An eighteen-month plan from the arithmetic under RSA to the lattice mathematics under ML-KEM, written for a working cryptographic engineer about to spend their days on the post-quantum transition. Classical cryptography first and properly, then enough quantum mechanics to see exactly what Shor's algorithm breaks and what it costs, then the post-quantum families to the level of implementing the standards from their FIPS documents alone and defending their parameters.
The checklist and the gate log are mine. Signed out, the page is read-only.Blocks are scored on gates, not hours. A gate is an implementation that passes the published test vectors, a proof that survives a check against the book, or a written assessment someone else has read, and the block is done when the gate passes.
Each block lists practice that scores you as well as reading: challenge sites, test vectors, problem sets with answers. Those cannot report back here, so I write their results in the gate log: a set completed, a vector suite passed, a parameter estimate reproduced.
Eight ideas carry the whole subject; everything after is one of them applied. Each stage returns to all eight at more depth, and the second column is what owning one looks like.
| Idea | You own it when |
|---|---|
Security is a reduction A scheme is secure relative to a hardness assumption, and the proof is an algorithm: anyone who breaks the scheme is turned into someone who breaks the assumption. There is no other kind of security argument. | You write the reduction for a given scheme yourself, with the simulator and the loss stated, and can say what breaks if a hypothesis is dropped. |
Structure is what a quantum computer eats Shor's algorithm finds hidden periods, and factoring, discrete logarithms and elliptic curves all reduce to period finding. Problems without that structure, lattices and hashes among them, only lose the square root that Grover takes. | Shown a new hardness assumption, you say whether a quantum computer gets a polynomial or a square-root advantage against it, and why. |
Amplitudes interfere A quantum computer is not trying every answer at once. Amplitudes can be negative, and an algorithm is a way of arranging for the wrong answers to cancel and the right one to add up. | You explain Grover's rotation picture from memory, say why iterating past the optimum makes it worse, and why this gives a square root and no more. |
Information-theoretic versus computational The one-time pad and quantum key distribution are secure against any computer, at the cost of a channel that must already be authenticated. Everything post-quantum is computational, secure only for as long as its assumption holds. | You can say which half of a deployed system is which, and what the authentication in a quantum key distribution link is actually protected by. |
Measurement disturbs, states cannot be copied Measuring a quantum state in the wrong basis changes it, and no process copies an unknown state. Between them these are the whole of why an eavesdropper on a quantum channel leaves marks. | Given a protocol on a quantum channel, you name the measurement an attacker is forced to make and compute the error rate it leaves behind. |
Errors hide secrets A system of linear equations is easy; the same system with a little noise added to each equation is the learning with errors problem, and nobody knows how to solve it, quantum computer or not. Every lattice standard is this idea in a polynomial ring. | You write out ML-KEM's key generation, encapsulation and decapsulation as operations on module elements, and derive the decryption failure bound from the noise sizes. |
Parameters are a cryptanalysis budget A parameter set is chosen by costing the best known attack and leaving a margin. For lattices that is the block size at which lattice reduction finds the short vector, and the margin is the argument that has to be defended. | You run the lattice estimator on a scheme's parameters and reproduce the security level its designers claim, then say which attack sets it and what a better one would cost. |
The job is migration Traffic recorded today is decrypted when the machine arrives, so key exchange had to move first and signatures follow. Most of the work is finding where cryptography is, not choosing what replaces it. | Handed a system, you produce an inventory of its cryptography, rank what is exposed to harvest-now-decrypt-later, and put each item on the published transition timeline. |
The documents the transition is measured against, and where each stood in September 2026. Check the dates before quoting any of them: this table is a snapshot, and the additional-signature process in particular moves every few months.
| Document | What it covers | Where it stands |
|---|---|---|
| FIPS 203, ML-KEM | The lattice key encapsulation mechanism, from Kyber | Final, August 2024 |
| FIPS 204, ML-DSA | The lattice signature, from Dilithium | Final, August 2024 |
| FIPS 205, SLH-DSA | The stateless hash-based signature, from SPHINCS+ | Final, August 2024 |
| FIPS 206, FN-DSA | The compact lattice signature, from Falcon | Draft; final expected late 2026 or 2027 |
| SP 800-208 | The stateful hash-based signatures, LMS and XMSS | Final, October 2020 |
| HQC | A code-based key encapsulation mechanism, the backup to ML-KEM | Selected March 2025; draft standard pending |
| Additional signatures | The second signature competition, nine candidates in round three | Round three since May 2026; standards not before 2028 |
| NIST IR 8547 | The transition timeline: RSA and elliptic curves deprecated 2030, disallowed 2035 | Initial public draft, November 2024 |
| CNSA 2.0 | The national security systems suite and its dates, from software signing in 2025 to everything by 2035 | In force; dates are per system class |
| X25519MLKEM768 | The hybrid key exchange browsers and servers actually deploy in TLS 1.3 | IETF draft, widely deployed |
| Study | Six hours a week from the block's reading, in sittings of at least an hour, with the exercises done as they come rather than saved for later. |
|---|---|
| Code | Four hours a week in Python, with Sage for anything algebraic. Every scheme in the week's reading is run against real test vectors the same week. |
| Derive | Twenty minutes a day rederiving one result from memory on paper: a reduction, a decryption correctness bound, the cost of a lattice attack. Timed, checked against the book, kept. |
| Read the field | One paper abstract a day from the IACR ePrint listing, and the week's posts on the NIST post-quantum forum. Ten minutes; the point is to recognise names and problems, not to follow every thread. |
| Review | Sunday evening: read the week's log, score the derivations, write the next week's three priorities. |
Weeks 1 to 20
Post-quantum cryptography is classical cryptography with different hardness assumptions. The reductions, the security games, the implementation discipline and the protocol mistakes are all the same, so this stage builds them from the ground up even for someone who has shipped cryptographic code. What was learned on the job is checked against the book here.
You can write a reduction proof for a symmetric or public-key scheme without the book open, you have implemented RSA, Diffie-Hellman and ECDSA from the definitions and broken each one through a known misuse, and you have modelled a protocol in a prover and watched it find an attack.
Weeks 1 to 4
Everything later is arithmetic in a finite structure: integers modulo a prime, polynomials modulo another polynomial, vectors over both. This block makes that arithmetic automatic, so the cryptography can be about the cryptography.
Practice
Modular arithmetic, lattices and elliptic curve challenges with a scoreboard. Log the challenges finished per week.
Gate
The six routines from the last task pass a hundred random test vectors each, checked against Sage, written and passing in a single sitting of under two hours.
Reading
Shoup. Free from the author. The one mathematics book for the whole plan; the chapters named in the tasks are the ones to do.
Install it now. Every algebraic object in the plan can be checked against it.
Weeks 5 to 10
Pseudorandom functions, block ciphers, message authentication and hashing are where security games and reductions are first learned, on objects small enough to hold in the head. The proofs here are the template for every proof later, lattice ones included.
Practice
Boneh's course. The problem sets are graded; log the score on each.
The challenge sets. Log the set and challenge number finished each week; the gate wants sets one to four.
Gate
Cryptopals sets one to four complete, and a written reduction proof that a cipher-block-chaining MAC on fixed-length messages is a secure MAC if the block cipher is a pseudorandom function, checked line by line against Katz and Lindell.
Reading
Katz and Lindell, third edition. The textbook for the classical stage; its proofs are the ones to imitate.
Boneh and Shoup. Free. Deeper than Katz and Lindell and closer to how papers are written now.
Aumasson, second edition. The practitioner's view of the same material, including what actually breaks in deployed systems.
Weeks 11 to 16
RSA, Diffie-Hellman and elliptic curves are exactly what a quantum computer removes, so this block learns them well enough to know what is being lost: the group structure, the assumptions, the constructions built on them, and the ways they fail when misused.
Practice
Sets five to eight. Log the challenge number and the date each one fell.
Invalid curves, small subgroups and padding attacks with a scoreboard. Log the challenges finished.
Gate
Cryptopals sets five to eight complete, and your own ECDSA over P-256 that passes the NIST vectors and recovers a private key from two signatures that reused a nonce, in under one hour from a cold start.
Reading
Katz and Lindell, chapters 9 to 13.
Galbraith. Free from the author. The algebra behind discrete logarithms and elliptic curves in full, and later the lattice chapters.
NIST's test vectors for every approved algorithm. An implementation that has not passed these is a sketch.
Weeks 17 to 20
Cryptography is deployed inside protocols, and most real failures are in the protocol or the implementation rather than the primitive. This block reads TLS 1.3 as a specification, learns constant-time discipline, and picks up the prover that finds protocol attacks mechanically.
Practice
The tool itself, with example models. Log which models you built and whether the prover terminated on each.
Gate
A Tamarin model of a two-message key exchange that finds the man-in-the-middle attack when authentication is removed and proves secrecy when it is restored, written and run in one weekend, with a page explaining what the prover checked.
Reading
Read as a specification: what is derived from what, and why each message is where it is.
The handshake patterns underneath WireGuard and Signal, small enough to read in an afternoon.
Wong. The engineering chapters, and the last chapter is a first look at post-quantum schemes.
The clearest short account of what constant-time means and how to get it in C.
The tutorial chapters, then the case studies. The prover returns in the last block for a post-quantum handshake.
Weeks 21 to 36
Enough quantum computing to derive Shor's algorithm and cost it, not to build a machine. Then quantum cryptography proper, quantum key distribution and its no-go theorems, because it is the other answer to the same threat and someone in a cryptography department will be asked to assess it.
You have a state-vector simulator of your own, Shor's algorithm running in it, a defended estimate of what a cryptographically relevant machine costs, and a two-page position on quantum key distribution against post-quantum cryptography that you would sign.
Weeks 21 to 26
Qubits, unitaries, measurement, entanglement and the quantum Fourier transform, learned by building a simulator so that every claim about a circuit can be checked against numbers.
Practice
A drag-and-drop circuit simulator that shows amplitudes live. Your simulator is scored against it; log the circuits matched.
The Qiskit courses with graded exercises. Log the modules finished.
Gate
A ten-qubit state-vector simulator whose amplitudes agree with Quirk to six decimal places on ten circuits including the quantum Fourier transform, and the four-qubit transform circuit derived on paper in under thirty minutes.
Reading
Nielsen and Chuang. The standard text; chapters 1, 2, 4, 5 and later 12 are the ones the plan uses.
Matuschak and Nielsen. Free. Quantum computing taught with spaced repetition built into the text.
Watrous. Free. A mathematician's version of the same material, terse and exact.
Weeks 27 to 32
The threat, derived rather than quoted: period finding, the reduction from factoring and discrete logarithms to it, Grover's square root, and the resource estimates that turn an algorithm into a date. This is the block that lets you answer the question everyone asks.
Practice
The Shor and Grover modules have exercises with answers; log the ones finished and the scores.
Gate
Shor's algorithm factoring 15 and 21 end to end in your own simulator, and a one-page estimate of the logical and physical qubits and the runtime for RSA-2048 with every assumption stated, defended against the numbers in the 2025 paper.
Reading
Shor. The original, still the clearest statement of the reduction.
Gidney and Ekerå, 2019. The estimate every policy document quoted for five years.
Gidney, 2025. The twenty-fold reduction; read it for what changed and what did not.
Roetteler, Naehrig, Svore and Lauter. Why elliptic curves fall first.
Weeks 33 to 36
Quantum key distribution is the other answer to the quantum threat, and it is sold hard. This block learns it well enough to derive a key rate, run the attacks on real implementations, and hold a position on where it belongs, which for most networks is nowhere near the core.
Practice
The key distribution module runs BB84 on real hardware, with the error rate that implies. Log the rate you measured.
Gate
A BB84 simulation with the photon-number-splitting attack and decoy states whose secret key rate matches the GLLP formula within five percent at three distances, and the two-page position memo read and marked up by one colleague.
Reading
Pirandola and others, 2020. The review of the whole field; the sections on discrete-variable protocols and practical security are the ones to read closely.
Shor and Preskill. Six pages. Read it three times.
Lo, Ma and Chen. Why real systems with laser pulses can be secure at all.
Gottesman, Lo, Lütkenhaus and Preskill. The key rate formula the gate asks for.
Broadbent and Schaffner. The no-go results and everything that is not key distribution.
The position a national security customer will hold. Read it before writing the memo.
The UK view, which reaches the same conclusion by a different route.
Where the interface and security standards for the equipment are written.
Weeks 37 to 78
The standards, the mathematics under them, the attacks that set their parameters, the other families kept as backups, and then the engineering of actually moving systems over. The second half of this stage is the job description; the first half is what makes the second half more than reading vendor sheets.
You have implemented ML-KEM and SLH-DSA from their FIPS documents and passed the validation vectors, you have reproduced the security estimates of the standard parameter sets with the lattice estimator, you have reproduced one published break, and you have written and defended a migration assessment for a real system and given a talk on it.
Weeks 37 to 46
ML-KEM, ML-DSA and FN-DSA are all one idea, learning with errors in a polynomial ring, with different constructions on top. This block learns the idea from the worst-case hardness results down to the byte encodings in the FIPS documents.
Practice
NIST's known-answer vectors for ML-KEM, ML-DSA and SLH-DSA, under the generated JSON files. Log which parameter sets pass.
Learning with errors and reduction challenges with a scoreboard. Log the challenges finished.
Gate
An ML-KEM-768 implementation written from FIPS 203 alone that passes every known-answer vector in the NIST validation set, and the chosen-plaintext security reduction written out and checked by someone who has read the Kyber paper.
Reading
Peikert. Free. The survey of the field up to the standards; chapters 4 and 5 are the ones to work.
Regev. Free. Twenty pages from the person who defined the problem.
Lyubashevsky. Free. The designer's own explanation, at exactly the level the implementations need.
The specification the gate is implemented from.
The design papers and the reference code, to be opened only after your own implementation passes.
Weeks 47 to 52
A parameter set is a bet on the best attack. This block learns lattice reduction well enough to run it, the estimator well enough to reproduce the security claims in the standards, and the hybrid and side-channel attacks that the estimator does not cover.
Practice
Albrecht's Sage tool. Log the parameter sets estimated and the bits the estimate gives for each.
Gate
Your own LLL that recovers the secret of a forty-dimensional low-density knapsack, and an estimator run for every ML-KEM parameter set that reproduces the classical core-SVP security levels in FIPS 203 within two bits, with the setting attack named for each.
Reading
Nguyen and Vallée. The reference on lattice reduction; the first three chapters are what the block needs.
Micciancio and Regev. Free. The chapter from the 2009 book, still the best short account of the attacks.
Albrecht and others. How the competition's candidates were costed against each other.
The timing attack from a compiler-emitted division. The clearest example of why constant time is not a property of source code.
Weeks 53 to 60
The backups, kept because lattices might fall. Hash-based signatures rest on the least assumption there is and are already required for firmware signing; code-based encryption is the oldest post-quantum scheme and now a standard; multivariate and isogeny schemes are where the most instructive breaks happened.
Practice
The SLH-DSA vectors for the gate. Log the parameter sets that pass.
The round three candidates and their submissions. Log one candidate read in full per fortnight and a paragraph on its assumption.
Gate
SLH-DSA-SHAKE-128s written from FIPS 205 alone and passing every known-answer vector, and the four-family comparison for firmware signing as a one-page table with sizes and speeds measured from your own or reference code.
Reading
The specification the gate is implemented from.
LMS and XMSS as national security systems already use them.
The design papers behind SLH-DSA; open after your own implementation passes.
The conservative code-based system and the arguments for it.
The code-based scheme NIST chose in 2025 as a second key encapsulation mechanism.
Beullens. A finalist removed by one paper; the block reproduces it.
Castryck and Decru. The other finalist removed by one paper.
The multivariate candidate still standing in the additional signature process.
The isogeny signature that survived, and why.
Bernstein, Buchmann and Dahmen. Dated but still the one book that introduces every family in one place.
Weeks 61 to 68
The job. Hybrid key exchange in real protocols, certificates and signatures, hardware modules and validation, inventory and prioritisation, and the government timelines the work is measured against. The gate is a migration assessment someone else has to read.
Practice
The demos and interoperability tests. Log which protocols you stood up and which key exchange each negotiated.
Gate
A hybrid TLS 1.3 handshake captured and decoded field by field with the key share sizes annotated, and a migration assessment for one real system with an inventory, a risk ranking and a timeline, read and marked up by two people who work on that system.
Reading
The draft behind the key exchange most of the internet now negotiates.
liboqs and the OpenSSL provider, for standing up post-quantum TLS and SSH on a laptop.
Clean, portable, tested implementations of the standards, and the place to contribute in the last block.
The LAMPS working group's answer to certificates during the transition.
The federal timeline: deprecation in 2030, disallowed in 2035.
The NSA's suite and dates for national security systems.
The civilian agency guidance and the inventory templates.
The migration roadmap and the working groups doing the practical sequencing.
Weeks 69 to 78, then ongoing
Expert means the field comes to you: you read the new results as they appear, you can reproduce them, you contribute code the field uses, and you can stand in front of the department and explain a break the week it happens.
Practice
Contributions are the score. Log each pull request opened and its state.
Gate
One reproduced paper with a public repository and write-up, one merged pull request to a post-quantum library, and one talk given to the department, all three inside the same six months.
Reading
Where results appear first. The daily listing is the reading habit.
The mailing list where the standards are argued about in public.
The conference closest to deployment; the talks are recorded.
The conference series for the field itself.
The Rust-to-proof toolchain used for the verified ML-KEM in libcrux.
The proof assistant behind the Formosa verified implementations.
Every book the blocks read from, in one place, with what it is for. Free ones are marked, and there is one at every stage. The paid ones are worth a used copy of the edition named.
| Book | Stage | Why this one |
|---|---|---|
| A Computational Introduction to Number Theory and Algebra Victor Shoup, second edition Free | Classical | All the algebra the plan needs, proved, with exercises, from the author of half the reductions in the field. |
| Introduction to Modern Cryptography Jonathan Katz and Yehuda Lindell, third edition | Classical | The standard textbook. Its definitions and proofs are the template for reading everything after it. |
| A Graduate Course in Applied Cryptography Dan Boneh and Victor Shoup Free | Classical | Deeper than Katz and Lindell and written in the game-hopping style current papers use. The free one for the stage. |
| Serious Cryptography Jean-Philippe Aumasson, second edition | Classical | What breaks in practice, from someone who breaks it. Short enough to read alongside the textbook. |
| Real-World Cryptography David Wong | Classical | How the primitives are assembled into systems, with a first chapter on post-quantum schemes at the end. |
| Mathematics of Public Key Cryptography Steven Galbraith Free | Classical | Discrete logarithms, elliptic curves and lattices at full mathematical depth, free from the author. |
| Quantum Computation and Quantum Information Michael Nielsen and Isaac Chuang, tenth anniversary edition | Quantum | The standard text, and its chapter 12 is the only textbook treatment of quantum cryptography most people will need. |
| Quantum Country Andy Matuschak and Michael Nielsen Free | Quantum | The notation made automatic by spaced repetition. Read it before Nielsen and Chuang, not instead. |
| Introduction to Quantum Computing, lecture notes John Watrous Free | Quantum | The same material as a mathematician writes it, for when the textbook is being too gentle. |
| Advances in quantum cryptography Stefano Pirandola and others Free | Quantum | A review paper rather than a book, but it is the book on quantum key distribution as deployed, and it is free. |
| A Decade of Lattice Cryptography Chris Peikert Free | Post-quantum | The survey that the lattice standards grew out of, from one of the people who grew them. |
| Basic Lattice Cryptography: the concepts behind Kyber (ML-KEM) and Dilithium (ML-DSA) Vadim Lyubashevsky Free | Post-quantum | The designer explaining the designs at exactly the level an implementer needs. |
| The LLL Algorithm: Survey and Applications Phong Nguyen and Brigitte Vallée, editors | Post-quantum | Lattice reduction from the people who understand it best. The first three chapters are the cryptanalysis block. |
| Post-Quantum Cryptography Daniel Bernstein, Johannes Buchmann and Erik Dahmen, editors | Post-quantum | From 2009, so the parameters are stale, but still the one book that introduces every family side by side. |
| FIPS 203, 204 and 205 National Institute of Standards and Technology Free | Post-quantum | The standards themselves. Two of the gates are implemented from these with everything else closed. |