 chapters, all of them in the course, with the glossary and the notation reference beside them. Each Part progresses from intuition to construction to attacks to tradeoffs. Every chapter has functions to write, Chapter 3 included, which is the one chapter that prints no code of its own, and every chapter's numbered exercises are there too, in one sequence with its functions.
The links below go to the chapters. Without a session, clicking one asks you to sign in and then returns you to the chapter you clicked.
All 41 chapters are published.
Part I: Foundations
Part II: Lattice-based cryptography
Part III: Hash-based signatures
Part IV: Code-based and isogeny-based cryptography
Part V: Migration and deployment
Part VI: Post-quantum zero-knowledge
Part VII: Post-quantum blockchain
Appendices
Signing in, and where your work is kept
The course is behind a GitHub sign-in. There is no other account to create and nothing else to configure.
Your code, your written answers, your test verdicts, your chapter selection and your read marks are held against your GitHub account, so they follow you to any machine you sign in from. The privacy page lists exactly what is stored, how long it is kept, and how to export or delete all of it.