Description

Cryptography is the science of securely carrying out tasks (e.g., communication) in presence of adversaries (e.g., eavesdroppers). In this course, we will first study certain basic tasks in cryptography (e.g., secure communication), with an emphasis on precise modelling of the adversary's capabilities and goal -- the threat model -- and formally proving security in this model -- the security proof. Then, we will see how more complex applications you use everyday (e.g., HTTPS, secure messaging, time-based one-time password) can be built on top of these. Additionally, we will also have hands-on sessions aimed at exposing you to real world cryptographic libraries.

Prerequisites

Discrete structures and probability theory are soft prerequisites. This course will involve some amount of theory, and thus we will expect mathematical maturity.

Who can credit?

Since the course is a minor, it is open to all non-CS, non-freshmen UGs.

Grading and Attendance

Weightage	Towards
35%	End-sem
28%	Mid-sem
20%	Two (out of three) quizzes
10%	Two CTFs
5%	Class participation, pop-quizzes
2%	Feedback

Attendance is not mandatory (but encouraged). There will be four ungraded assignments to help you with quizzes and exams.

---

#	Date	Slides	+	Topics Covered
L01	29/Jul	[↗]	-	Administrivia What is cryptography? Course overview: what happens when you do netbanking?
Module I: Secure Communication in the Shared-Key Setting
L02	31/Jul	[↗]	-	What can we learn from history? Historical ciphers and their cryptanalysis Modern principles
L03	05/Aug	-	[↗]	Basic probability theory Primer: randomised algorithms
L04	07/Aug	[↗]	-	Perfect secrecy against eavesdroppers One-time pad Limitations of perfect secrecy: Shannon's impossibility
CTF0	07/Aug	-	[↗]	"CTF" 0
A1	10/Aug	-	[↗]	Assignment 1
L05	12/Aug	[↗]	[↗]	Primer: Turing machine and other models of computation Probabilistic polynomial time (PPT) and negligible functions The security parameter
L06	14/Aug	[↗]	-	How to encrypt messages longer than the key? Computational secrecy against eavesdroppers Pseudo-random generators (PRG) and Computational OTP Main tool: reduction algorithm
L07	19/Aug	[↗]	[↗]	How to construct a PRG? Stream ciphers and unpredictability Theoretical constructions
Q1	19/Aug		[↗]	Quiz 1: 17:00-18:00 in CC101+CC103
L08	21/Aug	[↗]	[↗] [↗]	How to (statefully) encrypt multiple messages? Length-extension of PRG Main tool: hybrid argument
CTF1	24/Aug		[↗]	CTF 1: due 06/Sep EoD
H	26/Aug	No lecture: Id-e-Milad
L09	28/Aug	[↗]	[↗]	How to (statelessly) encrypt multiple messages? Random oracles and pseudo-random functions (PRFs)
A2	31/Aug	-	[↗]	Assignment 2
L10	02/Sep	[↗]	-	How to construct a PRF? Chosen-plaintext attack (CPA) CPA-secure SKE from PRF
L11	04/Sep	[↗]	[↗] [↗]	How to efficiently encrypt long messages? Block ciphers Modes of Operation
Q2	07/Sep	-	[↗]	Quiz 2: 08:15-09:25 in CC103
L12	09/Sep	[↗]	-	How to deal with an active adversary? Part I Message authentication code (MAC) How to construct a fixed-length MAC? Domain-extension and CBC-MAC
L13	11/Sep	[↗]	[↗]	How to deal with an active adversary? Part II A chosen-ciphertext attack (CCA): padding-oracle attack How to construct an IND-CCA-secure SKE? Authenticated encryption: AES-GCM
M	20/Sep		[↗]	Mid-sem: 14:00-16:00 in TBA
Module II: Secure Communication in the Public-Key Setting
L14	23/Sep	[↗]		Key exchange Basic group theory
L15	25/Sep	[↗]		Diffie-Hellman key exchange (DHKE) Public-key encryption (PKE) Elgamal encryption
L14	30/Sep	[↗]		Basic number theory Goldwasser-Micali encryption RSA encryption
A3	30/Sep		[↗]	Assignment 3
H	02/Oct	No lecture: Mahatma Gandhi Jayanti
L17	07/Oct	[↗]		Digital signature One-way function (OWF) Lamport's one-time signature
L18	09/Oct	[↗]		Signing longer messages: hash-then-sign paradigm Collision-resistant hash function Domain extension: Merkle-Damgård and Merkle Tree
Q3	14/Oct		[↗]	Quiz 3: 17:00-18:00 in TBD
L19	14/Oct	[↗]		Efficient (many-time) signatures Trapdoor permutation and hash-then-invert paradigm Identification protocols and Fiat-Shamir Transform
CTF2	16/Oct		[↗]	CTF 2
Module III: Applications
L20	16/Oct	[↗]		Interactive proof (IP) IP for graph non-isomorphism (GNI)
L21	21/Oct	[↗]		Zero-knowledge (ZK) IP ZK IP for GI and GNI ZK Proof of Knowledge (ZKPoK)
A4	23/Oct		[↗]	Assignment 4
L22	23/Oct		[↗]	eVoting: setting and requirements How Helios Voting works Tools used: homomorphic PKE, distributed decryption, non-interactive ZKPoK
L23	28/Oct		[↗]	Background: certificates and PKI SSL/TLS Tools used: almost everything from Modules I and II
L24	30/Oct		[↗]	Secure messaging Signal protocol a/k/a the double ratchet Tools used: DHKE, key-derivation function (KDF), SKE (AEAD)
L25	04/Nov		[↗]	Bitcoin Zerocash Tools used: everything from Module II, ZKP and commitment
L26	06/Nov		[↗]	TBD
E	14/Nov		[↗]	End-sem: 09:00-12:00 in LA002

---

Listed below are the resources relevant to this course. The list of per-lecture resources (e.g., further reading) can be found at the end of the respective lecture slide.

Textbooks

• Introduction to Modern Cryptography, by Jonathan Katz and Yehuda Lindell, which we will mostly follow for the first two modules
• Foundations of Cryptography, Volume I by Oded Goldreich
• A Graduate Course in Applied Cryptography by Dan Boneh and Victor Shoup

Background Material
The following background will be useful to have. However, since this is a minor course, we will gently introduce most of it over the course of the course.

• Basic probability theory, which can be found in §A.3 of Katz-Lindell or the first recitation of MIT6875.
• Basic number theory, which can be found in §B of Katz-Lindell or the third recitation of MIT6875.
• Basic theory of computation and computational complexity, which can be found in the second recitation of MIT6875.

Related Courses

• Foundations of Cryptography (MIT6875) by Vinod Vaikuntanathan
• Cryptography (CS406) by Manoj Prabhakaran

Prior Iterations

• Autumn'25, by me
• Autumn'24, by Sruthi Sekar