Free online course Modern Cryptography for Beginners: Encryption, Hashing, Signatures and Secure Computation
Duration of the online course: 24 hours and 7 minutes
New
Build real cryptography skills with a free online course on encryption, hashing, signatures, TLS and secure computation—learn how modern security is proven.
In this free course, learn about
Cryptography goals, threat models, and why adversaries are central to security definitions
TLS secure channels: authenticated key exchange to establish shared keys and authenticate peers
Idealized protocols (coin flipping, commitments) and properties like hiding vs binding/fairness
Block ciphers (DES/AES), permutations, and key-recovery security games incl. TKR/KR/EKS
2DES meet-in-the-middle weakness; motivation for 3DES and modern ciphers like AES
PRFs and distinguishing experiments; birthday attacks and limits of block ciphers as PRFs
Modern systems rely on cryptography every time you log in, send a message, pay online, or establish a secure connection. This course gives beginners a clear path into modern cryptography by focusing on the ideas that actually drive security in practice: rigorous threat models, precise definitions, and the reasoning that links an algorithm to the protection it promises. Instead of treating crypto as magic, you learn how to think like a security engineer and how to measure what an attacker can and cannot do.
You start with the purpose of cryptography and why the notion of an adversary sits at the center of everything. With that mindset, the course connects real-world secure channels like TLS to their essential building blocks, explaining why key exchange must be authenticated and what can go wrong when it is not. Through simple motivating stories, you develop intuition for protocol design, including fairness and bias prevention, before moving into the core primitives that power modern security.
From there, you build a practical foundation in symmetric cryptography: block ciphers, why standards like DES led to AES, and how security is defined through games such as key recovery and pseudorandomness. You see why shortcuts like Double DES fail against classic attacks, and how birthday-style effects shape real security limits. With that groundwork, you learn encryption modes and what it really means to be secure against chosen-plaintext attacks, understanding why deterministic encryption leaks patterns and how modern modes prevent it.
The course then expands your toolbox with hash functions, message authentication, and authenticated encryption, emphasizing how privacy and integrity must work together. You move into the number theory behind public-key cryptography, then study RSA and Diffie–Hellman through the lens of formal security goals, including why chosen-ciphertext security requires carefully restricting decryption access. Digital signatures and Schnorr-style reasoning add authenticity and non-repudiation concepts, and the course ties them to real deployments with public-key infrastructure and certificates.
Finally, you explore advanced but increasingly relevant ideas: identity-based encryption, commitment schemes, homomorphic encryption limits, and secure computation from two-party to multi-party settings using secret sharing. By the end, you will be able to read crypto discussions with confidence, understand why protocols are constructed the way they are, and make better security decisions in engineering and cybersecurity contexts.
Course content
Video class: Introduction: What is Cryptography?30m
Exercise: In modern cryptography, why is an "adversary" considered a central concept?
Video class: Introduction: Secure channels and TLS29m
Exercise: In a typical TLS secure channel, what is the main role of the authenticated key exchange phase?
Video class: Introduction: The divorce21m
Exercise: In the safe-based fair coin-flipping protocol, which pair of properties must the safe satisfy to prevent either party from biasing the outcome?
Video class: Introduction: Cryptographic Lego39m
Video class: Block Ciphers and KR Security: What is a block cipher, and DES47m
Exercise: Which condition is required for a function family E to be a block cipher?
Video class: Block Ciphers and KR Security: TKR and KR Security, EKS, Security of DES1h06m
Exercise: In the consistent key recovery (KR) game for a family of functions, when does the adversary win at finalize?
Video class: Block Ciphers and KR Security: 2DES, Meet-in-Middle-Attack, 3DES, AES47m
Exercise: Why is Double DES (2DES) not effectively much more secure than DES against key-recovery attacks?
Video class: Pseudorandom Functions: Definition and example35m
Exercise: In the PRF distinguishing experiment, what does a distinguisher try to do by querying the oracle?
Video class: Pseudo random functions: Birthday attacks, PRF implies KR55m
Exercise: Why does the birthday attack give a generic distinguisher against viewing a block cipher as a PRF?
Video class: Symmetric Encryption: Modes of Operation and IND-CPA57m
Exercise: Why is deterministic encryption (like ECB with a fixed key) insecure under IND-CPA?
Video class: Symmetric Encryption: IND-CPA security of CTR$ and CBC$1h18m
Exercise: In counter mode, what key factor enables a birthday-style IND-CPA attack that can reveal whether two plaintext blocks are equal?
Video class: Hash Functions1h30m
Exercise: In the collision-resistance game for a hash function family, what information is the adversary given at initialization?
Video class: Message Authentication1h31m
Exercise: In the UFCMA security game for a message authentication code (MAC), what must be true for the adversary to win?
Video class: Authenticated Encryption1h04m
Exercise: Which generic composition method correctly achieves authenticated encryption by preserving privacy (IND-CPA) and integrity of ciphertext (INT-CTXT)?
Video class: Computational Number Theory: Part 11h32m
Exercise: In the classic Diffie–Hellman key exchange, what value do both parties end up computing as the shared key?
Video class: Computational Number Theory: Part 256m
Exercise: Why are RSA encryption exponents like 3, 17, or 65537 commonly used in practice?
Video class: Public-key Encryption: Part 11h31m
Exercise: In IND-CCA security for public-key encryption, why must the decryption oracle refuse to decrypt certain ciphertexts?
Video class: Public-Key Encryption: Part 241m
Exercise: In the random oracle model, how is a hash query H(x) answered to ensure consistency across repeated queries?
Video class: Digital Signatures: Part 11h06m
Video class: Digital Signatures: Part 224m
Exercise: In Schnorr signatures, why is it important that the group order m is prime in the security reduction that extracts the signing key from two forgeries?
Video class: Public-Key Infrastructure and Certificates28m
Exercise: What is the main purpose of a certificate in a public key infrastructure (PKI)?
Video class: Session Key Exchange59m
Exercise: Why is basic Diffie–Hellman key exchange alone insufficient for session key exchange against active attackers?
Video class: Identity-based Encryption31m
Exercise: In identity-based encryption (IBE), what enables a sender to encrypt to a recipient without obtaining a certificate or public key for that recipient?
Video class: Commitment schemes36m
Exercise: In a commitment scheme, what does the binding property guarantee?
Video class: Homomorphic encryption39m
Exercise: Why can’t homomorphic encryption schemes generally achieve IND-CCA security when the function class is non-trivial?
Video class: Two-party secure computation39m
Exercise: In the semi-honest (honest-but-curious) setting for secure two-party computation, what is the adversary allowed to do?
Video class: Secret sharing26m
Video class: Multi-party secure computation56m
Exercise: In the private-sum MPC protocol using additive secret sharing, what does each party broadcast after receiving shares from all others?