I’ve been asked some variant of this a couple of times in the past few days (here, via email, and via Signal):
How do I learn more about cryptography?
The bad news is, that’s too broad of a question for me to effectively answer for a general audience. What you already know matters a lot on how to approach this topic.
The best introduction I can point people to is, So, you want to be a Cryptographer?* | CryptoGotchas.
The author includes one of my blog posts on the matter from 2020 in their recommended reading list: How To Learn Cryptography as a Programmer - Dhole Moments
As the title says, it’s about how to start learning cryptography if you already know a little computer programming. The only thing I would add in 2025 is that you should probably skip learning “public key encryption” entirely until you’re an expert, lest you accidentally implement RSA insecurely and think you’re safe.
(Use KEMs (Key Encapsulation Mechanisms) instead. Libsodium’s crypto_box and crypto_box_seal APIs are morally equivalent to DHKEM-X25519 from HPKE.)
Post-Quantum Cryptography
Post-quantum cryptography is still being implemented and deployed in critical infrastructure. Alfred Menezes has two lecture series worth tuning into if you’re interested in this topic:
- Lattice-Based Cryptography – Cryptography 101 with Alfred Menezes
- Kyber and Dilithium – Cryptography 101 with Alfred Menezes
Aside: I do have a blog post in draft status about implementing Kyber and Dilithium, but I’m also implementing both algorithms in pure TypeScript and walking through the implementation with the blog post but as you can imagine, that takes a while to write and format. If you follow the FIPS-203 and FIPS-204 specifications from back-to-front, you’ll basically be able to predict the structure and contents of that post.
Cryptanalysis
The best way of learning is often doing. To that end, there are a few cryptography challenges worth trying at:
If you’d rather follow along someone’s breakdown of a cryptography function:
- Cryptanalysis of Meow Hash | Content
- Carnage's tech talk
- The first collision for full SHA-1
- Counter-cryptanalysis (this is why SHA1 collisions don’t break git)
Cryptography Software and/or Protocol Design
First, you should learn about JSON Web Tokens. Maybe even implement (but don’t publish) a simple JWT library, following the RFCs, and use it in a local app.
Then, and only then, you should read this next section:
Read this: No Way, JOSE! Javascript Object Signing and Encryption is a Bad Standard That Everyone Should Avoid - Paragon Initiative Enterprises Blog, How Many Days Since the Last JWT alg=none Vulnerability?, and (optionally) Possibility of Reintroducing HS256/RSA256 Type Confusion (CVE-2021-46743) · Issue #351 · firebase/php-jwt · GitHub for even more fun
It is important that you follow the prescribed pattern (read the standard first, then implement it faithfully, and finally learn about the sharp edges of the standard that you may very well get cut by), so you can learn how impactful getting this wrong is.
If you intuitively understand the importance of making your designs easy to use and hard to misuse, you can then begin designing cryptographic software or protocols. A lot of the cryptography used on the Internet isn’t misuse-resistant, and that frequently bites end users (a.k.a., probably the very people that will read this thread, and your friends).
My full-time job is to review cryptography products (both proprietary and open source) to spot design flaws and implementation errors. Some of these things can be subtle. For example: Understanding HKDF - Dhole Moments
Advanced Topics (Multi-Party Computation, Zero-Knowledge Proofs, etc.)
The best resource I’ve found to date is ZKDocs.
Designing Cryptography Primitives
If you decide you need to build your own block cipher mode, or new asymmetric-key cryptosystem, or zero-knowledge proof system, you’re either about to make a huge mistake OR you’ve long since transcended needing to read my advice on this matter.
(If the latter, I wish you the best. Make sure you share your pre-print PDF with the IACR.)
I hope you found this helpful. Happy to answer any questions anyone has.