About this course
You read a chapter, run the code it prints without leaving the page, and then implement the functions the chapter just taught. The book’s own pytest suites decide whether you got it right. That is the loop, across 41 chapters.
The course carries the full text of The Encryptorium Book of Post-Quantum Cryptography: seven Parts, 41 chapters, 214 runnable listings, 189 numbered exercises, and 386 functions left unwritten for you to fill in. Each of those 386 is a real function from a working reference implementation with its body removed, and each is proved by tests from the book’s own suites.
What is free and what is not
The book is free, and it is complete. All 41 chapters and all four appendices, including a worked solution for every compute and derivation exercise, are published at book.encryptorium.com under CC BY-SA 4.0. The code is MIT and public at github.com/Encryptorium/book-of-pqc-code, alongside the reference implementations and the 41 test suites. That repository carries the exercise track too: all 386 stubs, each one keeping its signature and its docstring, and each carrying a hint, a chapter reference, and the tests that prove it. Nothing has been removed from the book to sell this course, and nothing here is withheld from it.
The chapter text here is the book’s text, with three deliberate differences and no others. On the 40 chapters that print Python, one paragraph is rewritten, the one that sends a reader of the book to a repository to clone, because here the code runs where it is printed. The numbered exercises are lifted out of the chapter’s closing section, because here they are answerable and each one gets its own page. And the pointer paragraphs that close that section in the book, naming Appendix D and the packages in the public code repository, are cut from all 41 chapters, because the Appendix D entries they point to open inside each exercise here, and the rebuild track they name is these exercise pages. Nothing else is reworded and nothing is cut. Two of its appendices are not here, and their absence is the one place the two differ in substance rather than in wording. Appendix C is the setup guide for running the code in a terminal, which is the thing the course is instead of. Appendix D is the worked answer to every numbered exercise, and here those answers arrive inside the exercise you are working on rather than as 42 separate pages. Both are finished, free and one click away at book.encryptorium.com, and the prerequisites page says so; nothing about them is exclusive to either side.
So the honest account of what the course adds is not the material. It is the working environment and the wiring around it, and if a git clone and the book’s Appendix C suit you better, do that instead.
What you do in a chapter
Read it. Every one of the 214 Python listings the chapters print has a Run control (Chapter 3 prints no code). Click it and the output appears inside the block, at the position where the book’s # ==> expected-output markers sit. On a match the markers give way to the real output. On a mismatch both are shown, paired line by line, so you can see which line moved. Click the code itself and it becomes editable, so you can change a parameter, run it again, and see what that does. What you type is saved to your account, so an edit is still there when you come back, on whatever machine you sign in from; Reset puts the printed version back and deletes the saved copy.
At the close of every section that teaches one of the 386 functions, one line names that section, says how many functions it teaches, and links to them. There are 153 such sections. And at the chapter’s close, where the book prints its numbered exercises, one line says what the chapter’s sequence holds and one control opens it. Those are the two places the exercises interrupt the reading, and nothing else on the page competes with the prose.
A chapter’s exercises are one sequence, and it carries both kinds. The book’s 189 numbered exercises are there in full, in book order, and the chapter’s functions follow, ordered so that whatever a function depends on comes before it. Previous and Next walk the whole sequence, so you answer an exercise, write the function it leads to, and carry on without changing surface.
A numbered exercise gives you a box to write in. Nothing marks it right or wrong, because most of them cannot be marked: they ask you to justify a parameter choice or estimate a migration window. What you write is saved to your account, and once you have written something the worked answer from Appendix D opens beside it, so you assess it yourself. A function is graded, and its answer opens once you have run your code. Both answers are also published in the free book, which needs no attempt at all; the gate is there so the default is to try first, not to make anything hard to reach.
A function exercise is one function on its own page: the signature and the docstring it has to satisfy, a hint, the section of the specification or the chapter that defines it, and the tests that prove it. The rest of the module is folded around your cursor, so you can open any of it when you need the context. The proving tests are printed on the same page in full, so nothing about the grading is hidden. Every hint was written by hand, one per function, and nothing on the page is generated while you read.
Run the tests and each one comes back passing, failing, or blocked. Blocked means an unwritten function stands between your code and a green test, and the verdict names it. Writing a function whose dependency is missing is not the same as writing it wrong, and the course does not report it as though it were.
Nothing installs. Python runs in your browser through Pyodide in a background worker, with pytest and, where a chapter needs it, NumPy, as real wheels. The suite you run is the suite in the repository, and the code you write stays on your device.
Who this course is for
Security engineers, protocol designers, and cryptography practitioners who need to reason about post-quantum schemes well enough to implement, deploy, or attack them, and who learn that by writing the code. You should be able to write Python and follow a textbook-style proof. Motivated learners who meet the prerequisites can work through it as well.
No lattice theory, no coding theory, no isogenies, and no zero-knowledge background is assumed. The chapters build those from first principles. Quantum computing is the one exception, and the book does not teach it. Chapter 31 works in the quantum random oracle model, and Chapter 33 works directly with superpositions and Dirac notation. The prerequisites page names a free primer for that gap.
The full list is on the Prerequisites page, which is public and gives you a self-test question for each item.
Who this course is not for
Anyone who only wants to read. The course does support that choice: tell it you are here to read rather than to write, and it leads with what you have read and stops pulling in chapters for code you are not writing. But the exercises are why the course exists, and what it adds to plain reading is small: listings you can run in place, a read marker, and three figures you can step through. The free book is the same text, searchable on the same keystroke, and costs nothing.
Anyone who wants a non-technical overview of the PQC migration. Encryptorium publishes the Post-Quantum Readiness Assessment framework and a blog series at encryptorium.com for that audience.
Anyone without a grounding in classical algorithms, basic linear algebra, Python 3, or deployed cryptography such as TLS and AES. That is a “not yet” rather than a “no”. The Prerequisites page names a free resource for each gap and says what to read in it.
What you will have built
One member of each of four post-quantum families, from scratch: lattice-based, hash-based, code-based, and isogeny-based.
Three of those are checked against the official NIST test vectors. ML-KEM (FIPS 203) in Chapter 11 reproduces the ACVP key generation, encapsulation, and decapsulation vectors byte for byte across all three parameter sets. ML-DSA (FIPS 204) in Chapter 12 reproduces the key generation, signing, and verification vectors across all three. SLH-DSA (FIPS 205) in Chapter 17 reproduces the key generation vectors across all twelve parameter sets, reproduces signatures at the six fast sets, and is checked against the signature-verification vectors at all twelve.
None of the three arrives in one jump. Regev encryption comes first in Chapter 10, Lamport signatures and Merkle trees in Chapter 14, WOTS+ and XMSS in Chapter 15, FORS and the hypertree in Chapter 16.
The code-based and isogeny-based builds are pedagogical toys, and each chapter states how its code differs from the scheme it models: McEliece in Chapter 20, HQC in Chapter 21, SIDH in Chapter 22, and SQIsign in Chapter 23. Multivariate signatures get a survey chapter with a worked toy UOV rather than a from-scratch implementation.
Past the code, you will know why each scheme exists, what its assumptions are, which attacks it resists, and how to plan the migration of a real system to post-quantum cryptography. You will be prepared to analyze which layers of a zero-knowledge system have to change to stay secure against a quantum adversary.
How the course is organized
Seven Parts and 41 chapters. Each Part goes from intuition to construction to attacks to tradeoffs.
| Part | Chapters | Functions | What it covers |
|---|---|---|---|
| I: Foundations | 1 to 6 | 48 | The quantum threat model, the algebra the later Parts use, the hard problems, the KEM and signature interfaces |
| II: Lattice-based cryptography | 7 to 13 | 80 | LWE, Ring-LWE, Module-LWE, Regev encryption, ML-KEM and ML-DSA from scratch, lattice cryptanalysis |
| III: Hash-based signatures | 14 to 18 | 42 | Lamport, Merkle trees, Winternitz, XMSS, FORS, SLH-DSA from scratch, generic and structural attacks |
| IV: Code-based and isogeny-based | 19 to 24 | 65 | Coding theory, toy McEliece, HQC, toy SIDH and the attack that broke it, SQIsign, the multivariate families |
| V: Migration and deployment | 25 to 30 | 33 | CBOM-based inventory, crypto agility, hybrids, TLS 1.3, PKI and code signing, running the program |
| VI: Post-quantum zero-knowledge | 31 to 35 | 58 | A four-layer decomposition of a ZK system, PQ commitments, Fiat-Shamir in the QROM, STARKs and FRI, case studies |
| VII: Post-quantum blockchain | 36 to 41 | 60 | Chain threat models, Layer-1 signature migration, wallets and key rotation, consensus signatures, rollups, governance |
Two appendices are here as reference material you reach for while reading. Appendix A is a glossary of scheme names and recurring terms; Appendix B lists the reserved mathematical symbols of every Part. The book’s other two are not pages here: Appendix C is the terminal setup guide, and Appendix D’s worked answers are the reveal inside each exercise. Both are published in full at book.encryptorium.com.
The full chapter list, with a one-line description of each of the 41, is on the home page, which is public.
How you move through it
Two orders run through the course, and they are not the same order. You read in book order, because a chapter explains ML-KEM before it explains the pieces ML-KEM is built from. You write in dependency order, because a function whose callees are still stubs cannot go green. The course keeps both rather than forcing one to serve the other, and joins them at the section, which is why an exercise arrives at the section that taught it rather than in a pile at the end. 180 of the 386 functions can be written with nothing else written first, and the course works out which those are rather than leaving you to find out by failing.
You do not have to take all 41 chapters. The topics page lets you pick the ones you want, and unless you have said you are here to read rather than to write, your selection is closed under what the code needs. 39 of the 41 chapters stand alone; Chapter 27 needs Chapter 11, and Chapter 29 needs Chapters 11, 15, and 27. That closure exists to keep the functions you write solvable, which is why saying you are not writing them turns it off. A selection narrows your counts and your next step. It never locks a page.
Two facts are tracked, and they are kept apart on purpose. What you have written is measured from real test outcomes, and progress counts functions rather than tests. 716 of the 2,326 tests in the 41 suites already pass before you write a line, because a suite also covers fixtures, frozen constants, and validation behaviour. A test count would flatter you from the first minute. What you have read is your own claim. You mark a chapter read when you have read it, and nothing infers it from how far you scrolled or how long the tab was open.
Search covers the 41 chapters and the two reference appendices, headings included, on Ctrl+K or Cmd+K. Three figures step through their own construction one stage at a time instead of presenting it finished: the ML-DSA signing loop in Chapter 12, the Merkle authentication path in Chapter 14, and the WOTS+ chain in Chapter 15.
The rigor bar
Three rules apply to every chapter of the book, and the course inherits all three, because it is the same text and the same code.
- Every mathematical claim is either cited to a source in the bibliography or derived in the text. There is no hand-waving and no “it can be shown”. The bibliography holds 426 entries.
- Every code block meant to run standalone carries a
# ==>expected-output marker and is verified to produce that output on one declared environment: CPython 3.10 or newer, the standard library, and NumPy 1.26 or newer for the lattice chapters. There are 291 such blocks across the chapters and the appendices, and the gate runs in CI. The browser runtime here is that same environment. - Every flagship implementation is tested against the official NIST test vectors where applicable. The HQC and SQIsign chapters are pedagogical toys, and each documents how its code differs from the scheme it models, and why.
The course adds a fourth and removes none: your code is held to the same suites as the reference implementation. There is no separate grader, no hidden tests, and no partial credit. All 2,326 tests are the book’s own, and the ones that prove the function you are writing are printed on the page beside it.
If you find a claim that is not sourced, or a listing that does not produce the output it prints, that is a bug. Report it to contact@encryptorium.com, or open an issue on the code repository.
The status of standards, drafts, deployments and research results in this book was checked against their sources as of 19 October 2026. A statement that gives a different date carries its own.
What the course does not do
- No AI. The hints and references are 386 records written by hand, the same ones that generate the public stub files. Nothing is written for you while you work, and nothing you type is sent anywhere to be judged.
- No account beyond a GitHub sign-in. No profile, no password, no email. Your code, your written answers, your test results, the chapters you have marked read and the topics you picked are held against your GitHub account, so they follow you to any machine you sign in from. The privacy page lists exactly what is stored, and you can export or delete all of it from settings.
- No video, no discussion forum, and no certificate.
- No extra dependencies. The browser runtime covers what the book’s code needs and no more: the standard library, plus NumPy for the lattice chapters. The free book’s Appendix C documents the local setup if you would rather run the same suites in a terminal.