August 2024
These lectures describe Kyber (ML-KEM) and Dilithium (ML-DSA), the quantum-safe lattice-based key encapsulation and signature schemes that were recently standardized by the National Institute of Standards and Technology (NIST).
Learning outcomes
On successful completion of this course, students will be able to:
- Understand how the Kyber public-key encryption scheme and Kyber key encapsulation mechanism work.
- Understand how the Dilithium signature scheme works.
- Appreciate the many optimizations that were incorporated to facilitate fast implementations, and to reduce key sizes, ciphertext sizes, and signature signatures.
- Read the FIPS 203 and FIPS 204 standards and fully understand them, including the technical details that were omitted from the lectures.
Note to instructors
If you are teaching a course in applied cryptography and would like to use my video lectures as a secondary source or a primary source, please send me an email message. I will be happy to arrange a meeting with you, to tell you about my experience teaching applied cryptography over the past 30 years, and we can have a discussion about the curriculum, exercises, projects, and tests for your course. If you use any of the resources (videos or slides) on this web page in your classes, please do provide your students a link to my page (cryptography101.ca).
Bilibili lectures
Full Playlist (thanks to Zijie Lu and Brandon Shi for uploading the videos to Bilibili)
YouTube Lectures
V1: Introduction
V2: The Kyber PKE and KEM
- V2a: Kyber-PKE (simplified)
- V2b: Optimizations
- V2c: Kyber-PKE (full scheme)
- V2d: Kyber KEM
V3: The Dilithium signature scheme
- V3a: Dilithium (toy version)
- V3b: Dilithium (without t compression)
- V3c: Dilithium t compression
- V3d: Dilithium (full scheme)
V4: Number-Theoretic Transform (NTT)
- V4a: Dilithium NTT
- V4b: Kyber NTT
Additional Material
Errata (last updated: Jan 7, 2026)
Here is a list of errors in the video lectures. These errors have already been corrected in the lecture slides (available below).
- Slide 29 (V1b): a*b^T should be a^T*b
- Slide 36 (V1b): a*b^T should be a^T*b
- Slide 48 (V2a): e is selected from S_{\eta_1}^k (not from S_{\eta_2}^k)
- Slide 51 (V2a): add (q/2)*m to the figure
- Slide 53 (V2a): replace |E_i| by ||E_i||_{\infty} (two occurrences)
- Slide 59 (V2b): “Decompress” is missing “,10”
- Slide 60 (V2b): last line: -59x^2 should be -49x^2
- Slide 65 (V2c): e is selected from S_{\eta_1}^k (not from S_{\eta_2}^k)
- Slide 90 (V3a): “Alice’s signing key” should be “Alice’s verification key”
- Slide: 93 (V3a): “make” –> “makes”
- Slide 104 (V3b): Item 5: c_1 should be c
- Slide 108 (V3b): I deleted the intermediate matrix in the calculation of z = y + c*s1
- Slide 112 (V3b): I deleted “transpose” on y and b in I-MSIS and MSIS statements
- Slide 156 (V4a): The NTT^{-1} operations require kn\log n multiplications (not \ell n \log n multiplications)
- Slide 169 (V4b): “integers modulo 256″ should be ‘integers modulo 3329”
- Slide 170 (V4b): e is selected from S_{\eta_1}^k (not from S_{\eta_2}^k)