Skip to content

Roadmap

Level: reference

What is written, what is a stub, and what is next.

The library was started on 2026-09-07 with the full chapter spine and every planned page's permanent URL in place, and two lessons actually written. That order is deliberate: a plan with a shape is worth more than three finished pages and no map, and a folder name is a URL that must not move later.

Status

Page Status
Breaking a cipher by counting written, 2026-09-07 — Python; 26! keys broken without trying one, and the program catches its own frequency guess being wrong and corrects it from a crib
A hash is not encryption written, 2026-09-07 — Python and shell; digests checked against NIST vectors in the program, and every openssl line verified byte-identical under LibreSSL and OpenSSL 3
Every other page listed in a chapter README stub — the questions are written down, no example behind it yet

What is next, in order

  1. What a key is and Kerckhoffs's principle — chapter 1 is the vocabulary every later page uses, and it is currently the only chapter with nothing written. The key/nonce/salt/seed distinction is checkpoint 1 and is where most confusion actually lives.
  2. random is not secrets — pure stdlib, high practical value, and it is the prerequisite for every key that appears later.
  3. HMAC, and comparing in constant time — completes checkpoint 2, and the length-extension demonstration is a genuinely good twenty-line program.
  4. ECB leaks the picture — the most convincing image in the subject, and it is one openssl enc over a PPM.
  5. Diffie–Hellman by hand — checkpoint 3, and pow(g, a, p) is the whole implementation.

Things known to be missing

  • No diagrams yet. A handshake and a block-cipher mode both want one; the site renders Mermaid natively (see mkdocs.yml).
  • No Rust examples yet. Rust's job in this library is the byte-level and type-level view — fixed-size arrays, what a constant-time comparison must avoid — and no page has needed it so far.
  • Chapter 11's SAP page needs a real system to check against. Everything on it will be prose until then, and marked as such.
  • The examples CI job has never yet failed on a platform split, because only one shell example exists. That is not evidence the guard works; see the note in CONTRIBUTING.md.

See also