Classical Crypto Today

Changelog

Every update, in order

This site changes often — new modules, new Playground tools, corrections to existing content. Nothing changes silently: every dated entry below corresponds to a real, published commit.

2026-10-01

A new Foundations Learn module: Entropy

  • Added a new Foundations Learn module, Entropy: measuring, estimating, and testing true randomness — min-entropy vs. Shannon entropy, how NIST SP 800-90B actually tests an entropy source, true random number generators and why their raw output still needs conditioning, /dev/random vs. /dev/urandom and boot-time entropy starvation, and measuring Diceware passphrase strength — with 2 practice problems, an advanced deep-dive section, and a 10-question quiz
  • Linked the Entropy Testing Playground tool to this new module instead of Random Number Generation, now that there's a module focused specifically on entropy measurement
  • Added a Randomness & entropy section to the Library: NIST SP 800-90B, NIST SP 800-90A Rev. 1, the “Mining Your Ps and Qs” weak-keys paper, and the ANU Quantum Random Numbers Server
  • Added 4 new Glossary terms — Diceware, Min-entropy, NIST SP 800-90B, and TRNG — and expanded the existing Entropy definition to mention min-entropy
  • The Navigate graph, sitemap, site-wide search, and the Assess checklist all picked up the new module automatically, since each is generated directly from the module catalog

2026-10-01

Entropy Testing Playground tool: manual entry vs. live quantum-random

  • Added an Entropy Testing Playground tool: type in a bit string by hand, or fetch live bits from the ANU Quantum Random Numbers Server, and see Shannon entropy alongside three real NIST SP 800-90B non-IID min-entropy estimators — Most Common Value, Collision, and Markov — ported directly from NIST's own reference implementation
  • Added the site's first API route (/api/qrandom) to proxy the ANU QRNG service server-side, since it sends no CORS headers and a direct browser call is rejected outright
  • Extended the Playground index page's honesty note to flag this tool's two distinct caveats: a live third-party network dependency, and a partial (3 of 10) implementation of NIST SP 800-90B's non-IID estimator suite

2026-10-01

3DS/tokenization tools, and Standards/Glossary/Library/Changelog catch-up

  • Added two more Payments Playground tools: a 3DS message flow & JWS signing simulator (a real EMV 3DS 2.x AReq/ARes exchange, signed with genuine ECDSA via Web Crypto) and a network tokenization tool (domain-bound token generation, a simulated token vault, and a rejection demo for a cross-merchant token replay)
  • Added an illustrative CAVV generator, explicitly banner-labeled as a representative construction rather than a real algorithm, since no card network has ever published its actual CAVV method
  • Tightened the Playground index page's honesty note into three explicit tiers: tools using real Web Crypto, tools implementing real published standards on the from-scratch 3DES core, and the two tools (CAVV, token cryptogram) flagged as illustrative because no public algorithm exists
  • Added a new Standards page entry for EMVCo & PCI SSC — how chip, 3DS, and tokenization specs actually get made, why CAVV generation is deliberately left unpublished, and how PCI DSS/PIN Security compliance is enforced through card-network contracts rather than government law — plus a 10-question quiz
  • Added 13 new Glossary terms covering the Payments chapter: ARQC/ARPC, CAVV, CVV/CVC, EMVCo, ICC Master Key, ISO 9564, the Luhn algorithm, network tokenization, PAN, PCI DSS, PIN block, Token Requestor ID, and TPK/ZPK
  • Added a Payments & card security section to the Library: ISO 9564-1, the EMV Book 1–4 and 3-D Secure specifications, the EMVCo tokenisation specification, PCI DSS, PCI PIN Security Requirements, and FIPS 46-3 (DES)

2026-09-30

Playground “under the hood” completed, and a full Payments chapter

  • Finished adding real Web Crypto commands to every remaining Playground tool's how-it-works page — AES-GCM, SHA-256, HMAC, RSA-OAEP, ECDSA, ECDH, TLS key schedule, JWT, PBKDF2, envelope encryption, certificate chain builder, certificate revocation, PKCS#11 session, and X3DH — so all 14 original tools now show the actual API calls behind each step, not just prose
  • Added a live dual-console protocol log (client/server message trace) to the TLS key schedule tool
  • Added Subject/Authority Key ID (SKI/AKI) and whole-certificate fingerprint detail, with a chain-match indicator, to both the certificate chain builder and certificate revocation tools
  • Made how-it-works code blocks horizontally resizable and widened their default width for legibility
  • Shipped a new Payments use-case category with four pages: PIN block encryption & translation, CVV/CVC generation & verification, EMV ARQC/ARPC card authentication, and 3-D Secure/tokenization — each with practice problems and a 5-question quiz
  • Built a from-scratch, FIPS-46-verified DES/3DES implementation (src/lib/des.ts) specifically because Web Crypto has no DES/3DES support, and three Payments Playground tools on top of it: a PIN block builder & translator, a CVV/CVC calculator, and an EMV ARQC/ARPC simulator
  • Updated the Playground index page and site footer to flag the Payments tools' one real exception to “nothing simulated” honestly, rather than leaving the old blanket Web Crypto claim standing

2026-09-25

Challenges, site-wide search, and a new Use Cases section

  • Added a new Standards section covering the standardization bodies themselves — NIST, the IETF, ISO/IEC, and OASIS — how each actually works, what it's published, and a real reference for every claim; includes diagrams, practice problems, and a 10-question quiz per body (no Playground, by design)
  • Added a Quizzes page listing every knowledge check on the site in one place, linked from the left navigation; fixed Use Case pages missing a "Try it yourself" link to their related Playground tool, and filled in Use Cases, Challenges, and their quizzes on the sitemap
  • Added a PKCS use case: an overview of the PKCS standards family plus an in-depth look at PKCS#11 (Cryptoki) — object attributes, the wrap-then-decrypt API attack, a real-key Playground tool, and a hands-on Challenges puzzle exploiting the same attack
  • Launched a Challenges section: 16 hands-on CTF-style puzzles across Warm-up, Classical Ciphers, Symmetric-key, RSA, and Diffie-Hellman/ECC, each checked entirely in the browser with hints, a points total, and local-only progress tracking
  • Added a site-wide search: a ⌘K/Ctrl+K command palette indexing every module, use case, playground tool, glossary term, and now challenge
  • Fixed the Navigate graph erroring with "This page couldn't load" when panning on Chrome, Firefox, and Edge — a browser swipe-navigation gesture conflict
  • Added a link to About in the left navigation
  • Added three real-cryptography Playground tools: a TLS key schedule walkthrough, KMS envelope encryption, and certificate revocation checking
  • Expanded the TLS and JWT Learn modules with session resumption, 0-RTT trade-offs, SNI/ECH, revocation and refresh tokens, JWKS, and the "alg: none" attack
  • Added a new top-level Use Cases section covering KMS envelope encryption, key wrapping & exchange, PKI in production, and federated identity (OAuth2/OIDC/SAML) — each with a 10-question quiz

2026-09-24

Breadth, new sections, and a full quiz bank

  • Added a Disclaimer, Data Privacy section, Software Bill of Materials, dual MIT/CC BY-NC-ND license, a curated Further Reading list, and this Changelog to the About page
  • Added a CI workflow that lints, builds, and audits dependencies on every push
  • Expanded every module's knowledge check from 3 to 10 questions — 210 questions total
  • Added an About page and a manual light/dark theme toggle
  • Added a breadcrumb navigation banner, a References page, and a "Navigate" force-directed knowledge graph
  • Dropped the "MVP build" label; added a sitemap, robots.txt, a dynamic OG image, and Vercel Analytics
  • Added the first knowledge-check quiz bank (3 questions per module)
  • Added Glossary, Compare, and Migration Checklist sections
  • Added illustrated diagrams for hash chains, blockchain hash-chains, certificate chains, and X3DH/Double Ratchet
  • Added three new Playground tools: PBKDF2, a certificate chain builder, and an X3DH simulator
  • Added a History & Purpose of Cryptography module and substantially expanded the math foundations module

2026-09-23

The Playground, and illustrated diagrams everywhere

  • Replaced schematic SVG diagrams with true illustrated ones (GCM, OAEP, cipher wheel, modular clock, timeline, swimlane, pipeline)
  • Added a "how it works" sister page to every Playground tool, with real formulas and diagrams
  • Added wrong-key demonstrations to the RSA-OAEP, ECDSA, and ECDH Playground tools
  • Launched the Playground — real cryptography running in the browser via the Web Crypto API
  • Fixed the elliptic-curve point-addition diagram twice over, rebuilding it on a real curve with numerically verified coordinates after it didn't actually pass through Q
  • Tripled the depth of the core protocol modules (RSA, ECC, AES, hashing, TLS, etc.)
  • Added formulas and diagrams across all 20 Learn modules
  • Replaced the top navigation with a collapsible left sidebar

2026-09-22

Launch

  • Redesigned Explore as a categorized glossary
  • Expanded the catalog to 20 modules and shipped the Assess quiz
  • Shipped the MVP: a persona picker and 8 content modules

Generated from this project's own git history — see the full commit log ↗ for exact diffs.