A Graduate Course in Applied Cryptography

Dan Boneh and Victor Shoup's A Graduate Course in Applied Cryptography is organized in three parts that move from symmetric encryption and integrity through public-key encryption and signatures to protocols for identification, zero-knowledge, key exchange and multiparty computation. For most constructions the authors state what an attacker may do and what counts as winning, then show by reduction that an attacker who beats the construction by more than trivial guessing would gain a comparable advantage against an explicit assumption or a component's security. That method is the reason to read the book, because it trains a reader to ask what a security claim quantifies over before trusting it. The authors offer the January 2023 draft, version 0.6, as a free PDF from the book's homepage at toc.cryptobook.us. It is still unfinished, and its examples predate current deployment guidance.

Chapter 2 sets the pattern. Perfect secrecy requires at least as many possible keys as possible messages, so for messages that are bit strings of a fixed length the key must be at least as long as the message, and the book asks instead that efficient adversaries gain at most negligible advantage in telling apart encryptions of two equal-length messages they choose. A challenger encrypts one of them, and Theorem 2.7 converts an attacker's edge at recovering a random encrypted message, measured above the chance of a blind guess, into at least as large an edge at this game, so semantic security leaves message recovery with negligible advantage. The equal-length rule is a leak the definition permits on purpose, and length can betray a great deal in practice. A proof holds within its stated model and hardness assumptions, and it carries over to deployed code when the implementation matches that model in what an attacker can observe as well as in what it computes. Section 4.3.2 describes AES code that returns correct ciphertexts while its cache timing leaks information about the key, a channel outside the input-output games. Tests still catch real bugs, though no finite set of passing tests covers every efficient adversary.

Chapter 9 shows what CPA security leaves open once a receiver processes ciphertexts an active attacker can alter. Mel intercepts an email encrypted under randomized counter mode or randomized CBC, both proven CPA secure, and XORs the difference between To:[email protected] and To:[email protected] into the first ciphertext block or the IV respectively, so the mail server decrypts the altered header and files the message in Mel's inbox. Ciphertext integrity closes that route by requiring that no efficient attacker, except with negligible probability, can produce a valid ciphertext different from every one the sender created. The book proves that CPA security plus ciphertext integrity yields chosen-ciphertext security, and encrypt-then-MAC achieves both generically with independent keys and secure components, while an arbitrary MAC-then-encrypt combination carries no such guarantee. Use a vetted library construction, and note that replay and reordering still need protocol state, while peer identity needs the binding Chapter 21 develops.

Public-key encryption, in Chapter 12, marks where the symmetric encrypt-then-MAC result stops transferring. A hybrid scheme with a stream-cipher layer lets Molly change From:Alice to From:Molly on submitted homework without reading its body, so Professor Bob gives her the credit. Chosen-ciphertext security rules that attack out, while wrapping a malleable scheme in sender authentication does not by itself supply it, because Molly, a registered student, can authenticate the altered ciphertext under her own credential. Even a CCA-secure scheme lets anyone holding Bob's public key encrypt a fresh submission headed From:Alice, a problem the book assigns to signcryption in Section 13.7. Nonmalleability and sender authentication therefore need separate checks after confidentiality is established.

Key exchange in Chapter 21 gets the same scrutiny. If parties identify themselves and then run anonymous key exchange, an adversary can wait for identification to finish and run a separate exchange with each side, relaying and editing traffic between the two keys. Reversing the order fails as well, because the adversary can terminate two encrypted channels and relay the identification messages between them. Authenticated key exchange binds the accepted identity to the session key, and the chapter grades protocols by the compromise they survive, separating static security from stronger notions such as forward secrecy and HSM security. Its main protocols, through Section 21.10, assume an offline certificate authority, while later sections treat password-based key exchange and a protocol with an online trusted third party.

The same discipline governs Chapter 23's treatment of trust spread across several parties. A sealed-bid auction run by one server exposes every bid if that server leaks or colludes, and copying all bids to several servers adds more places where a single compromise exposes them. Multiparty computation instead splits the evaluation itself among the parties and limits what each learns to what its own input and the specified output reveal. Beyond privacy and soundness, the definition asks for input independence, measured against an ideal auction in which a corrupt bidder chooses its bid without seeing Alice's, so a secure protocol gives that bidder no way to set its own bid one dollar above her unknown bid. Most protocols in the chapter do not attempt fairness or guaranteed output delivery, and the output still leaks, since a price set at the second-highest bid reveals that bid. The main treatment assumes an asynchronous network with static corruption and uses honest-but-curious parties as a step toward malicious ones, leaving adaptive corruption outside the model. A reader can then list which collusion and network assumptions remain once the trusted server is gone.

Several gaps affect the reading decision. Chapters 1 and 17 appear in the table of contents without bodies, and the Bulletproofs and SNARK sections remain unwritten along with appendices C and D. A bibliography exists, though many chapters still lack their Notes. The preface suggests a first pass that follows each proof idea and leaves detailed proofs to advanced readers, and it recommends reading through the exercises even without any intention of solving them. The material assumes probability and algebra along with enough mathematical maturity to follow proofs.

Engineers and auditors who already read proofs will gain most when they bring a precise question about a design: which experiment its security claim refers to, and which attacker behavior falls outside it. Readers looking for an implementation recipe or a current configuration guide should look elsewhere.