Modern Cryptography
Not just ciphers — an entirely different discipline
This collection includes ciphers, people, historical and cultural context, mathematical foundations, hashes, signatures, and protocols. A cipher reversibly transforms plaintext into ciphertext with a key, but many exhibits explain other parts of cryptography. This page connects that broader history to modern practice.
Classical → Modern: Compare Historical Weaknesses with Modern Design
| Classical Cipher Type | Historical Limitation | Modern Solution | Modern Example |
|---|---|---|---|
| Caesar / Monoalphabetic | Frequency analysis — letter mapping preserved | Nonlinear substitution combined with diffusion and key mixing | AES SubBytes |
| Homophonic Substitution | One-to-many substitution can retain language and structural clues | Computational security under a defined attack model | AES in an appropriate authenticated mode |
| Polyalphabetic / Vigenère | Repeating key creates detectable periodicity | Pseudorandom keystreams with per-key nonce uniqueness and counter limits | ChaCha20, AES-GCM |
| Transposition (Rail Fence, Columnar) | Letter counts preserved; language and ordering clues can help analysis | Nonlinear substitution combined with diffusion and key mixing | AES ShiftRows + MixColumns |
| Playfair / Hill (block) | Small blocks leak digraph statistics; linear algebra solvable | 128-bit blocks, non-linear operations, round keys | AES (128-bit block) |
| Fractionation (Bifid, ADFGVX) | Coordinate mixing insufficient with static key square | Multiple rounds of mixing with key-derived round keys | AES 10–14 rounds |
| Layered classical systems | Substitution + transposition — each layer still attackable | Multiple designed rounds; security depends on the whole construction | AES, Camellia, SM4 |
| Machine ciphers (Enigma, Lorenz) | Physical key distribution; operator errors; structural flaws | Authenticated public-key methods help establish shared secrets | RSA, Diffie-Hellman, ECDH |
| One-Time Pad | Impractical key management — reuse is catastrophic | Computationally secure with short key; KDFs for key derivation | AES-256, X25519 key exchange |
Confusion & Diffusion
Making the relationship between key and ciphertext as complex as possible. Caesar has a simple key relationship: C = P + 3. One known pair reveals the entire key.
Modern solution: AES S-boxes are highly non-linear. The S-box has a precise public algebraic definition. Its nonlinearity works with the other round operations; an S-box alone does not make encryption secure.
Spreading each plaintext bit's influence across many ciphertext bits. Caesar does not spread changes across letter positions: change one letter, change exactly one ciphertext letter.
Modern solution: AES combines ShiftRows and MixColumns to spread byte dependencies. Across suitable inputs, changing one bit of a full AES input changes about half the output bits on average; this is not an exact per-message promise or a standalone security proof.
What Replaced Classical Cryptography
Taxonomy note: Symmetric and public-key encryption schemes both reversibly transform plaintext into ciphertext. RSA encryption and RSA signatures are distinct schemes with different encoding and padding requirements. Diffie–Hellman establishes shared secrets; signatures authenticate messages; hash functions produce digests. These primitives solve different problems and must be combined with appropriate protocols.
Looking for the exhibits? Explore these constructions — DES, Diffie-Hellman, RSA, AES, and SHA-256 — and further exhibits in Hall XI · Modern Cryptography. This page provides the wider context: the journey from classical failure to modern practice, and additional constructions such as ChaCha20, ECDH and post-quantum schemes.
128-bit blocks, 256-bit key, 14 rounds. 2²⁵⁶ possible keys; no practical key-recovery attack is known against correctly used full-round AES. Protocol, mode and implementation failures remain separate risks.
Designed by Daniel Bernstein. Original ChaCha uses a 64-bit nonce and 64-bit block counter. IETF ChaCha20 (RFC 8439) uses a 256-bit key, 96-bit nonce, and 32-bit block counter. Both XOR plaintext with a deterministic pseudorandom keystream: never reuse a nonce under the same key, and never let the block counter wrap. Original specification; RFC 8439 §§2.3, 4 and errata.
Sufficiently large, fault-tolerant quantum computers could break conventional RSA and Diffie–Hellman using Shor’s algorithm. NIST standardized the first three algorithms from its post-quantum project in 2024: ML-KEM (formerly CRYSTALS-Kyber, key encapsulation) and ML-DSA (formerly CRYSTALS-Dilithium, signatures), both based on structured lattice problems. NIST also standardized the hash-based SLH-DSA signature scheme in 2024. These are intended to resist known quantum attacks; they are not proofs against every future attack. The mathematics is on exhibit in the Hall of Foundations: lattices & the SVP, the closest-vector problem, Learning With Errors — an introduction to the mathematical setting of lattice-based standards — and polynomial rings.
ECDSA signatures verify under a public key rather than concealing content; attribution to a person requires a trusted key association: a private scalar on an elliptic curve, a public point, and a signature anyone can check. Suitable 256-bit elliptic-curve groups and 3072-bit RSA are commonly compared at roughly 128 bits of classical security, under their respective assumptions. Security requires an appropriate curve and implementation. Reused or biased nonces, side-channel leakage, faults and validation errors can compromise a signer. Shor’s algorithm also applies to the elliptic-curve discrete logarithm problem. The group law is in the Hall of Foundations.
Shamir’s Secret Sharing (1979) represents the secret in a finite field and samples the remaining polynomial coefficients independently and uniformly. With distinct nonzero share coordinates, k valid shares reconstruct the secret; fewer than k preserve its prior distribution. This information-theoretic property also holds against quantum computation, but does not protect stolen shares or faulty implementations. Threshold signing protocols can build on secret-sharing ideas but require additional protections; plain Shamir sharing does not authenticate shares or perform signatures.
Zero-knowledge proofs combine a soundness guarantee with a specified bound on what the verifier can learn beyond the statement. The guarantee depends on the protocol and security model; toy protocols can have a visible nonzero soundness error. The succinct variants — zk-SNARKs and STARKs — validate private transactions and compress whole blocks of computation into a proof small enough to check on a blockchain. The Fiat–Shamir transformation connects certain interactive identification protocols to noninteractive proofs or signatures under additional assumptions. A signature is not automatically a general-purpose zero-knowledge proof.
A valid tag can belong to an old message
Suppose A carries counter 1 and B carries counter 2. Each tag covers the counter and message under the same session key. An observer records both. Compare a receiver that remembers only the last token with one that accepts a valid tag only when its counter exceeds the highest accepted counter, initially 0.
Swipe or scroll the table horizontally to see every column. Keyboard: focus the table area and use the arrow keys.
| Delivery | Tag check | Last-token-only rule | Increasing-counter rule |
|---|---|---|---|
| A (1) | Valid | Accept | Accept; highest = 1 |
| B (2) | Valid | Accept | Accept; highest = 2 |
| A (1), replayed | Valid | Accept | Reject; highest = 2 |
| A changed to counter 3; old tag | Invalid | Reject | Reject; highest = 2 |
| Forget receiver state, keep key; replay A (1) | Valid | Accept | Accept; highest = 1 |
The A/B/A sequence defeats last-token-only checking. Resetting state under the unchanged key defeats the counter rule too. Rejected packets must not advance the accepted counter. This simplified rule rejects out-of-order messages; transports that allow reordering need a defined replay window and session lifecycle, including counter exhaustion. Replaying recorded ciphertext does not require encrypting a new message with a reused nonce: sender nonce uniqueness and receiver freshness are separate requirements.
Try the existing Crypto Lab: Regex Veil, in its Freshness section: open authenticated fragments twice, then reset the used-counter window. It is a local protocol teaching model, not a deployed transport.
Sources: Ross Anderson, Security Engineering: A Guide to Building Dependable Distributed Systems, third edition (2020), §4.3, printed pp. 122–124 (PDF pp. 169–171); David Wong, Real-World Cryptography (2021 edition), §3.3.3, PDF pp. 140–143 in the reflowed edition, which has no printed pagination. The table is a museum teaching example.
The museum's final lesson: Many historical systems failed through structural weaknesses, key reuse, or operational mistakes; others are obsolete or unresolved. A correctly used one-time pad retains perfect secrecy. Modern cryptography adds computational security and public-key methods, while still depending on sound key management, and extends into protocols, signatures, and proofs.
Resources
Free browser-based cryptography toolkit. Encrypt and decrypt with dozens of classical and modern ciphers. Visualize algorithms step by step.
Simon Singh’s The Code Book traces the history of cryptography from ancient Egypt to quantum computing. A popular historical introduction, first published in 1999.
Dan Boneh’s Coursera course covers modern cryptographic primitives: stream ciphers, block ciphers, MACs, public-key encryption, and key exchange.
Research case studies: what was actually attacked?
UA-8295: altered firmware and forensic evidence · SoDark: eight-round radio linking protection · NFC: authentication, configuration and counterfeit hardware
Compare GPU search, GPRS faults and conditional-linear DES. Each result identifies the target, attacker access and limits of the evidence.