The cryptography glossary

Ciphers, hashes, keys, primes and the machines that used them: each term in a sentence, then a paragraph, with the page that explains it best.

Short definitions of 171 terms from cryptography, the history of codebreaking and the mathematics of primes, in plain English. Each has a one-sentence definition (the one you see when you hover over a dotted link on the other pages), a paragraph, and links to the pages that explain it best. Terms are linked from the pages that use them, the first time they appear.

A

Abundant number

A number whose proper divisors add up to more than the number itself.

12 is abundant: its proper divisors 1, 2, 3, 4 and 6 add to 16. Numbers whose divisors add to less are deficient (every prime is), and those that add to exactly the number are perfect.

ADFGVX cipher

A German First World War field cipher combining a Polybius square with a columnar transposition.

ADFGVX was introduced by Germany in March 1918. Each letter and digit becomes a pair of the letters A, D, F, G, V and X through a 6 by 6 square, and the pairs are then scrambled by a columnar transposition. The French cryptanalyst Georges Painvin broke it within weeks.

AEAD (authenticated encryption with associated data)

A cipher mode that encrypts and checks integrity in one step, so tampering is detected.

An AEAD mode both encrypts a message and produces a tag that proves neither the ciphertext nor any extra “associated data” (such as a header that is sent in the clear) was changed. AES-GCM and ChaCha20-Poly1305 are AEAD modes. Using one removes a whole family of mistakes that come from encrypting and authenticating separately.

Affine cipher

A substitution that maps each letter x to ax + b modulo 26.

The affine cipher multiplies the letter's number by a and adds b, all modulo 26. For it to be reversible a must share no factor with 26, which leaves 12 choices of a and 26 of b, only 312 keys. Caesar is the special case a = 1.

Argon2

The winner of the 2015 Password Hashing Competition; a memory-hard password hash.

Argon2 won the Password Hashing Competition in 2015 and is specified in RFC 9106. The Argon2id variant is the common recommendation for new systems because it resists both graphics-card and side-channel attacks. Like scrypt, it needs a lot of memory per guess.

ASN.1 and DER

A notation and a binary encoding used for certificates and keys.

ASN.1 describes structured data, and DER is its strict binary encoding, in which each item is a tag, a length and a value. Certificates and keys are DER. The PEM decoder on this site walks the structure and shows each piece.

Authentication tag

A short value that proves a message was not altered.

An authentication tag is a short checksum computed with a secret key. A receiver recomputes it and compares: if it differs, the message was changed or came from someone without the key. In AES-GCM the tag is 128 bits and is appended to the ciphertext. Without a valid tag, cipher.ink shows nothing at all rather than a corrupted message.

Autokey cipher

A Vigenère variant that uses the message itself as part of the key.

In an autokey cipher the key is a short primer followed by the plaintext itself, so it never repeats. That defeats the Kasiski method, but because the key depends on the message there are other ways in. The idea dates from the sixteenth century, and Blaise de Vigenère described a version in 1586.

Avalanche effect

A tiny change in input changes about half of the output bits.

A good hash or cipher has the avalanche effect: flipping one input bit flips about half the output bits, unpredictably. It means similar inputs give unrelated outputs, so nothing can be learned from near matches. The SHA-256 explorer lets you watch it happen.

B

Base64

A way of writing binary data using 64 printable characters.

Base64 represents bytes with the letters, digits, plus and slash, taking three bytes to four characters, with = padding at the end. It is used in email, web tokens and certificates. It is not encryption: anyone can decode it. The URL-safe variant swaps two characters so the text fits in a link.

bcrypt

A password hash from 1999 built to be slow and to resist custom hardware.

bcrypt is a password-hashing function based on the Blowfish cipher, with a built-in salt and a cost setting that doubles the work with each increment. It is memory-light, so graphics cards attack it less efficiently than they attack plain hashes, though newer designs resist them better. Its output starts with $2, which the hash identifier recognizes.

Birthday attack

Finding a hash collision far faster than guessing, thanks to the birthday paradox.

In a room of 23 people there is a better-than-even chance two share a birthday, and the same arithmetic means a collision in an n-bit hash takes only about 2^n/2 tries. That is why a 128-bit hash gives only about 64 bits of collision resistance.

Bletchley Park

The British codebreaking center of the Second World War.

Bletchley Park, a country house in Buckinghamshire, was home to the Government Code and Cypher School during the war. Its codebreakers read Enigma and Lorenz traffic and built early electronic computers such as Colossus. The site is now a museum.

Block cipher

A cipher that encrypts data in fixed-size blocks, such as 16 bytes at a time.

A block cipher transforms a fixed-size block of data under a key; AES works on 128-bit (16-byte) blocks. To encrypt longer messages it is used in a mode of operation that chains the blocks together safely. Without a mode, equal blocks encrypt to equal ciphertext, which leaks patterns.

Bombe

The electromechanical machine that tested Enigma settings against a crib.

The bombe was designed by Alan Turing and Gordon Welchman at Bletchley Park, building on the Polish “bomba”. It did not decrypt messages: it eliminated impossible rotor settings by following the logical consequences of a crib, leaving a few candidates to check by hand. Over 200 were built.

Book cipher

A cipher that locates words or letters in a shared book.

In a book cipher each word or letter is replaced by its position in an agreed text, such as page, line and word number. Without the same edition of the book it cannot be read. The Beale ciphers are the most famous example, and it was used in the American Revolution.

Brute force

Trying every possible key or password until one works.

A brute-force attack tries all possibilities in turn. Its cost grows with the size of the search space, so a long random key makes it hopeless: guessing a 128-bit key is far beyond any attacker. It is realistic only when the secret is short or chosen from a small set, such as a four-digit PIN or a four-letter word.

C

Caesar cipher

A substitution that shifts every letter a fixed number of places along the alphabet.

Julius Caesar is reported to have used a shift of three, so A became D. There are only 25 useful shifts, so it can be broken by trying all of them. ROT13 is the same cipher with a shift of 13, which is its own inverse.

Carmichael number

A composite number that fools the Fermat primality test for every base.

A Carmichael number is composite yet satisfies aⁿ⁻¹ ≡ 1 (mod n) for every a coprime to it. The smallest is 561 = 3 × 11 × 17. Robert Carmichael described them in 1910, and in 1994 it was proved that there are infinitely many.

CBC (cipher block chaining)

A mode that XORs each plaintext block with the previous ciphertext block before encrypting.

CBC chains blocks so that identical plaintext no longer gives identical ciphertext. It needs an unpredictable initialization vector and padding, and it provides no authentication by itself, which has led to padding-oracle attacks on systems that accepted modified ciphertext. Modern designs prefer an authenticated mode such as GCM.

Checksum

A short value computed from data to detect accidental changes.

A checksum is a small value derived from a file or message, used to notice that it has changed. Simple checksums such as CRC-32 catch accidental damage but are easy to forge on purpose. A cryptographic hash such as SHA-256 is the checksum to use when someone might tamper with the file.

Chen prime

A prime p for which p + 2 is prime or a product of two primes.

Chen Jingrun proved in 1973 that every large enough even number is the sum of a prime and a number that is prime or a product of two primes, the nearest anyone has come to Goldbach. Primes p where p + 2 is prime or semiprime are named for him.

Chinese remainder theorem

A way to combine remainders modulo coprime numbers into one answer.

If you know a number's remainder modulo several pairwise coprime numbers, the Chinese remainder theorem says exactly one number below their product fits. RSA implementations use it to decrypt about four times faster by working modulo each prime separately.

Cicada prime cycles

Why some cicadas emerge every 13 or 17 years, both prime numbers.

Periodical cicadas emerge in broods of 13 or 17 years. One hypothesis is that prime cycle lengths make it hard for predators or hybridizing broods with shorter cycles to line up often. It remains a hypothesis and is debated.

Cipher

A method for turning a message into an unreadable form and back, using a key.

A cipher is a pair of procedures, one to encrypt and one to decrypt, controlled by a key. The word covers everything from a three-letter shift on paper to AES. Strictly a cipher works on letters or bits, while a code swaps whole words or phrases for other symbols; in everyday speech the two get mixed up.

Ciphertext

The scrambled output of encryption; unreadable without the key.

Ciphertext is what encryption produces from plaintext. A good cipher makes it look like random noise to anyone without the key, so it can be stored or sent over an open channel. cipher.ink's server only ever holds ciphertext: the key sits in the part of the link after the #, which browsers do not send.

Circular prime

A prime that stays prime for every rotation of its digits, like 197.

197, 971 and 719 are all prime, so 197 is a circular prime. A circular prime with more than one digit can use only the digits 1, 3, 7 and 9, because any other digit would eventually rotate to the end and make an even number or a multiple of 5.

Client-side encryption

Encryption done in your own browser or app, before anything is sent.

With client-side encryption the data is encrypted on your device and only ciphertext is sent to the server. The server cannot read what it stores. You still have to trust the code your browser runs, which is why the cipher.ink source is short and published.

Code (codebook)

A system that replaces whole words or phrases with code words or numbers.

A code substitutes words and phrases, not letters, from a codebook that sender and receiver both hold. Diplomatic codes of centuries past used thousands of entries. A code can be very hard to break but is useless for anything not in the book, and a captured book compromises everything.

Collatz steps

How many steps of “halve if even, triple and add one if odd” it takes to reach 1.

Start with any whole number; if it is even, halve it; if odd, triple it and add 1. The Collatz conjecture says every start eventually reaches 1. It has been checked for enormous ranges of numbers but is unproved.

Collision

Two different inputs that produce the same hash.

A collision is a pair of different inputs with the same hash. Because there are more possible inputs than outputs, collisions must exist; a good hash function makes them impossible to find. MD5 and SHA-1 are broken because practical collisions have been produced, which is why they should not be used for signatures or certificates.

Composite number

A whole number greater than 1 that is not prime, so it has a divisor besides 1 and itself.

A composite number can be written as a product of two smaller whole numbers: 12 = 3 × 4, 91 = 7 × 13. Proving a number composite can be easy, by finding a divisor, or it can be done without finding any factors, as the Miller–Rabin test does.

Coprime

Two numbers that share no divisor except 1.

Numbers are coprime (or relatively prime) when their GCD is 1: 8 and 15 are coprime even though neither is prime. The affine cipher needs its multiplier coprime to 26, and RSA needs its exponent coprime to φ(n).

Cousin prime

A prime that is 4 away from another prime, like 7 and 11.

Cousin primes differ by 4: (3, 7), (7, 11), (13, 17). Like twin primes they are conjectured to be infinite in number, and the same kind of counting heuristic predicts about how many to expect.

CRC (cyclic redundancy check)

A fast error-detecting code that is not secure against deliberate changes.

A cyclic redundancy check treats data as a polynomial and keeps the remainder after division by a fixed polynomial. It reliably catches burst errors in storage and networks, and ZIP and PNG files use CRC-32. Because it is linear, an attacker can change data and fix the CRC to match, so it gives no security.

Crib

A guessed piece of plaintext used to break a cipher.

A crib is a word or phrase the codebreaker expects to appear in a message, such as a weather report or a greeting like “Heil Hitler” at the end. At Bletchley Park cribs were matched against ciphertext to test Enigma settings, and the bombes then ran the checks mechanically.

Cryptanalysis

The study of breaking ciphers without the key.

Cryptanalysis is the art and science of reading encrypted messages without being given the key. It ranges from counting letter frequencies to subtle statistical attacks on modern ciphers. Cryptography and cryptanalysis develop together: each broken cipher teaches designers what to avoid.

Cryptography

The science of protecting information with codes and ciphers.

Cryptography is the practice of securing information so that only the intended people can read or alter it. It includes encryption, signatures, hashing and key exchange. The word comes from the Greek for “hidden writing”, and its history reaches back at least to ancient Egypt and Mesopotamia.

CSP (content security policy)

A rule the server sends that tells the browser which scripts and resources a page may load.

A content security policy is an HTTP header that limits what a page may load or run. cipher.ink forbids inline scripts, third-party resources and anything not served from its own origin, so even if an attacker managed to inject text into a message, the browser would refuse to run it.

CSPRNG

A random number generator whose output is safe to use for keys.

A cryptographically secure pseudorandom number generator produces bytes that nobody can predict, even knowing the earlier output. Browsers expose one through crypto.getRandomValues. Ordinary generators such as Math.random are fast but predictable, and must never make keys, salts or nonces.

CTR (counter mode)

A mode that encrypts a counter to make a keystream and XORs it with the data.

Counter mode turns a block cipher into a stream cipher: it encrypts successive counter values, each combined with a nonce, and XORs the result with the plaintext. It parallelizes well and needs no padding. The one firm rule is never to reuse a nonce and key together. GCM is counter mode plus an authentication tag.

Cunningham chain

A sequence of primes in which each is twice the previous one plus 1.

A Cunningham chain of the first kind is a run of primes p, 2p + 1, 4p + 3, …. Starting at 2 gives 2, 5, 11, 23, 47, a chain of five. The smallest chain of six begins at 89. Every term except the last is a Sophie Germain prime.

D

Deficient number

A number whose proper divisors add up to less than the number itself.

8 is deficient: 1 + 2 + 4 = 7. Every prime and every prime power is deficient. Most small numbers are deficient or abundant; perfect numbers are rare.

Dictionary attack

Guessing passwords from a list of likely ones instead of trying every combination.

A dictionary attack tries common passwords, words and their usual variations first, because people choose them far more often than random strings. Lists built from leaked passwords make this very effective against human-made passwords, and almost useless against truly random ones.

Diffie–Hellman

The first public key exchange: two parties build a shared secret over an open channel.

In 1976 Whitfield Diffie and Martin Hellman published a way for two people to agree on a secret by exchanging only public values. Each raises a shared base to a private exponent, and the results combine to the same number on both sides. Its security rests on the discrete logarithm problem. Ralph Merkle contributed the idea of public-key distribution.

Digest

The fixed-size output of a hash function.

A digest, also called a hash value or fingerprint, is what a hash function outputs. SHA-256 digests are 32 bytes, usually written as 64 hexadecimal characters. The same input always gives the same digest, so comparing digests is a way of comparing files without comparing every byte.

Digital signature

A value made with a private key that anyone can check with the matching public key.

A digital signature proves that a message came from the holder of a private key and has not changed since. Anyone with the public key can verify it, but only the private key can create it. RSA, ECDSA, EdDSA and the post-quantum ML-DSA are signature schemes.

Digraph

A pair of letters treated as a single unit.

A digraph is two letters handled together. The Playfair cipher encrypts digraphs, which flattens single-letter frequencies, since there are 600 or so pairs instead of 26 letters, and so needs far more text to analyze.

Discrete logarithm

Finding the exponent x in gx = y within modular arithmetic, believed to be hard.

Given a prime p, a base g and a result y, the discrete logarithm problem asks for x with g^x ≡ y (mod p). Raising is quick, reversing is not, for large p. Diffie–Hellman, ElGamal and elliptic-curve cryptography depend on this one-way behavior.

E

ECB (electronic codebook)

The simplest block-cipher mode, which encrypts equal blocks to equal ciphertext and should not be used.

In ECB mode each block is encrypted on its own with the same key, so identical plaintext blocks give identical ciphertext blocks. Patterns therefore survive: an image encrypted this way still shows its outline, as the ECB image demo makes plain. It is useful only as a teaching example.

Elliptic curve

A mathematical curve whose points form a group, used for compact public-key cryptography.

Elliptic-curve cryptography uses points on a curve with a special addition rule. Its discrete-logarithm problem is hard enough that 256-bit keys give strength comparable to 3,072-bit RSA. It powers modern TLS key exchange and signatures such as Ed25519.

Emirp

A prime that is a different prime when its digits are reversed.

“Emirp” is “prime” spelled backwards. 13 and 31 are both prime, so each is an emirp; a palindromic prime like 131 is not, because reversing gives the same number. The smallest emirp is 13.

Encoding

Changing the form of data for storage or transport, without any secret.

Encoding such as Base64, hexadecimal or URL encoding changes how data is written so that it survives a particular channel. Anyone can reverse it, because there is no key. Mistaking an encoding for encryption is a common and costly error.

End-to-end encryption

Encryption where only the sender and recipient hold the keys, not the service between them.

In end-to-end encryption, messages are encrypted on the sender's device and decrypted only on the recipient's, so the service that carries them cannot read them. It is a statement about who holds the keys, not about the algorithm used. cipher.ink has this property: the key lives only in the link you share, never on the server.

Entropy

A measure of unpredictability, counted in bits.

In cryptography, entropy measures how many equally likely possibilities a secret could be drawn from. A secret with 40 bits of entropy has about a trillion possibilities; each extra bit doubles the number. A passphrase of six words chosen at random from a 7,776-word list has about 77.5 bits. Entropy describes how the secret was chosen, not how it looks.

Euclid's theorem

There are infinitely many primes.

Euclid's proof, from about 300 BC, assumes there is a largest prime, multiplies all primes together and adds 1; the result has a prime factor that is not on the list, a contradiction. It is one of the oldest proofs still in textbooks. See the largest known prime for how far the search has got.

Euler's totient (φ)

The count of numbers up to n that are coprime to n.

Euler's totient φ(n) counts how many of 1, 2, …, n share no factor with n. For a prime p it is p − 1. For a product of two primes pq it is (p − 1)(q − 1), which is what the RSA private exponent is built from.

F

Factorial prime

A prime one more or one less than a factorial, like 7 = 3! + 1.

The factorial n! is the product 1 × 2 × … × n. A factorial prime is a prime of the form n! ± 1; for example 3! + 1 = 7 and 11! + 1 = 39,916,801. They are useful because n! ± 1 has no factors up to n, and for the same reason n! + 2 to n! + n are all composite, giving long gaps between primes.

Fermat prime

A prime of the form 22n + 1.

Fermat numbers are 2^2ⁿ + 1. The first five (3, 5, 17, 257, 65,537) are prime, and Fermat guessed they all were, but no other Fermat prime is known. Gauss showed that a regular polygon with a prime number of sides can be built with ruler and compass exactly when that prime is a Fermat prime.

Fermat's little theorem

If p is prime, then a raised to p − 1 leaves remainder 1 modulo p.

For a prime p and any a not divisible by it, a^p−1 ≡ 1 (mod p). Fermat stated it in 1640. It is the foundation of fast primality tests and of why the three-pass padlock protocol works; composite numbers that fool it are called pseudoprimes.

Fibonacci number

A term of the sequence 1, 1, 2, 3, 5, 8, 13, where each is the sum of the two before.

The Fibonacci sequence appears in nature and in algorithms. Some Fibonacci numbers are prime (2, 3, 5, 13, 89, 233), but it is not known whether infinitely many are.

Forward secrecy

A property that keeps past conversations safe even if a long-term key is later stolen.

With forward secrecy, each session uses a fresh temporary key that is deleted afterward, so recording encrypted traffic today and stealing the server's key next year reveals nothing. HTTPS with ephemeral Diffie–Hellman has it.

Fractionation

Splitting each letter into parts, such as coordinates, before further scrambling.

A fractionating cipher turns each plaintext letter into two or more smaller symbols, then mixes those across the message. ADFGVX and Bifid first convert letters into grid coordinates; mixing the coordinates spreads each letter over several ciphertext characters.

Frequency analysis

Breaking a cipher by counting how often each letter appears.

In English, E is the most common letter, then T, A, O, I and N. Because a simple substitution keeps those proportions, the most frequent ciphertext letter probably stands for E. The method was described by the Arab scholar al-Kindi in the ninth century and still opens most puzzle ciphers. The frequency tool draws the chart.

G

Gaussian prime

A prime in the complex integers; the real primes 3 mod 4 are examples.

Gaussian integers are complex numbers a + bi with whole a and b, and they have their own primes. A real prime stays prime there only if it is 3 mod 4; those that are 1 mod 4, such as 5 = (2 + i)(2 − i), split in two.

GCM (Galois/counter mode)

An authenticated mode that encrypts with counter mode and adds a tag that detects tampering.

AES-GCM encrypts with counter mode and computes a short authentication tag over the ciphertext and any associated data. A receiver who gets a wrong tag discards the message, so tampering is detected. It is the mode used by TLS 1.3 and many other systems. A repeated nonce under one key breaks it badly.

General number field sieve

The fastest known classical algorithm for factoring very large numbers.

The general number field sieve is the best known algorithm for factoring integers of more than about a hundred digits. It was used to factor the 250-digit RSA-250 in 2020, at a cost of thousands of core-years. Its cost grows faster than polynomially, which is what makes 2,048-bit RSA keys safe against today's classical computers.

GIMPS

The Great Internet Mersenne Prime Search, a volunteer project that finds record primes.

GIMPS, founded by George Woltman in 1996, lets volunteers lend spare computer time to test Mersenne numbers. Its volunteers have found many of the record primes since, including the record 2^136,279,841 − 1 found in October 2024.

Goldbach conjecture

The unproved claim that every even number above 2 is the sum of two primes.

Christian Goldbach wrote to Euler in 1742 with the guess that every even number greater than 2 is a sum of two primes: 28 = 5 + 23. It has been verified by computer to very large numbers, but no proof is known.

Greatest common divisor (GCD)

The largest number that divides both of two numbers.

The GCD of 12 and 18 is 6. Euclid's algorithm finds it quickly by repeated division, even for numbers hundreds of digits long. Two numbers whose GCD is 1 are called coprime. The extended version also gives the modular inverses that RSA needs.

H

Happy prime

A prime that reaches 1 when you repeatedly replace it by the sum of the squares of its digits.

Take 7: 49, then 97, then 130, then 10, then 1. It reaches 1, so 7 is a happy number, and a prime that does this is a happy prime. Numbers that do not reach 1 fall into a cycle that includes 4. It is a recreational property, with no deep use.

Hash function

A function that turns any input into a fixed-size fingerprint and cannot be run backwards.

A cryptographic hash function maps input of any length to a fixed-length output, such as 256 bits for SHA-256. The same input always gives the same output, a tiny change gives a completely different one, and it is infeasible to find an input for a given output or two inputs with the same output. Hashes check file integrity and sit inside signatures, passwords storage and HMAC.

Hill cipher

A cipher that multiplies blocks of letters by a key matrix, modulo 26.

Lester Hill published this cipher in 1929. Letters become numbers, a block of them is multiplied by an invertible matrix mod 26, and the result is turned back into letters. It was the first practical polygraphic cipher built on algebra, but is weak against known plaintext because it is linear.

HMAC

A MAC built from a hash function and a secret key.

HMAC (hash-based message authentication code) wraps a hash function such as SHA-256 around a key in a specific two-pass way, defined in RFC 2104. It avoids the weaknesses of simply hashing the key and message together. It is used for signing API requests, in TOTP codes, and inside PBKDF2.

Homophonic substitution

A substitution where common letters have several different symbols.

In a homophonic cipher a frequent letter like E gets many symbols, used in rotation, so that the ciphertext frequencies flatten out. It was used from the fifteenth century. It is much harder than simple substitution, but patterns of pairs and words can still give it away. The Zodiac Killer's 340-character cipher, solved in 2020, is a famous example.

HOTP (counter-based one-time password)

A one-time code derived from a secret and a counter (RFC 4226).

HOTP is the one-time-password algorithm TOTP is built on: it applies HMAC to a counter and truncates the result to a few digits. In TOTP the counter is the number of 30-second periods since 1970. Hardware tokens often use HOTP and increase the counter each press.

Hybrid encryption

Using public-key cryptography to send a key, then symmetric encryption for the data.

Public-key operations are slow and limited in size, so real systems use them only to protect a small random symmetric key, then encrypt the data with that key. Email encryption, TLS and file encryption all work this way.

I

Illegal prime

A prime that, read as data, encodes something that is restricted.

An illegal prime is a prime number whose binary form is a program or file that is illegal to distribute in some places. It was created to make a point about the absurdity of treating numbers as property. cipher.ink's page makes harmless examples and does not reproduce any restricted one.

Index of coincidence

A statistic that tells whether text is a simple substitution or polyalphabetic.

The index of coincidence is the chance that two letters drawn at random from a text are equal. English gives about 0.067, random letters about 0.038. Computed on every kth letter, it reveals the length of a Vigenère key. William Friedman introduced it in 1922.

Initialization vector (IV)

The starting value a cipher mode mixes in so identical messages encrypt differently.

An initialization vector is a public starting value for a cipher mode. It need not be secret, but in some modes it must be unpredictable, and in others it must simply never repeat. People often use “IV” and “nonce” for much the same thing; the mode defines which requirement applies.

J

JWT (JSON Web Token)

A compact signed token that carries claims, often used for login sessions.

A JSON Web Token has three Base64url parts: a header, a payload of claims and a signature. The payload is readable by anyone, so it must not hold secrets. A verifier must check the signature and require a specific algorithm, because tokens that say alg: none have been accepted by careless libraries.

K

Kasiski examination

A way to find the key length of a Vigenère cipher from repeated sequences.

If the same word is enciphered with the same part of the key twice, the ciphertext repeats. The distances between repeats are multiples of the key length, so their common factors reveal it. Friedrich Kasiski published this in 1863; Charles Babbage had found it earlier but did not publish.

KEM (key encapsulation mechanism)

A public-key tool that creates and delivers a random shared key.

A key encapsulation mechanism lets someone who holds a public key produce a random secret together with a short ciphertext that only the private-key holder can open. Both sides then share the secret. ML-KEM is the post-quantum standard KEM.

Kerckhoffs's principle

A system should stay secure even if everything but the key is public.

Auguste Kerckhoffs wrote in 1883 that a cipher must not require secrecy and should be able to fall into enemy hands without trouble. Modern cryptography follows this: algorithms are public and scrutinized, and only keys are secret. cipher.ink's code is published for that reason.

Key

The secret value that controls a cipher; whoever has it can decrypt.

A key is the small piece of secret information that a cipher needs in order to encrypt or decrypt. Modern ciphers are public, so all of the security rests on the key being long enough to guess only by luck and on being kept secret. A passphrase is not a key itself; a function such as PBKDF2 turns it into one.

Key derivation function (KDF)

A function that turns a password or other secret into a cryptographic key.

A key derivation function takes input such as a passphrase and produces a key of the right length. A password-based KDF is deliberately slow so that each guess costs an attacker time; PBKDF2, scrypt and Argon2 are examples. Others, such as HKDF, stretch a key that is already strong.

Key exchange

A way for two parties to agree on a shared secret over an open channel.

A key exchange lets two people who have never met agree on a secret key while an eavesdropper watches every message. Diffie–Hellman, published in 1976, was the first. After the exchange both sides use the shared secret as a symmetric key.

Key size

The length of a key in bits; more bits means a larger space to search.

The key size is how many bits a key has. Adding one bit doubles the work of brute force. For symmetric ciphers 128 bits is far beyond reach and 256 bits adds margin against future quantum search. For RSA the key is much larger (2,048 bits or more) because the attacks on it are cleverer than guessing.

Keyword

A secret word used to build a cipher alphabet or key.

Many classical ciphers use a keyword instead of a number: it can order the columns of a transposition, build a mixed alphabet by writing the word first and then the unused letters, or repeat along the message in Vigenère. Keywords are easy to remember and, being words, easy to guess.

Known-plaintext attack

An attack where the analyst has some plaintext and its ciphertext.

In a known-plaintext attack the codebreaker knows or guesses part of the original message and uses it to find the key. At Bletchley Park the guessed words were called cribs. Modern ciphers are designed so that even huge amounts of known plaintext reveal nothing about the key.

L

Length-extension attack

An attack that appends data to a hash without knowing the secret it covers.

With hashes built like SHA-256, knowing H(secret + message) lets an attacker compute the hash of the message with extra data appended, without knowing the secret. That is why H(key + message) is not a safe MAC, and HMAC exists. SHA-3 is immune.

Lorenz cipher

The German teleprinter cipher machine whose traffic was broken by Colossus.

The Lorenz SZ40/42 machine encrypted high-level German army messages on teleprinter tape using twelve wheels. British cryptanalysts, led by Bill Tutte, worked out its structure from a single error without ever seeing the machine, and Colossus, built in 1943–44, automated the attack.

Lucas–Lehmer test

A fast, exact test for whether a Mersenne number is prime.

For an odd prime p, start with 4 and repeat s → s² − 2 modulo 2^p − 1 a total of p − 2 times: the Mersenne number is prime exactly when the result is 0. It is so efficient that the largest known primes are Mersenne primes.

M

MAC (message authentication code)

A keyed checksum that proves a message came from someone who knows the key and was not changed.

A message authentication code is a tag computed from a message and a secret key. Only someone with the key can make a valid tag, so a matching tag shows both integrity and origin. HMAC is the most common construction, and the tag in AES-GCM is also a kind of MAC. A MAC does not hide the message; it only vouches for it.

Mersenne prime

A prime of the form 2p − 1.

Mersenne numbers are 2^p − 1. They can be prime only if p is prime, though not every prime p works: 2¹¹ − 1 = 2047 = 23 × 89. The Lucas–Lehmer test checks them quickly, and the largest known primes are all Mersenne primes found by volunteers through GIMPS.

Miller–Rabin test

A fast probabilistic test that proves a number composite or says it is probably prime.

The Miller–Rabin test checks a number against several bases using modular exponentiation. A composite number fails for most bases, so a few passes make a composite number astonishingly unlikely. With the first 13 primes as bases it is a proof for every number below about 3.3 × 10²⁴. The number card on this site uses it.

Mode of operation

The recipe for using a block cipher on messages longer than one block.

A mode of operation says how a block cipher is applied across many blocks: ECB, CBC, CTR, OFB and GCM are the common ones. The mode, not the cipher, decides whether patterns leak, whether the message is authenticated, and whether a repeated nonce is fatal. Choosing AES is only half the decision.

Modular arithmetic

Arithmetic on a clock: numbers wrap around after reaching the modulus.

In modular arithmetic you keep only the remainder after dividing by a fixed modulus n. On a 12-hour clock 9 + 5 is 2. It underlies the Caesar cipher (mod 26), RSA, Diffie–Hellman and almost all public-key cryptography.

Modular exponentiation

Computing a power and keeping only the remainder, done fast by repeated squaring.

Computing a^e mod n by multiplying one factor at a time would be impossible for 2,048-bit exponents. Repeated squaring needs only about as many steps as the exponent has bits. RSA and Diffie–Hellman rely on this being easy in one direction and hard to reverse.

Modular inverse

A number that undoes multiplication in modular arithmetic.

The inverse of a modulo n is a number b such that a × b leaves remainder 1 when divided by n. It exists exactly when a and n are coprime. RSA decryption uses the inverse of the public exponent modulo φ(n).

Monoalphabetic cipher

A substitution cipher that always replaces a given letter with the same symbol.

In a monoalphabetic cipher the mapping from plaintext to ciphertext letters never changes, so every E becomes the same symbol. That is what makes frequency analysis work. Caesar, Atbash, affine and keyword ciphers are all monoalphabetic.

N

Nonce

A number used once: a value that must never repeat with the same key.

A nonce is a value that must be used only once with a given key. In AES-GCM it is a 96-bit value that must never repeat under the same key; repeating it lets an attacker recover the keystream and forge tags. cipher.ink makes a fresh random one for every message. Nonces need not be secret, only unique.

Null (cipher null)

A meaningless symbol added to a cipher to confuse the analyst.

Nulls are padding symbols that carry no meaning. They break up word lengths and patterns, and can also be used to complete a block or grid. Mary, Queen of Scots' cipher included nulls.

O

One-time pad

A cipher using a truly random key as long as the message, used once, which is provably secure in theory.

The one-time pad combines the message with a random key as long as the message, used once only and then destroyed. Shannon proved in 1949 that it has perfect secrecy. The difficulty is practical: generating, delivering and never reusing that much key. Reuse it and the secrecy collapses; Soviet reuse of pads was exploited in the Venona project.

P

Padding

Extra bytes added so a message fills whole cipher blocks.

Block ciphers need data in whole blocks, so the last block is padded to full size with a known pattern such as PKCS#7. Padding must be checked carefully: a server that reveals whether the padding was valid can be used as an oracle to decrypt messages. Modes such as GCM and counter mode need no padding at all.

Palindromic prime

A prime that reads the same forwards and backwards, like 131.

Palindromic primes include 2, 3, 5, 7, 11, 101, 131 and 151. Any palindrome with an even number of digits is divisible by 11, so apart from 11 itself they all have an odd number of digits.

Passphrase

A password made of several random words, long enough to be strong and easy to remember.

A passphrase is a password made of words instead of mixed characters. Words chosen by dice or a computer from a known list are easy to remember and have a calculable strength; words you pick yourself are far weaker than they feel. Length matters more than complexity.

PBKDF2

A slow password-based key derivation function built on HMAC.

PBKDF2 (Password-Based Key Derivation Function 2, RFC 8018) runs an HMAC many times over a password and salt. The iteration count sets the cost: cipher.ink uses 600,000 rounds of HMAC-SHA256, so every guess at your passphrase takes a measurable fraction of a second. Browsers include it natively, which is why this site uses it.

PEM

A text format that wraps Base64 data between BEGIN and END lines.

PEM (Privacy-Enhanced Mail) is the familiar text format with lines such as -----BEGIN CERTIFICATE-----. The body is Base64 of binary DER data. Keys, certificates and requests are all stored this way. A private key in PEM must never be pasted into a website.

Pepper

A secret value, kept apart from the database, added to password hashing.

A pepper is like a salt that is secret and shared across all users, stored outside the password database, for example in a hardware module or application setting. If only the database leaks, the attacker is missing the pepper. It adds a layer but does not replace a salt or a slow hash.

Perfect number

A number equal to the sum of its proper divisors, like 6 and 28.

The proper divisors of 6 are 1, 2 and 3, which add to 6; 28 is the next. Euclid showed that when 2^p − 1 is a Mersenne prime, 2^p−1(2^p − 1) is perfect, and Euler proved every even perfect number is of this form. Whether an odd one exists is unknown.

Perfect secrecy

A cipher whose ciphertext reveals absolutely nothing about the message.

Claude Shannon proved in 1949 that the one-time pad has perfect secrecy: the ciphertext is consistent with every possible message of the same length. The price is a key as long as the message that is used only once. Every other practical cipher relies on computational difficulty instead.

Plaintext

The readable message before it is encrypted.

Plaintext is the original, readable message: the text, file or number you want to protect. Encryption turns it into ciphertext, and decryption turns the ciphertext back into exactly this. Despite the name, plaintext need not be words; for a computer it is any sequence of bytes, such as a photo or a spreadsheet.

Playfair cipher

A digraph cipher using a 5 by 5 keyword grid, used by the British in the First World War.

The Playfair cipher encrypts pairs of letters using a 5 by 5 grid built from a keyword: letters in the same row or column move along, others swap corners of a rectangle. Charles Wheatstone invented it in 1854, and Lord Playfair promoted it. Britain used it for field communications in the First World War.

Plugboard

The front panel of an Enigma where cables swapped pairs of letters.

The German military Enigma had a plugboard (Steckerbrett) where up to ten cables each swapped two letters before and after the rotors. It multiplied the number of settings enormously, to about 1.6 × 10²⁰ in total, but because it was a fixed substitution it could be attacked separately.

Pollard's rho

A factoring method that finds small factors by following a pseudorandom sequence until it cycles.

John Pollard's 1975 rho algorithm iterates a simple function modulo n and looks for a cycle, which reveals a factor with a gcd. It finds a factor p in roughly the square root of p steps, so it quickly splits numbers with a small factor, but is no match for a number whose factors are all huge.

Polyalphabetic cipher

A cipher that uses several substitution alphabets in turn, hiding letter frequencies.

A polyalphabetic cipher changes the substitution as it goes, so the same plaintext letter becomes different ciphertext letters at different places. The Vigenère cipher uses a repeating keyword to pick the alphabet; Enigma changes it with every key press. It defeated simple frequency analysis for centuries.

Polybius square

A grid that replaces each letter with its row and column numbers.

A Polybius square writes the alphabet in a 5 by 5 grid (I and J share a cell) and replaces each letter with its row and column, so E might become 15. It was described by the Greek historian Polybius in the second century BC and underlies ADFGVX, Bifid and Nihilist ciphers.

Post-quantum cryptography

Cryptography designed to resist attacks by quantum computers.

Post-quantum algorithms rely on problems that quantum computers are not known to solve quickly, such as lattice problems. NIST standardized ML-KEM (key exchange) and ML-DSA (signatures) in 2024. Symmetric ciphers and hashes need only larger sizes; the public-key systems RSA and elliptic curves are the ones at risk.

Preimage

An input that hashes to a given output; finding one should be infeasible.

A preimage of a hash value is any input that produces it. A hash is preimage resistant if, given only the output, finding an input is infeasible. That is what “one-way” means. It is a different, harder property than finding collisions, which is why MD5 is broken for signatures while still being hard to reverse by pure computation.

Primality test

A procedure that decides whether a number is prime.

A primality test answers “is this number prime?” without necessarily factoring it. Trial division is exact but slow; Miller–Rabin is fast and, with enough witnesses, so reliable it is used for RSA keys; the AKS test (2002) proved the question can be settled in polynomial time.

Prime factorization

Writing a number as a product of primes; it is unique for every number.

The fundamental theorem of arithmetic says every whole number above 1 is a product of primes in exactly one way, apart from order: 360 = 2³ × 3² × 5. Multiplying is easy; finding the factors of a large number is believed to be hard, and RSA depends on that.

Prime gap

The distance between two consecutive primes.

The gap after 7 is 4 (to 11); the gaps get larger on average, roughly the natural logarithm of the number, but they are irregular. Long runs of composites exist: n! + 2 up to n! + n are all composite, so gaps can be as large as you like. The first gap of 14 follows 113.

Prime number

A whole number greater than 1 whose only divisors are 1 and itself.

A prime has exactly two divisors: 1 and itself. The first few are 2, 3, 5, 7, 11 and 13; 2 is the only even one. Every whole number above 1 is either prime or a unique product of primes, which is why primes are called the atoms of arithmetic. The number 1 is not prime.

Prime number theorem

The number of primes below n is roughly n divided by its natural logarithm.

Proved in 1896 independently by Hadamard and de la Vallée Poussin, it says about n/ln n of the numbers up to n are prime. Near a million roughly one in 14 numbers is prime; near 2¹⁰²⁴ about one in 710, which is why finding RSA primes by random trial is practical.

Primitive root

A number whose powers cycle through every nonzero value modulo a prime.

A primitive root (or generator) of a prime p is a number g whose powers g, g², … produce all of 1 to p − 1 before repeating. Diffie–Hellman uses one as the base. Safe primes make finding good ones easy.

Probable prime

A number that passed a primality test that is not a proof.

A probable prime has passed a probabilistic test such as Miller–Rabin. For a random number the chance that it is actually composite is smaller than the chance of a hardware error, so RSA key generators accept probable primes. Proofs for numbers of special form, such as Mersenne numbers, are rigorous.

Proth prime

A prime of the form k × 2n + 1 with k odd and k < 2n.

François Proth showed in 1878 that numbers of this form can be tested for primality with a simple test. Fermat primes are Proth primes with k = 1. Some of the largest known non-Mersenne primes are found this way.

Pseudoprime

A composite number that passes a primality test it should fail.

A Fermat pseudoprime to base 2 is a composite n with 2ⁿ⁻¹ ≡ 1 (mod n); the smallest is 341 = 11 × 31. Carmichael numbers are pseudoprimes to every coprime base. Miller–Rabin is built to avoid being fooled this way.

Public-key cryptography

Cryptography with a public key anyone may use and a matching private key kept secret.

Public-key (asymmetric) cryptography uses a pair of linked keys. Something locked with the public key can be unlocked only with the private key, and a signature made with the private key can be checked by anyone with the public key. It was invented in the 1970s and solves the problem of agreeing on a secret with someone you have never met. RSA, Diffie–Hellman and elliptic curves are public-key systems.

Pythagorean prime

A prime that is 1 more than a multiple of 4, such as 5, 13 or 17.

A Pythagorean prime has the form 4k + 1 and, by a theorem of Fermat, is the sum of two squares in exactly one way: 13 = 2² + 3². It is also the hypotenuse of a right triangle with whole-number sides. Primes of the form 4k + 3 are not sums of two squares.

R

Rail fence cipher

A transposition that writes the message in a zigzag across rows.

In the rail fence cipher the message is written diagonally down and up across a few rows, then read off row by row. The only key is the number of rows, so it is trivial to break.

Rainbow table

A precomputed table that reverses unsalted hashes quickly.

A rainbow table is a space-saving precomputed lookup of hash chains, invented by Philippe Oechslin in 2003, which lets an attacker reverse unsalted password hashes far faster than recomputing them. A unique salt per password makes them useless, because the table would have to be rebuilt for every salt.

Reflector

The fixed half-wheel in Enigma that sends the signal back through the rotors.

The reflector sends the current back through the rotors by a different path, which makes Enigma reciprocal: typing the ciphertext with the same settings returns the plaintext. It also meant that no letter could ever encrypt to itself, a flaw the codebreakers used.

Riemann hypothesis

The famous unproved claim about the zeros of the zeta function, which governs how primes are spread.

Bernhard Riemann conjectured in 1859 that all the nontrivial zeros of the zeta function lie on one vertical line. If true it pins down how evenly the primes are distributed. It is one of the Clay Institute's Millennium Prize Problems and remains unproved.

ROT13

The Caesar cipher with a shift of 13, which is its own inverse.

ROT13 shifts every letter 13 places; since the alphabet has 26 letters, applying it twice returns the original. It gives no security at all and is used only to hide spoilers and punch lines from a casual glance.

S

Safe prime

A prime of the form 2q + 1 where q is also prime.

A safe prime is p = 2q + 1 with q prime. They are used as moduli in Diffie–Hellman because the group order has only large prime factors, which blocks some shortcuts for the discrete logarithm. 23 is a safe prime (23 = 2 × 11 + 1).

Salt

A random value mixed into a password hash so identical passwords hash differently.

A salt is random data, unique per user or message, added to a password before hashing. It is stored beside the hash and need not be secret. It stops one precomputed table working against everybody and means two people with the same password get different hashes. cipher.ink makes a fresh random salt for every passphrase message.

scrypt

A password hash that demands lots of memory as well as time.

scrypt, designed by Colin Percival and published as RFC 7914, makes each password guess use a large block of memory, which makes mass guessing on graphics cards and custom chips expensive. It uses PBKDF2 inside. It is not available in the browser's built-in crypto, so cipher.ink uses PBKDF2 instead.

Scytale

A rod around which a strip is wound so that a message reads across it.

The scytale was a transposition device attributed to the Spartans: a leather strip wound around a rod of a given thickness, message written along the rod and read off flat as scrambled letters. How it was truly used in antiquity is debated by historians.

Secret sharing

Splitting a secret into pieces so that a minimum number of them recover it.

In Shamir's secret sharing (1979), a secret is split into n shares so that any k of them recover it and fewer reveal nothing. It uses polynomials over a finite field. It is used for sharing recovery keys among several trustees.

Semiprime

A number that is the product of exactly two primes.

A semiprime is p × q where the two primes may be equal: 15, 21 and 49 are semiprimes. An RSA modulus is a semiprime, and its security is the difficulty of splitting it back into its two primes.

Sexy prime

A prime that is 6 away from another prime, like 5 and 11.

Sexy primes differ by 6, from the Latin sex, which means six. Examples are (5, 11), (7, 13) and (11, 17). The name is a pun, and the idea is the same as for twin and cousin primes.

Shor's algorithm

A quantum algorithm that would factor large numbers and break RSA.

In 1994 Peter Shor showed that a large enough quantum computer could factor integers and compute discrete logarithms in polynomial time, which would break RSA, Diffie–Hellman and elliptic-curve cryptography. No such machine exists yet, which is why the world is moving to post-quantum algorithms ahead of time.

Side channel

Information leaked by how a computation runs, such as its timing, instead of by its output.

A side-channel attack learns a secret from physical or timing details of an operation: how long it takes, how much power it draws, or which memory it touches. Careful implementations use constant-time code so that those details do not depend on secret values. Comparing tags with a constant-time routine is the usual example.

Sieve of Eratosthenes

An ancient method for listing primes by crossing out multiples.

Write the numbers from 2 up, and repeatedly take the smallest one not crossed out and cross out all its multiples; what remains is prime. Attributed to Eratosthenes of Cyrene in the third century BC, it still finds all primes up to a limit faster than testing them one by one.

Sophie Germain prime

A prime p for which 2p + 1 is also prime.

A Sophie Germain prime p is one where 2p + 1 is also prime: 11 works because 23 is prime. Germain used them in the early 1800s in work on Fermat's Last Theorem. Such primes give safe primes, which are good for Diffie–Hellman, and they begin Cunningham chains.

Squarefree number

A number not divisible by any square above 1.

A squarefree number has no repeated prime factor: 30 = 2 × 3 × 5 is squarefree, 12 = 2² × 3 is not. Carmichael numbers must be squarefree.

Steganography

Hiding the very existence of a message, rather than scrambling it.

Steganography conceals that a message exists at all: invisible ink, a message in the low bits of an image, or a note in a hollow object. Encryption makes a message unreadable but visibly secret; steganography tries to avoid suspicion. The two combine well.

Stream cipher

A cipher that produces a keystream and combines it with the data a bit or byte at a time.

A stream cipher generates a long pseudorandom keystream from a key and a nonce, then combines it with the plaintext, usually with XOR. Decryption is the same operation. ChaCha20 and RC4 are stream ciphers, and AES in counter or OFB mode behaves like one. Reusing a key and nonce makes two messages share a keystream, which is disastrous.

Substitution cipher

A cipher that replaces each letter with another symbol according to a rule.

A substitution cipher swaps every plaintext letter for a different letter or symbol, leaving the order unchanged. The Caesar cipher is the simplest example; a keyword or mixed alphabet gives 26! possible keys, far too many to try, yet frequency analysis still solves it in minutes.

Sum of two squares

A number that can be written as a2 + b2.

Fermat showed that an odd prime is a sum of two squares exactly when it is 1 mod 4. A general number is a sum of two squares when every prime that is 3 mod 4 divides it to an even power. 25 = 3² + 4² = 0² + 5².

Symmetric encryption

Encryption where the same key locks and unlocks the data.

In symmetric encryption the sender and receiver share one secret key, which both encrypts and decrypts. It is fast, which is why it protects the bulk of data on the internet, from disks to web traffic. Its weakness is delivering the key to the other person without anyone else seeing it, the problem that public-key cryptography addresses. AES and ChaCha20 are symmetric ciphers.

T

Taxicab number

A number that is the sum of two cubes in two different ways, the smallest being 1,729.

Hardy visited Ramanujan in hospital and remarked that his taxi's number, 1729, was dull. Ramanujan replied that it is the smallest number expressible as the sum of two cubes in two ways: 1729 = 1³ + 12³ = 9³ + 10³.

TLS (HTTPS)

The protocol that encrypts the connection between your browser and a website.

Transport Layer Security is the protocol behind the padlock in the address bar. It authenticates the website with a certificate, agrees on session keys with a key exchange and then encrypts traffic with an AEAD cipher. TLS protects data in transit, but the site at the other end still sees what you send.

TOTP (time-based one-time password)

The six-digit codes that authenticator apps show, which change every 30 seconds.

TOTP (RFC 6238) computes a short code from a shared secret and the current time, using HMAC. Both your phone and the server know the secret, so both can compute the same code for the current 30-second window. Codes are single-use and expire quickly, which is the whole point.

Transposition cipher

A cipher that rearranges the letters of a message without changing them.

A transposition cipher keeps the letters but shuffles their positions, by a rule such as writing in a zigzag or reading down columns. Letter frequencies stay the same as in the plaintext, which is the giveaway that tells an analyst to try transposition and not substitution.

Trial division

Testing a number by dividing it by every prime up to its square root.

Trial division is the oldest primality test and factoring method: divide by 2, 3, 5 and so on up to the square root of n. It is fine for small numbers and hopeless for numbers with hundreds of digits, where faster methods are needed.

Twin prime

A prime that is 2 away from another prime, like 11 and 13.

Twin primes are pairs such as (3, 5), (11, 13) and (17, 19). Whether there are infinitely many is the twin prime conjecture, still open. In 2013 Yitang Zhang proved that infinitely many pairs of primes lie within a bounded distance, a breakthrough later improved to 246.

Two-factor authentication (2FA)

Logging in with two different kinds of proof, such as a password and a code.

Two-factor authentication asks for something you know (a password) and something you have (a phone or security key). Time-based one-time codes are the most common second factor. It protects against stolen passwords, though not against a fake site that asks for the code too.

U

Ulam spiral

A spiral of numbers on which the primes line up in diagonals.

In 1963 the mathematician Stanislaw Ulam, doodling in a boring meeting, wrote the whole numbers in a square spiral and circled the primes; they clustered along diagonals. The pattern comes from quadratic polynomials that produce many primes.

Unicode normalization

Converting text to one standard form so that identical-looking text is identical.

The same visible character can be written as different code points: “é” can be one character or an “e” plus an accent. Normalization (NFC is the usual form) picks one. cipher.ink normalizes passphrases to NFC before deriving a key, so a passphrase typed on a phone and a laptop produces the same key.

URL fragment

The part of a web address after the # sign, which browsers never send to the server.

The fragment is the text after # in a URL. The browser keeps it and does not include it in the request, so the server never sees it. cipher.ink puts the decryption key in the fragment of a link, which is why the server stores messages it cannot read.

V

Vigenère cipher

A polyalphabetic cipher that shifts each letter by the matching letter of a repeating keyword.

The Vigenère cipher adds a keyword, repeated along the message, to the plaintext letter by letter. It was called le chiffre indéchiffrable for about three centuries until Kasiski and Babbage showed how to break it. Its weakness is that the key repeats.

W

Web Crypto API

The cryptography built into web browsers, available to scripts.

The Web Crypto API (crypto.subtle) gives web pages fast, audited implementations of AES, RSA, hashing, HMAC and PBKDF2, with keys that can be marked non-extractable. cipher.ink uses it for everything instead of shipping its own cryptographic code.

X

X.509 certificate

A signed file that ties a public key to a name, such as a website.

An X.509 certificate contains a public key, the name it belongs to, a validity period and a signature by a certificate authority. Browsers use certificates to confirm they have reached the real website. They are normally stored as PEM text or DER bytes.

XOR (exclusive or)

A bit operation that is 1 when the two bits differ; applying it twice undoes it.

XOR compares two bits and gives 1 if they differ and 0 if they match. XOR with a key twice returns the original, which makes it the core of stream ciphers and the one-time pad. On its own with a short repeating key it is easy to break.

XSS (cross-site scripting)

An attack that gets a website to run an attacker's script in a visitor's browser.

Cross-site scripting happens when a site displays untrusted text as HTML and an attacker supplies a script. In a message service it matters a great deal, because a script in one message could try to read others. cipher.ink treats every message as hostile HTML: it is sanitized, and a content security policy blocks scripts anyway.

A

B

C

D

E

F

G

H

I

J

K

L

M

N

O

P

R

S

T

U

V

W

X

Keep going

Further reading