The goal of this course is to provide insight into cryptography secure against quantum computers (post-quantum cryptography) as well as various methods for the mathematical cryptanalysis of cryptographic systems


Cryptology deals with mathematical techniques for design and analysis of algorithms and protocols for digital security in the presence of malicious adversaries. For example, encryption and digital signatures are used to construct private and authentic communication channels, which are instrumental to secure Internet transactions.

This course in cryptology consists of two main topics:

The first part focuses on post-quantum cryptography dealing with cryptographic systems that are secure even given the existence of quantum computers and the second part focuses on cryptanalysis, the analysis of the security of cryptographic systems.

After a general introduction to cryptography (the constructive side of cryptology) and cryptanalysis the course introduces the main contenders for secure systems: lattice-based encryption, code-based encryption, hash-based signatures, and multivariate-quadratic-based signatures. These systems are examples of public-key systems and this is the main area affected by quantum computers; symmetric-key systems, such as hash functions and block and stream ciphers) are used as building blocks inside them and for the transmission of data in bulk.

The second part of the course will cover various generic attacks against common cryptographic primitives (e.g., block ciphers, hash functions) and cover important cryptanalytic attack techniques like time-memory tradeoffs, linear cryptanalysis, differential cryptanalysis and algebraic cryptanalysis.


Basics of linear algebra (simple bachelor level), probability theory (simple bachelor level), knowledge of number theory and algebra matching at least http://www.hyperelliptic.org/tanja/teaching/cryptoI13/nt.pdf and http://www.hyperelliptic.org/tanja/teaching/CCI11/online-ff.pdf.

It is recommended but not mandatory to follow the MasterMath course on Cryptology first; that course is available as video lectures for self study.


Tanja Lange, Andreas Hülsing, and Marc Stevens.

There will be no graded homework assignments but problems for self study will be handed out. There will be a written exam at the end of the semester. The retake will be organized as a written exam or oral exam depending on the number of students who need to take it.