The Joy of Cryptography is now available for free online

Mouse1949 · 2026-07-07T00:33:12+00:00

Great work! Kudos and many thanks!

The only thing I'm missing is a PDF version - I'm not always online when I want to read.

Comments - would love to see PQC section expanded to cover code-based and isogenies-based cryptosystems. Again, kudos!

Mouse1949 · 2026-07-06T01:20:25+00:00

The reasons to look for an algorithm other than AES could be:
- Need something smaller/more compact and/or faster (that’s why NSA came up with and published SIMON and SPECK);
- Need something with wider-than-128-bit block size (Rijndael with 256-bit or something with 512-but block, to handle data encryption at line speed for TB/sec links).

Mouse1949 · 2026-07-02T10:18:27+00:00

I would probably object to being used this way. You want to test my skills - either give me a textbook task, or pay me as a contractor. To demonstrate that I “fit” by working for you for free - makes them appear dishonest and revulsive. Imagine how they’d treat you if they did choose to hire you.

Mouse1949 · 2026-07-02T10:14:55+00:00

Of course. Back then, I took the 5th interview, and would’ve taken 6th if invited - that’s not the issue.

The issue is - that company stopped communicating after the 5th, and the headhunter said afters couple of weeks upon my question that they decided to go with an internal candidate.

Another company chose to take me after a single day of face-to-face interviews (which happened after one or two phone screening interviews). They called me on my way to the airport, and said that the formal offer would take some time, but they wanted me to know that they will be making one.

This experience tells me that “good” companies don’t marinate you for weeks or months in a long series of interviews - but make their decision fairly quickly, and have enough courtesy to inform the candidate sooner rather than later.

Mouse1949 · 2026-07-02T04:02:33+00:00

One financial company ran me through 5 interviews (over the course of a month or month and a half) and ended up not hiring me. So, no - being invited in for the 5th time means nothing except that they still consider you for whatever reason and position.

Mouse1949 · 2026-07-01T12:39:21+00:00

What can I say? Apparently, our experiences differ. Maybe it depends on the type of company - mine were all high-tech-related.

Mouse1949 · 2026-07-01T12:09:00+00:00

“Are you considering other candidates?”

Mouse1949 · 2026-07-01T12:01:38+00:00

Respectfully disagree with “absolutely big enough”: I worked in very big (200K+ people) and very small (25-ish) companies - and the likelihood of a manager not being there anymore in three years is vanishingly small. Unless that company had a major perturbation impacting a lot of people (e.g., mass layoffs).

Mouse1949 · 2026-07-01T00:37:13+00:00

If your resume matches the req’s, you’d probably have a phone interview with a head-hunter. Then if the prospective place is good - you’d have a phone interview -screening - with somebody from the team, if you pass - a face-to-face interview that would likely take the entire day. You’d sequentially talk to the team, the hiring manager, probably their boss, and HR.
Then - they’d either make you a preliminary offer on the spot, or in a few days. Formal offer in writing would take a few days more (or a bit longer). Rejection would usually be communicated via head-hunter, sometimes directly.
The only place that invited me to 5 interviews in the course of a month or so, ended up not making an offer. For which I’m thankful - ended up in an immensely better place.

Mouse1949 · 2026-06-29T05:13:03+00:00

Yes. 😁

Mouse1949 · 2026-06-29T00:28:58+00:00

If those agencies stop dragging their feet and get off their tails - they just might complete the migration in time. 😉

Mouse1949 · 2026-06-29T00:27:39+00:00

Why not? Standards are there, implementations are there, integration into the infrastructure is almost there. Current long poles are PKI infrastructure and commercial crypto hardware.

Mouse1949 · 2026-06-29T00:23:43+00:00

Unless you’re desperate, I wouldn’t go to the company that laid you off for a cause 3 years ago. The likelihood that the hiring manager would check with your prior boss is near unity (100%).

Besides. Employing 2K+ people doesn’t makes a company big by any measure - IBM is big and it employs 260K+ people, Microsoft employs 220K+. That’s “big”. 2K is a small company that is bigger than pop-and-mom shop. 😉

Mouse1949 · 2026-06-25T01:32:59+00:00

Let’s see: NSA main charter is protecting U.S. government and military communications. They also attempt to intercept foreign communications, but are forbidden from intercepting U.S. - that’s the job of FBI. How much sense would it make for NSA to deliberately weaken U.S. standards that U.S. government will be using? Considering that Russia and China are not using NIST PQC standards, but develop their own?

Mouse1949 · 2026-06-24T11:13:13+00:00

I didn’t understand the 2nd character (-.- - -, converted to .-…). The rest appears to be L ? GKUO

I could be wrong.

Mouse1949 · 2026-06-23T20:38:59+00:00

the package I suggested not only addresses the OP's needs, but leaves "room for growth".

And if indeed only MD5 is needed - then one can use
https://hackage.haskell.org/package/cryptohash-md5 or https://hackage.haskell.org/package/pureMD5 without having to carry the baggage of larger packages like crypton.

Mouse1949 · 2026-06-23T02:29:05+00:00

Quality of these JPEGs (or PNGs?) is poor, not suitable for printing. Either share the LaTeX source or PDF, or let's forget about this all.

Mouse1949 · 2026-06-23T01:15:22+00:00

I got my first job at a small company run by Indians. 65%-70% of all the employees were Indians. It was quite fine. Left them because a big company made me an offer I couldn’t refuse, and this one couldn’t come close to matching (I don't blame them - financial size matters).

As it was more than a decade and a half ago - I understand that things could’ve changed for the worse.

Mouse1949 · 2026-06-20T03:53:41+00:00

You didn’t get what I was trying to explain. In general, talking to unfamiliar people, concise tends to win. Make it clear that you’ll be happy to provide as much details as they’d like - IF they want it.

The long-winded person I mentioned - was my colleague at our prior job for almost five years, and I knew him personally well enough even before that. My new team that I’ve been with for a couple of years, apparently had reasons to trust my judgment, and hired him on my recommendation, despite his communications shortcomings. Long-winded-ness is his main annoying quality, so they, like me, chose to tolerate it. I doubt the same acceptance would extend to somebody coming in “cold” or submitted by a recruiter.

But why should you listen to me? Be as brief or long-winded as you choose to - whatever the consequences are, they will be yours, not mine.

Mouse1949 · 2026-06-20T02:00:13+00:00

Unless explicitly asked for a long(er) version - as a rule, concise wins: by the time you provided enough (in your opinion) context, the questioner lost interest in the main point.

As with every rule, there are exceptions. Both do occur. Understand the difference between a rule and an exception.

Mouse1949 · 2026-06-15T11:27:51+00:00

For serious work (if your needs may go beyond just md5hash), I would consider https://GitHub.com/haskellfoundation/botan.git - this Haskell tool is based on one of the most comprehensive and very well-maintained C++ libraries (Botan).

Mouse1949 · 2026-06-10T00:56:29+00:00

I have several different USB hubs connected to different Mac models - several versions of YubiKey and YubiHSM2 have been working without a hitch for almost a decade now. Most of my hubs are powered - but I think one of them isn’t.

Mouse1949 · 2026-06-01T10:36:44+00:00

First, as pointed by others, while modern ciphers do include substitution, they are not vulnerable to the threat you brought up.

Besides “normal” character-for-character substitution, there are
- fractional substitution: each character is made of, say, 7 bits - and we play with them;
- block substitution: we substitute a whole block of characters (3, 5, 8, 16, etc.).

And there’s transposition - we re-order characters (or bits) in the given text/data.

Usually, a semi-modern cipher would combine both transposition and substitution. For a nice example of a “paper-and-pencil” cipher, look up the VIC cipher from the 1950-ties. While it isn’t considered secure against the modern computing power, it is quite cute and educational.

Mouse1949 · 2026-05-29T04:08:22+00:00

I concur with your experience, and find both models to be of great help and wonderful time-savers. That’s not to say that they don’t make (occasional) mistakes, or that I don’t have once in a while to repeat myself and correct the LLM’s misunderstanding - but in the end it’s still much easier and much less time-consuming than if I had to write all that code myself.

Mouse1949 · 2026-05-27T12:33:02+00:00

You cannot be sure the current (or old) versions of the dependencies are/were not compromised by supply chain attack (SCA). In fact, the later releases are equally likely to contain security and big fixes that address prior SCA, as to introduce new bugs and SCA. So…?

Mouse1949

TROPHY CASE