Glossary

ACME

The protocol certificate authorities like Let's Encrypt use to issue certificates automatically. The server proves it controls a domain by publishing a file on the website or a record in DNS.

Covered in Certificates and PKI

AES

The Advanced Encryption Standard, the symmetric cipher that protects most data today. The same key encrypts and decrypts, and it's very fast. 256-bit keys are considered safe even against quantum computers.

Covered in Public-key cryptography, Post-quantum cryptography

Asymmetric cryptography

Another name for public-key cryptography, because the two keys in a pair do different jobs.

Bootstrapping (compilers)

Building a compiler using an earlier version of itself. Every compiler binary descends from older binaries, which is why a compiler can carry behaviour that appears nowhere in its source code.

Covered in Reflections on Trusting Trust

Certificate

A signed document saying that a public key belongs to certain domain names. Websites present one to prove their identity. Web certificates follow a format called X.509.

Covered in Certificates and PKI

Certificate authority (CA)

An organisation trusted to check who controls a domain and sign certificates for it. Browsers trust a CA if its root certificate is in their trust store.

Covered in Certificates and PKI

Certificate Transparency

Public, append-only logs that record every publicly trusted certificate. Browsers reject certificates that haven't been logged, so a CA can't secretly issue a certificate for someone else's domain.

Covered in Certificates and PKI

Chain key

The secret at the current position of a hash chain. Each step derives a message key and the next chain key from it, then deletes it.

Covered in The Double Ratchet

Chain of trust

The path from a website's own certificate, through one or more intermediate certificates, to a root certificate the browser already trusts. Every signature along the way must check out.

Covered in Certificates and PKI

Commitment

The digital version of a sealed envelope: you publish something that fixes a value without revealing it, then open it later. It's hiding (nobody can see the value early) and binding (you can't change it).

Covered in Zero-knowledge proofs

Completeness

The property that an honest prover with a true statement always convinces an honest verifier.

Covered in Zero-knowledge proofs

Diffie–Hellman key exchange

A way for two parties to agree on a shared secret while everything they send is public. Each mixes in a private number; an eavesdropper would need to solve the discrete logarithm problem to catch up.

Covered in Diffie–Hellman key exchange

Digital signature

A value made with a private key that proves who signed something and that it hasn't changed since. Anyone can check it with the matching public key.

Covered in Public-key cryptography, Certificates and PKI

Discrete logarithm problem

Given g, p and g^x mod p, find x. Easy to compute forwards, believed infeasible backwards for large numbers on ordinary computers. Diffie–Hellman depends on it; the elliptic-curve version underpins ECDHE.

Covered in Diffie–Hellman key exchange, ECDHE

Diverse double-compiling (DDC)

David Wheeler's method for checking that a compiler binary matches its source code: rebuild it via an independent compiler and compare the results byte for byte.

Covered in Reflections on Trusting Trust

Double Ratchet

The algorithm Signal and WhatsApp use to change keys with every message. It combines hash chains with fresh Diffie–Hellman keys to give both forward secrecy and post-compromise security.

Covered in The Double Ratchet

ECDHE

Elliptic-curve Diffie–Hellman with ephemeral keys: the key exchange behind almost every HTTPS connection. A fresh key pair is made for each connection and deleted afterwards.

Covered in ECDHE

Elliptic curve

The set of points satisfying y² = x³ + ax + b. Points can be “added” to each other, and multiplying a point by a number is easy to do but hard to undo, which gives small, fast keys.

Covered in ECDHE

Ephemeral key

A key pair created for a single session or message and then deleted, so it can't be stolen later.

Covered in ECDHE

Fiat–Shamir transform

Turning an interactive proof into a non-interactive one by computing the verifier's random challenge with a hash function. Bind a message into the hash and the result is a digital signature.

Covered in Zero-knowledge proofs

Forward secrecy

The guarantee that stealing today's keys doesn't expose past conversations, because the keys that protected them have already been deleted.

Covered in ECDHE, The Double Ratchet

Garbled circuit

Andrew Yao's technique for computing any function on two people's private inputs. Every logic gate's truth table is encrypted, so the circuit can be evaluated without revealing any value flowing through it.

Covered in The millionaires' problem

Grover's algorithm

A quantum algorithm that speeds up brute-force search by a square root. It weakens symmetric ciphers and hashes, which is fixed by doubling key sizes.

Covered in Post-quantum cryptography

Harvest now, decrypt later

Recording encrypted traffic today in the hope of decrypting it once a large quantum computer exists. It's why long-lived secrets need quantum-resistant protection before such computers arrive.

Covered in Post-quantum cryptography

Hash function

A function that turns any input into a short, fixed-size fingerprint. A cryptographic hash is one-way, and it's infeasible to find two inputs with the same output. SHA-256 is the most common.

Used in Certificates and PKI, The Double Ratchet

HMAC

A keyed hash. Only someone with the key can compute it, so it proves a message came from a key holder and wasn't changed. The Double Ratchet uses it to turn its message chains.

Covered in The Double Ratchet

Hybrid encryption

Encrypting data with a fast symmetric key, then protecting that key with public-key cryptography. Almost all real systems work this way.

Covered in Public-key cryptography

Intermediate certificate

A CA certificate signed by a root, used for everyday signing so the root's private key can stay offline.

Covered in Certificates and PKI

Key derivation function (KDF)

A function that turns secret input, such as a Diffie–Hellman result, into one or more strong keys. HKDF is a common one.

Covered in The Double Ratchet

Key encapsulation mechanism (KEM)

A way to share a secret using someone's public key: you generate a random secret and “encapsulate” it so only they can open it. ML-KEM is the post-quantum standard.

Covered in Post-quantum cryptography

Lattice-based cryptography

Cryptography built on problems involving huge grids of points in many dimensions. It's the basis of ML-KEM and ML-DSA, and is believed to resist quantum computers.

Covered in Post-quantum cryptography

Leaf certificate

A website's own certificate, at the end of the chain of trust.

Covered in Certificates and PKI

Learning with errors (LWE)

The problem of recovering a secret from a set of equations that are each slightly wrong. Without the small errors it's school algebra; with them, nobody knows how to solve it efficiently.

Covered in Post-quantum cryptography

Man-in-the-middle attack

An attacker secretly sits between two parties, relaying their messages while reading or changing them. Each side thinks it's talking directly to the other. Certificates and key verification exist to stop it.

Covered in Certificates and PKI, Public-key cryptography

Message key

A key used to encrypt exactly one message, derived from a chain key and deleted once used.

Covered in The Double Ratchet

ML-KEM, ML-DSA and SLH-DSA

The three post-quantum standards NIST published in 2024: ML-KEM for sharing keys, ML-DSA for signatures, both lattice-based, and SLH-DSA, a signature scheme built only from hash functions.

Covered in Post-quantum cryptography

Modular arithmetic

“Clock” arithmetic, where numbers wrap around after reaching a fixed value, the modulus. Much of public-key cryptography is built on it.

Covered in Diffie–Hellman key exchange

Mosca's inequality

A rule of thumb for quantum risk: if the years your data must stay secret plus the years migration will take exceed the years until a quantum computer exists, you're already late.

Covered in Post-quantum cryptography

Multi-party computation (MPC)

Techniques that let a group compute a result from their private inputs while learning nothing except the result. Also called secure multi-party computation.

Covered in The millionaires' problem

Nonce

A “number used once”. Many protocols need a fresh random value each time; reusing one can expose a private key, as happened to Sony's PlayStation 3 signing key in 2010.

Covered in Zero-knowledge proofs

Oblivious transfer

A protocol where a receiver gets exactly one of the sender's messages, of their choice. The sender doesn't learn which one, and the receiver learns nothing about the rest.

Covered in The millionaires' problem

Post-compromise security

The guarantee that after an attacker copies your keys once, future messages become safe again on their own. Also called self-healing.

Covered in The Double Ratchet

Post-quantum cryptography

Public-key algorithms designed to stay secure against large quantum computers, which would break RSA and elliptic curves.

Covered in Post-quantum cryptography

Prekey

A public key uploaded to a messaging server in advance, so someone can start an encrypted conversation with you while you're offline.

Covered in The Double Ratchet

Private key

The half of a key pair that only its owner holds. It decrypts messages sent to the owner and creates their signatures.

Covered in Public-key cryptography

Public key

The half of a key pair that can be shared with anyone. Others use it to encrypt messages to its owner and to check the owner's signatures.

Covered in Public-key cryptography

Public-key cryptography

Cryptography where each person has a pair of linked keys, one public and one private. It lets strangers communicate securely without sharing a secret first.

Covered in Public-key cryptography

Quine

A program whose output is exactly its own source code. The same self-reference trick lets a compiler trojan copy itself into new compilers.

Covered in Reflections on Trusting Trust

Ratchet

In cryptography, a process that only moves forwards: each new key is derived one-way from the last, so old keys can't be recovered from new ones.

Covered in The Double Ratchet

Reproducible builds

Builds where the same source code always produces byte-for-byte identical software, so anyone can rebuild it and check that published software matches its source.

Covered in Reflections on Trusting Trust

Revocation

Cancelling a certificate before it expires, usually because its private key was stolen. Browsers learn about revoked certificates from lists published by CAs or pushed by browser makers.

Covered in Certificates and PKI

Root certificate

A self-signed CA certificate that ships with your operating system or browser in its trust store. Every trusted chain must end at one.

Covered in Certificates and PKI

RSA

The first practical public-key algorithm, published in 1977. Its security rests on how hard it is to factor the product of two large primes.

Covered in Public-key cryptography

SBOM

A software bill of materials: a list of every component inside a piece of software, so you know what you're trusting.

Covered in Reflections on Trusting Trust

Schnorr protocol

A short zero-knowledge proof that you know the private key behind a public key, without revealing it. With the Fiat–Shamir transform it becomes the Schnorr signature.

Covered in Zero-knowledge proofs

Secret sharing

Splitting a secret into shares that are individually meaningless, so it can only be rebuilt, or computed with, when enough shares come together.

Covered in The millionaires' problem

Shor's algorithm

A quantum algorithm that factors large numbers and solves discrete logarithms efficiently. A large enough quantum computer running it would break RSA, Diffie–Hellman and elliptic-curve cryptography.

Covered in Post-quantum cryptography

Simulator

In the definition of zero knowledge, a procedure that produces fake conversations, without knowing the secret, that can't be told apart from real ones. If one exists, the real conversation can't have leaked the secret.

Covered in Zero-knowledge proofs

SLSA

Supply-chain Levels for Software Artifacts, pronounced “salsa”: a framework of levels for build integrity, including signed records of how each piece of software was built.

Covered in Reflections on Trusting Trust

Soundness

The property that a cheating prover gets caught, except with a tiny, controllable probability.

Covered in Zero-knowledge proofs

Subject Alternative Name

The certificate field listing the domain names the certificate is valid for. Browsers check the address you visited against it.

Covered in Certificates and PKI

Supply-chain attack

Compromising the tools, build systems or components that produce software, rather than the software's own code. SolarWinds and xz-utils are well-known examples.

Covered in Reflections on Trusting Trust

Symmetric encryption

Encryption where the same key locks and unlocks. Fast and strong, but both sides need the key before they start.

Covered in Public-key cryptography

TLS

Transport Layer Security, the protocol that puts the S in HTTPS. It uses a key exchange such as ECDHE, a certificate to prove the server's identity, and symmetric encryption for the data.

Covered in ECDHE, Diffie–Hellman key exchange

Trust store

The list of root certificates your device or browser trusts. Whoever can add a root to it can make trusted certificates for any website.

Covered in Certificates and PKI

Trusted setup

A one-off ceremony that generates the public parameters for some zk-SNARKs. If anyone kept the secret randomness used, they could forge proofs, so it must be destroyed.

Covered in Zero-knowledge proofs

X25519

A widely used elliptic-curve Diffie–Hellman function, built on Curve25519. Most browsers prefer it for TLS key exchange.

Covered in ECDHE

X3DH and PQXDH

Signal's protocols for starting a conversation: several Diffie–Hellman calculations using the recipient's prekeys, giving the first shared secret for the Double Ratchet. PQXDH adds post-quantum protection.

Covered in The Double Ratchet

Zero-knowledge proof

A way to convince someone a statement is true while revealing nothing else, such as proving you know a password without revealing it.

Covered in Zero-knowledge proofs

zk-SNARK

A zero-knowledge succinct non-interactive argument of knowledge: a tiny proof, checkable in milliseconds, that a statement about a large computation is true.

Covered in Zero-knowledge proofs