Free online course Foundations of Cryptography: Symmetric, Public-Key, Hashing and Signatures
Duration of the online course: 32 hours and 51 minutes
New
Build real cryptography skills in this free online course—encryption, hashes and digital signatures explained clearly, with exercises and optional certificate.
Signatures/PKI, identification (Schnorr, Fiat–Shamir), number theory, secret sharing, ZK proofs
About the free online course
Modern security depends on cryptography, yet many developers and IT professionals use it as a black box. This course helps you build a clear, practical foundation so you can reason about security guarantees, understand what attackers can and cannot do, and choose the right primitives for real systems. Instead of relying on folklore, you will learn the mindset and vocabulary used to define security goals and evaluate whether a construction actually meets them.
You begin with symmetric-key encryption and the core idea of building a secure channel: confidentiality and integrity under well-specified adversary capabilities. From classical ciphers and perfect secrecy, you see why one-time pads are special and why key reuse breaks security. The course then moves to computational security, introducing the kinds of assumptions and efficiency constraints that make cryptography useful in practice, and the definitions that capture what it means for an adversary to learn nothing meaningful from ciphertext.
From there, you connect theory to building blocks that appear everywhere in software: pseudorandom generators and stream ciphers, pseudorandom functions, and block-cipher modes of operation. You will learn how subtle choices like IV handling, randomness, and composition determine whether an encryption scheme withstands realistic attacks. As you progress, the focus expands from passive eavesdroppers to active attackers, leading to message authentication codes, integrity for long messages, and the goal of authenticated encryption where secrecy and tamper resistance work together.
The course also develops a solid understanding of hash functions and how they are modeled, what generic attacks imply about security margins, and why design patterns such as Hash-and-MAC matter in engineering. Moving into public-key cryptography, you will study key exchange and cyclic-group hardness assumptions, then see how those ideas power public-key encryption, hybrid encryption, and the leap from CPA to CCA security.
Finally, you explore digital signatures, certificates and PKI, plus foundational number theory concepts that make the algorithms tick. Along the way, exercises reinforce the definitions and threat models so you can spot dangerous reuse, insecure compositions, and misleading security claims. By the end, you will be able to read cryptographic APIs and protocol descriptions with far more confidence, and make better security decisions in cyber security and software engineering projects.
Course content
Video class: noc20 cs02 lec01 Introduction28m
Exercise: Which set of properties defines the virtual secure channel for secure communication?
Video class: noc20 cs02 lec02 Symmetric key Encryption46m
Exercise: According to Kerckhoffs’ principle, what should the security of a cryptosystem rely on?
Video class: noc20 cs02 lec03 Historical Ciphers and their Cryptanalysis26m
Video class: noc20 cs02 lec04 Perfect Security51m
Exercise: Which statement best captures Shannon’s definition of perfect secrecy for an encryption scheme?
Video class: noc20 cs02 lec05 Limitations of Perfect Security20m
Exercise: In a one-time pad (Vernam cipher), what happens if the same key is reused to encrypt two different messages?
Video class: noc20 cs02 lec06 Introduction to Computational Security36m
Exercise: In modern cryptography, which pair of relaxations enables practical key reusability (using the same short key to encrypt many messages)?
Video class: noc20 cs02 lec07 Semantic Security49m
Exercise: In the ciphertext-only attack (COA) indistinguishability experiment for semantic security, what is the required upper bound on the adversary’s success probability of guessing which message was encrypted?
Video class: noc20 cs02 lec08 Pseudo random Generators PRGs30m
Exercise: In a pseudorandom generator (PRG) indistinguishability experiment, what condition must hold for every PPT distinguisher D if G is secure?
Video class: noc20 cs02 lec09 Operations on Pseudorandom Generators30m
Exercise: In the hybrid-argument proof for parallel composition of a PRG with k = 2, what is the intermediate experiment (Hint)?
Video class: noc20 cs02 lec10 Stream Ciphers20m
Exercise: Why is a basic stream cipher (m XOR G(k)) not multi-message secure when the same key k is reused?
Video class: noc20 cs02 lec11 Provably secure Instantiation of PRG39m
Exercise: In a provably secure PRG construction from a one-way permutation f and an associated hard-core predicate hp, how is a 1-bit expansion PRG G(s) typically defined for an n-bit seed s?
Video class: noc20 cs02 lec12 Practical Instantiations of PRG33m
Exercise: Why is a basic linear feedback shift register (LFSR) not considered a secure pseudo-random generator for critical applications?
Video class: noc20 cs02 lec13 CPA security35m
Exercise: Why is a basic stream cipher not multi-message secure when the same key is reused?
Video class: noc20 cs02 lec14 Pseudo random Functions PRFs41m
Exercise: In the indistinguishability experiment for a pseudo-random function (PRF), what is the distinguisher’s goal?
Video class: noc20 cs02 lec15 CPA secure Encryption from PRF37m
Exercise: In the PRF-based CPA-secure encryption scheme, what is the ciphertext for an L-bit message m?
Video class: noc20 cs02 lec16 Modes of Operations of Block Ciphers Part I26m
Exercise: Why is ECB mode not CPA-secure?
Video class: noc20 cs02 lec17 Modes of Operations of Block Ciphers Part II34m
Exercise: Which feature distinguishes CTR mode from OFB mode in generating the pad stream?
Video class: noc20 cs02 lec18 Theoretical Constructions of Block Ciphers38m
Video class: noc20 cs02 lec19 Practical Constructions of Block Ciphers Part I42m
Exercise: In a substitution–permutation network (SPN), where does the “confusion” mainly come from even though S-boxes are publicly known?
Video class: noc20 cs02 lec20 Practical Constructions of Block Ciphers Part II41m
Exercise: Why is double encryption (e.g., Double-DES) not considered to provide the expected 2k-bit security against key recovery?
Video class: noc20 cs02 lec21 From Passive to Active Adversary36m
Exercise: In the CCA security game, which restriction is imposed on the adversary’s decryption-oracle queries after receiving the challenge ciphertext c*?
Video class: noc20 cs02 lec22 Message Integrity and Authentication26m
Exercise: In a symmetric-key setting, what is the main purpose of a Message Authentication Code (MAC)?
Video class: noc20 cs02 lec23 Message Authentication for Long Messages Part I30m
Exercise: Why does independently authenticating each block of a multi-block message using a fixed-length MAC fail to give a secure MAC for arbitrary-length messages?
Video class: noc20 cs02 lec24 Message Authentication for Long Messages Part II33m
Exercise: In randomized ε-prefix-free encoding for CBC-based PRFs, why does XORing the last message block with a uniformly random n-bit key help security?
Video class: noc20 cs02 lec25 Information theoretic MACs Part I27m
Exercise: In a one-time information-theoretic secure MAC constructed using a strongly universal function (SUF), what is the maximum success probability of a computationally unbounded adversary forging a valid tag for a new message after seeing one valid (m, t) pair?
Video class: noc20 cs02 lec26 Information theoretic MACs Part II30m
Exercise: In the finite-field-based strongly universal function (SUF) used to build a one-time information-theoretic MAC, what is the tag output for message m under key (a,b) in Zp?
Video class: noc20 cs02 lec27 Cryptographic Hash Functions Part I30m
Exercise: In the Merkle–Damgård paradigm, what is the role of the fixed-length compression function h?
Video class: noc20 cs02 lec28 Cryptographic Hash Functions Part II33m
Exercise: In the Davies–Meyer construction for a compression function, how is the output computed from a block cipher?
Video class: noc20 cs02 lec29 Message Authentication Using Hash Functions42m
Exercise: In the Hash-and-MAC paradigm for authenticating arbitrary-length messages, how is the tag for a message m computed?
Video class: noc20 cs02 lec30 Generic Attacks on Hash Functions and Additional Applications of Hash Functions41m
Exercise: In a birthday attack on an l-bit hash output (N = 2^l), about how many distinct hash evaluations are needed to obtain a collision with a constant (non-negligible) probability?
Video class: noc20 cs02 lec31 Random Oracle Model Part I26m
Exercise: In the Random-Oracle Model (ROM), how is the hash function H ideally modeled when proving security of hash-based constructions?
Video class: noc20 cs02 lec32 Random Oracle Model Part II38m
Exercise: In a hash-based commitment scheme where the commitment is c = H(m || s), which security property can be proven from collision resistance alone (without using the Random-Oracle model)?
Video class: noc20 cs02 lec33 Authenticated Encryption32m
Exercise: Which pair of properties must a symmetric encryption scheme satisfy to be considered an authenticated encryption (AE) scheme?
Video class: noc20 cs02 lec34 Composing CPA secure Cipher with a Secure MAC Part I49m
Exercise: In the encrypt-then-authenticate composition, what is the correct order of operations to produce the final ciphertext?
Video class: noc20 cs02 lec35 Composing CPA secure Cipher with a Secure MAC Part II33m
Exercise: Why can the encrypt-and-authenticate composition fail to be CPA-secure when the MAC tag generation is deterministic?
Video class: noc20 cs02 lec36 Key Exchange Protocols Part I34m
Exercise: In an anonymous key-exchange protocol, what is the key difference between weak privacy and strong privacy against an eavesdropper?
Video class: noc20 cs02 lec37 Key Exchange Protocols Part II21m
Exercise: Which statement best describes a one-way trapdoor function?
Video class: noc20 cs02 lec38 Cyclic groups37m
Exercise: In a cyclic group G of order q with generator g, what is the discrete logarithm of an element y with respect to base g?
Video class: noc20 cs02 lec39 Cryptographic Hardness Assumptions in the Cyclic Groups31m
Exercise: In the Diffie–Hellman key exchange instantiated with E(α)=g^α and F(α,β)=g^(αβ), which hardness assumption is required to achieve strong privacy (the key looks indistinguishable from random given g^α and g^β)?
Video class: noc20 cs02 lec40 Candidate Cyclic Groups for Cryptographic Purposes Part I24m
Exercise: Why is the full multiplicative group Z_p* (with multiplication mod p) considered inappropriate for securely instantiating the Diffie–Hellman key-exchange in general?
Video class: noc20 cs02 lec41 Candidate Cyclic Groups for Cryptographic Purposes Part II27m
Exercise: Why are elliptic-curve-based cyclic groups often preferred over prime-order subgroups of Zp* for practical security?
Video class: noc20 cs02 lec42 Cryptographic Applications of the Discrete Log Assumption32m
Exercise: Why does finding a collision in the function HDL(α,β)=g^α·h^β help in solving a discrete logarithm instance?
Video class: noc20 cs02 lec43 Public key Encryption30m
Exercise: In public-key encryption, why are COA security and single-message CPA security considered equivalent?
Video class: noc20 cs02 lec44 El Gamal Public key Encryption Scheme36m
Exercise: In the El Gamal public-key encryption scheme, which pair correctly represents the ciphertext for a message m?
Video class: noc20 cs02 lec45 RSA Assumption25m
Exercise: In the RSA permutation over ZN*, what condition on the public exponent e ensures that an inverse exponent d exists modulo φ(N)?
Video class: noc20 cs02 lec46 RSA Public key Cryptosystem45m
Exercise: Why is plain RSA encryption considered insecure under chosen-plaintext attacks (CPA)?
Video class: noc20 cs02 lec47 Hybrid Public key Cryptosystem37m
Exercise: In a KEM/DEM hybrid encryption scheme, what does the encapsulation algorithm (Encap) output?
Video class: noc20 cs02 lec48 CCA Secure Public key Ciphers32m
Exercise: In the CCA security game for public-key encryption, what restriction is placed on the adversary’s post-challenge decryption queries?
Video class: noc20 cs02 lec49 CCA Secure Public key Ciphers Based on Diffie Hellman Problems25m
Exercise: Why is ElGamal public-key encryption not CCA secure?
Video class: noc20 cs02 lec50 CCA Secure Public key Ciphers Based on RSA Assumption38m
Exercise: Why is plain RSA encryption not CCA secure?
Video class: noc20 cs02 lec51 Digital Signatures36m
Exercise: In a public key infrastructure (PKI), what is the main role of a digital certificate issued by a Certificate Authority (CA)?
Video class: noc20 cs02 lec52 RSA Signatures19m
Exercise: In the plain RSA signature scheme, how can an adversary mount the simplest “no message attack” without querying any signature oracle?
Video class: noc20 cs02 lec53 Identification Schemes40m
Exercise: In the Schnorr identification scheme, when is a transcript (I, r, s) considered accepting?
Video class: noc20 cs02 lec54 Schnorr Signature Scheme and TLS or SSL29m
Exercise: In the Fiat–Shamir transformation, how is the verifier’s challenge determined in the resulting signature scheme?
Video class: noc20 cs02 lec55 Number Theory33m
Exercise: When does the multiplicative inverse of an integer a modulo N exist?
Video class: noc20 cs02 lec56 Secret Sharing36m
Exercise: In Shamir’s (n, t) secret sharing, why can any t+1 shareholders reconstruct the secret, but any t shareholders cannot?
Video class: noc20 cs02 lec57 Zero Knowledge Protocols Part I25m
Exercise: In the graph isomorphism zero-knowledge protocol, what is the probability that a cheating prover (who does not know the isomorphism) succeeds in all k rounds?
Video class: noc20 cs02 lec58 Zero Knowledge Protocols Part II30m
Exercise: In the zero-knowledge proof system for the 3-coloring problem, why does the prover commit to a randomly permuted coloring before the verifier chooses an edge challenge?
Video class: noc20 cs02 lec59 Good Bye for Now10m
Exercise: What is the two-stage approach described for achieving secure communication between two parties with no pre-shared information over a public channel?
