Summary
Further Reading
Books, references, and documentation to go deeper on cryptography.
This foundation is a hands-on introduction, not the last word. Cryptography rewards depth, and the sources below are the ones practitioners actually cite. They range from approachable narratives you can read on a train to rigorous references you keep open while coding, plus the standards that define what “correct” means in production.
Why This Matters
The fastest way to plateau is to stop reading after the tutorials. The authors below have spent careers finding the subtle failures this foundation only sketched, and the standards bodies define the parameters your systems must meet. Knowing which source answers which question saves hours and prevents the confident-but-wrong decisions that cause breaches.
Books from Approachable to Rigorous
| Book | Level | Best for |
|---|---|---|
| Real-World Cryptography (David Wong) | Approachable, modern | What is actually deployed today: TLS, Noise, PQC |
| Serious Cryptography (Jean-Philippe Aumasson) | Intermediate | Clear explanations of primitives and their pitfalls |
| Cryptography Engineering (Ferguson, Schneier, Kohno) | Intermediate, practical | Building and reasoning about whole systems |
| Understanding Cryptography (Paar, Pelzl) | Textbook, with lectures | Structured study with accompanying video course |
| A Graduate Course in Applied Cryptography (Boneh, Shoup) | Rigorous, free | The formal, proof-oriented deep end |
Start with Real-World Cryptography if you want breadth on what modern systems use, then move to Serious Cryptography or Cryptography Engineering for depth on why things fail.
Hands-On Challenge Sets
Reading is not enough; break things yourself.
- Cryptopals Crypto Challenges (cryptopals.com): the canonical set. You implement, then break, ECB, CBC padding oracles, and more. It reinforces every attack in the sibling Cryptography Checklist page’s Attacks section.
- CryptoHack (cryptohack.org): a gamified, interactive platform covering modern crypto and math foundations.
- The OpenSSL command-line labs throughout this foundation: extend them by building the full lab CA and mTLS setup end to end.
Standards and Recommendation Documents
These define the parameters you must actually meet.
| Document | Covers |
|---|---|
| RFC 8446 | TLS 1.3, the authoritative protocol spec |
| RFC 5280 | X.509 certificate and CRL profile |
| RFC 5246 | TLS 1.2 (for legacy context) |
| RFC 7748 | Curve25519 and Curve448 |
| NIST SP 800-57 | Key management and recommended key sizes |
| NIST SP 800-38D | GCM mode and its nonce requirements |
| NIST FIPS 203/204/205 | ML-KEM, ML-DSA, SLH-DSA (post-quantum standards) |
| OpenSSL documentation | The openssl commands used throughout this foundation |
Verifying a Claim Against a Source
When a source specifies a parameter, check your system against it directly.
cd ~/crypto-lab
# NIST SP 800-38D requires unique 96-bit nonces for GCM; confirm your tooling supports GCM
openssl enc -ciphers 2>/dev/null | tr ' ' '\n' | grep -i "gcm" | head -3Expected output:
-aes-128-gcm
-aes-192-gcm
-aes-256-gcmConfirming the cipher exists in your toolchain is the first step to applying a standard’s guidance. Use this page alongside the sibling Cryptography Checklist for the “what” and Next Learning Path for where to take the “why” next.
Practical Guidance
- Keep one approachable book (Real-World Cryptography) and one rigorous reference (Serious Cryptography) within reach; use the first for orientation and the second for decisions.
- Work through Cryptopals sets 1 and 2 before writing production crypto; implementing the attacks builds instincts no reading can.
- Cite the relevant RFC or NIST document in design reviews so parameter choices are grounded, not remembered.
- Bookmark the OpenSSL manual pages for the commands in this foundation; they are the authoritative reference for the lab tools.
- Track NIST FIPS 203/204/205 and RFC updates, since post-quantum guidance and TLS parameters continue to evolve.