You end up withAn authenticator-app code generator (HOTP and TOTP) that matches real sites; AES in C, with the key schedule and two modes of operation; textbook RSA and elliptic-curve key exchange and signatures you wrote and understand the weaknesses of; and working attacks from the Cryptopals challenges on real-world constructions, from repeating-key XOR to padding oracles.
Data pulled 2026-11-08 · time estimates are editorial
Why build cryptography you must never ship? Because “don’t roll your own crypto” only makes sense once you’ve seen how your own fails. After this track, ECB mode, a padding oracle and textbook RSA are attacks you’ve run, not warnings you’ve read.
Read this first. Nothing you write in this course belongs in production. Every implementation here skips protections real libraries have, such as constant-time code and safe padding. When you need cryptography in real software, use a vetted library such as libsodium or your platform’s standard one.
This course is an opener. Its first three stages are published. More stages come next; see Coming next at the end.
How to read the receipts.
Points are summed across every HN submission of the same URL. For multi-part series on one site (Andrea Corbellini’s elliptic-curve posts, the Cryptopals pages), that includes parts submitted on their own.
“Submitted N×” means HN rediscovered it N times.
Quotes come from the highest-ranked top-level comments in those threads, and a quote is sometimes a criticism. Quotes keep the commenter’s spelling.
Steps are ordered for learning, not by points.
Times are our estimates, not the authors’. They assume evenings and weekends, a reader who writes Python or C comfortably, and some patience with modular arithmetic.
An introductory book for programmers covering everything you need to understand a system like TLS: block ciphers, stream ciphers, hash functions, message authentication codes, public-key encryption, key agreement and signatures. Each primitive comes with the ways it gets broken in practice.
“I read the book, it is well written, accessible and pretty accurate. I think it’s worth a skim even just to learn more about something you vaguely know but you can’t explain in your own words.”
HN’s caveat is that reading isn’t the same as doing. “The old Cryptopals challenges (http://cryptopals.com/) seem to cover the same material in a pedagogically very different way” (PeterisP, 2016 · comment). That’s why the challenges are Stage 3 of this course.
The codes in your authenticator app, built from an HMAC, a counter and the clock, following RFC 4226 and RFC 6238. A small, complete first build that uses a real primitive correctly.
Alternative: Susam Pal’s MinTOTP (347 points across 7 submissions) does it in about 20 lines of Python. “It is a bit terse, but there is a 20-line Python implementation which cleared up the ideas for me” (3eb7988a1663, 2025 · comment)
AES from the bytes up: the finite field GF(2⁸), the S-box, the key schedule, the rounds, and decryption. Then two modes of operation, ECB and CBC, and why a sound cipher can still leak your data through the way it’s applied. The full code is in a companion repository.
“And also good that they mention right from the start that you shouldn’t use your (or their) self-made cryptography in production (although they could have emphasized it a bit more).”
Key generation, modular exponentiation and the extended Euclidean algorithm from first principles, then a working textbook RSA. The article has since been rewritten as the first of a three-part series that explains what breaks textbook RSA: Part 2 covers real primes, encoding text and malleability, and Part 3 covers timing side channels and blinding.
HN’s caveat came in 2021, before the rewrite, and it still applies to every textbook RSA: “Missing from the article is a warning about how hard it actually is to make RSA secure. There are a ton of footguns that are easy to miss which can result in a totally broken implementation.” (dagenix, 2021 · comment). A practical tip from the same thread: “Quite a bit of that code can be eliminated if you use the 3 argument form of Python’s pow() function.” (tzs, 2021 · comment)
432 points across 7 submissions of its parts (2015–2025) · Free · Python · ~1–2 weeks
A four-part series: elliptic curves over the reals, then over finite fields and the discrete logarithm, then ECDH key exchange and ECDSA signatures, then how the security can be broken and how it compares with RSA. The posts include Python scripts for the algorithms; write your own versions and check them against the scripts.
Alternative: Fang-Pen Lin’s Elliptic Curve Cryptography Explained (769 points, submitted 2×) covers the same ground to key exchange and encryption in one post, with a Jupyter notebook. “The thing I like best about this article is that it touches on elliptic curves over finite fields in more than a cursory way.” (andrewla, 2019 · comment)
1,313 points across 26 submissions (2013–2026) · Free · any language · ~6–10 weeks for sets 1–6
Eight sets of exercises, each an attack on a weakness found in real systems: basics, block crypto, block and stream crypto, stream crypto and randomness, Diffie-Hellman, RSA and DSA, hashes, and abstract algebra. You get just enough information to learn the concept and work out the attack yourself. For this opener, sets 1–6 are the target; sets 7 and 8 are a stage of their own.
“A good complement to this set of challenges is Dan Boneh’s Crypto class on Coursera. The coursera class is more theory-driven, whereas these challenges are more practical… they mix well.”
Set 1 is gentle; by set 3 you’re running a CBC padding-oracle attack. If you get stuck on the concepts, go back to the matching chapter of Crypto 101.
Coming next
Candidates for the next stages, receipts pulled but not yet reviewed or written:
Cryptocurrency from scratch. Andrej Karpathy’s A from-scratch tour of Bitcoin in Python (1,237 points), which builds keys, addresses and a transaction on secp256k1.
Zero-knowledge proofs. Matthew Green’s illustrated primer (367 points) and Programming Zero Knowledge Proofs: From Zero to Hero (281 points).
A Graduate Course in Applied Cryptography · Dan Boneh and Victor Shoup · https://toc.cryptobook.us/ · 1,438 points across 19 submissions (2015–2024) · Free (PDF, version 0.6, January 2023). The rigorous textbook: secret-key and public-key cryptography, then protocols, with proofs. “If it’s anything like the one they teach at Georgia Tech, this is a quite difficult course.” (auiya, 2020 · comment)
Handbook of Applied Cryptography · Menezes, van Oorschot and Vanstone · https://cacr.uwaterloo.ca/hac/ · 408 points across 9 submissions (2012–2025) · Free (PDF chapters). The classic algorithm reference from 1996. “Warning: this is more of a reference book.” (baby, 2023 · comment)
Method
Candidates came from the 47 crypto-tagged stories in the 4,140-story pull, plus a crypto topic pull with 30 terms: 155 candidates in all (phase1-stories/data/crypto_candidates.json). Blockchain explainers from 2017 and cryptography policy news made up much of the noise and were skipped by hand.
Selection. 16 resources had receipts pulled; 10 are used here, chosen by hand for followability and sequence. Points were then totalled across every submission of each URL.
Quotes come from the top five top-level comments of the two best-scoring threads per resource, in HN’s ranked order via the Firebase API. Links go to the full comment. Every ID and quote is checked with phase1-stories/scripts/check_track.py.
Content and costs were checked on 2026-11-08 on each resource’s own page: Crypto 101’s contents and formats, the AES post’s language, modes and inverse S-box, the TOTP post’s RFCs, the rewritten RSA article and the titles of its follow-up parts, the Cryptopals set list, and the Boneh–Shoup version and table of contents. Time estimates are editorial, not measured.
Data:tracks/crypto/receipts.json (resources used) and candidates_receipts.json (all 16 checked).