Ubuntu 26.04 and Rocky Linux 10.1 and later now negotiate a post-quantum key exchange with Cloudflare and Google by default. Almost none of the encryption books on sale were written for that. NIST published its first three post-quantum standards in August 2024, OpenSSL 3.5 added them in April 2025 and made the hybrid ML-KEM key exchange its default, and Let’s Encrypt has since shut down OCSP. So the best data encryption books in 2026 teach ideas that survive that shift, and one or two cover it directly.
Eight cryptography books made the cut, from first principles to TLS, OpenSSL, data privacy and post-quantum planning. You will also see what changed when we ran the books’ advice against a current OpenSSL. Prices come from Amazon’s catalog, and the lab commands below were run on Ubuntu 26.04 (OpenSSL 3.5.5) in October 2026, with the TLS, ML-DSA and AES-GCM checks repeated on Rocky Linux 10.2 (OpenSSL 3.5.8).
Pick a cryptography book by the job
Most readers need one book that explains the primitives and one that matches their daily work. Start with the job, because the best cryptography book for a developer wiring up AES-GCM is a poor pick for the admin who renews certificates or the CISO budgeting a post-quantum migration:
- Best overall: Serious Cryptography, 2nd Edition
- Best for developers: Real-World Cryptography
- Best textbook with post-quantum coverage: Understanding Cryptography, 2nd Edition
- Best for TLS and certificates: Bulletproof TLS and PKI, 2nd Edition
- Best for the OpenSSL command line: Demystifying Cryptography with OpenSSL 3.0
- Best for data privacy engineering: Practical Data Privacy
The other two are narrower. Becoming Quantum Safe is a migration playbook for the people who sign off on the budget, not for the engineers doing the work. Hacking Cryptography suits developers who learn faster by breaking a flawed implementation than by reading about a correct one. If you only buy one, buy Serious Cryptography, because it is the shortest route from “I use HTTPS” to knowing why AES-GCM, Ed25519 and TLS 1.3 are built the way they are.
Compare the eight encryption books
Read the post-quantum column first. Most of these books went to press before NIST finalized its standards in August 2024, and one targets an OpenSSL release that no longer gets free security fixes:
| Book | Publisher, year | Pages | Best for | Post-quantum coverage | Level |
|---|---|---|---|---|---|
| Serious Cryptography, 2nd Ed | No Starch, 2024 | 376 | How the primitives work and break | Full chapter | Beginner to intermediate |
| Real-World Cryptography | Manning, 2021 | 400 | Developers choosing the right tool | Overview, before the final standards | Beginner |
| Understanding Cryptography, 2nd Ed | Springer, 2024 | 564 | Self-study and university courses | Full chapter, written just before the final standards | Intermediate |
| Bulletproof TLS and PKI, 2nd Ed | Feisty Duck, 2022 | 512 | Admins running TLS and certificates | None | Intermediate |
| Demystifying Cryptography with OpenSSL 3.0 | Packt, 2022 | 342 | OpenSSL command line and C API | None (OpenSSL 3.0) | Intermediate |
| Practical Data Privacy | O’Reilly, 2023 | 344 | Anonymization and privacy tech in data work | Not the focus | Intermediate |
| Becoming Quantum Safe | Wiley, 2025 | 208 | Planning a post-quantum migration | The whole book | Non-technical |
| Hacking Cryptography | Manning, 2025 | 328 | Breaking flawed implementations in Go | Not the focus | Intermediate to advanced |
A missing post-quantum chapter does not sink a book. Symmetric encryption, hashing and TLS mechanics have not changed, and the hybrid key exchange in OpenSSL 3.5 still runs X25519 alongside ML-KEM. What has changed is the key exchange and signature layer, so pair one of the older picks with Serious Cryptography or Understanding Cryptography and you have covered it.
How we chose these books
We started from the publishers’ catalogs, not Amazon’s best-seller list, because a plain search for “cryptography” returns conference proceedings and a wave of self-published post-quantum titles long before it reaches a book you would learn from. The catalog pass covered No Starch, Manning, O’Reilly, Packt, Wiley, Apress, Springer and MIT Press. Every pick is a print edition, and every cover on this page matches the edition we link.
We did not read all eight cover to cover. Where we describe what a book covers, that comes from the publisher’s contents page, the author’s site or the code repository, and we say which. Several familiar titles were left out on purpose:
- Applied Cryptography, 20th Anniversary Edition (Wiley, 2015 reprint of the 1996 text, which predates AES)
- Cryptography Engineering (Wiley, 2010)
- Cryptography Algorithms, 2nd Edition (Packt, 2024), more theory than this list needs
- TLS Cryptography In-Depth (Packt, 2024, 712 pages), a thorough TLS 1.3 internals book that overlaps Bulletproof TLS and PKI
- Introduction to Modern Cryptography, revised third edition (CRC Press, 2025), Katz and Lindell’s proof-heavy graduate text
- Zero Trust Networks, Cloud Security Handbook and the Security+ study guide, now in our cybersecurity books list and Security+ book guide
Two more deserve a mention without a numbered section. The Joy of Cryptography by Mike Rosulek came out from MIT Press in January 2026 as a 702-page provable-security textbook. The full text is free to read at joyofcryptography.com under a Creative Commons license, so read it online before you pay the $85 list price for the hardcover. Packt’s Applied Cryptography using Python is due in November 2026, so check its contents once it ships.
1. Serious Cryptography, 2nd Edition
Jean-Philippe Aumasson co-designed BLAKE2 and SipHash, which No Starch’s author bio says run in every Linux system, and later BLAKE3. This second edition is the book we’d hand anyone who uses encryption at work and wants to understand it, because it explains each primitive with just enough math and then shows how real implementations got it wrong.
No Starch’s contents page runs 15 chapters in four parts: fundamentals and randomness, symmetric crypto (block and stream ciphers, hashes, keyed hashing, authenticated encryption), asymmetric crypto (RSA, Diffie-Hellman, elliptic curves) and applications. The applications part has a TLS chapter, a quantum and post-quantum chapter, and a new chapter on the cryptography inside cryptocurrencies. Each chapter ends with what can go wrong, which is the part most introductions skip.
It’s an explanation book, not a code book, so you will not find a lab to follow. The 2024 print run sits close to the August 2024 FIPS standards, so if the post-quantum chapter uses the Kyber and Dilithium names, read them as ML-KEM and ML-DSA, which is what OpenSSL calls them now. It cost about $43 against a $59.99 list price when we checked. Check the current price on Amazon.
2. Real-World Cryptography
David Wong is a cryptography engineer who contributes to internet standards, TLS among them, and he wrote this for developers and sysadmins who have to pick the right primitive without a math degree. Manning pitches it at cryptography beginners, and it earns that through diagrams rather than proofs.
Per Manning’s page, the book moves from building blocks such as hash functions and signatures to protocols such as HTTPS and secure messaging, then to user authentication, zero-knowledge proofs, hardware attacks, cryptocurrencies and post-quantum cryptography. Where Serious Cryptography explains how a primitive works, Wong spends more time on which one you should reach for and the bad practices to fix in code you inherit.
It came out in October 2021, nearly three years before NIST finalized ML-KEM and ML-DSA, so treat the post-quantum part as background and get the three families NIST was standardizing from Understanding Cryptography below. It ran about $56 when we checked. Check the current price on Amazon.
3. Understanding Cryptography, 2nd Edition
Paar and Pelzl’s 2010 textbook, now co-written with Tim Güneysu, has the most technical post-quantum coverage on this list. Springer’s page lists new chapters on SHA-3 and on post-quantum cryptography covering the three cipher families NIST was standardizing. The hardcover came out in May 2024, three months before the final FIPS documents, so if it uses the Kyber and Dilithium names, read them as ML-KEM and ML-DSA. It also lists up-to-date security parameters for every algorithm, which is what you want when someone asks how long an RSA key needs to be in 2026.
Ron Rivest wrote the foreword, and every chapter comes with a problem set and a further-reading discussion, so it works for self-study as well as a course. It’s a textbook in tone: you’ll learn how AES rounds or lattice schemes are built, but you will not type a single command. Expect more math than in the first two picks, kept as light as the subject allows.
The 2024 hardcover was sold by a third-party seller when we checked, at about $50 against a $79.99 list price, so check the seller and delivery date before you order. Check the current price on Amazon.
4. Bulletproof TLS and PKI, 2nd Edition
Ivan Ristić built SSL Labs, and this is still the book to read if you run web servers and want to know what your TLS configuration actually does. The second edition adds a new TLS 1.3 chapter and a rewritten configuration chapter, and OpenSSL developer Matt Caswell was one of its two technical reviewers.
Feisty Duck’s chapter list covers TLS 1.3 and 1.2, Internet PKI with Certificate Transparency, every major CA compromise, the protocol attacks from BEAST and POODLE to ROBOT and Raccoon, and then performance and deployment. That attack history is why it ages well: you learn why a setting exists, not only which value to type. Our guides on issuing Let’s Encrypt certificates and checking certificate expiry with OpenSSL pair well with the deployment chapters.
The text was last updated in January 2022, before post-quantum key exchange reached the TLS libraries you run. Its OCSP stapling material has also aged, because Let’s Encrypt removed OCSP URLs from its certificates in May 2025 and shut down its responders in August 2025. The paperback was about $69 and shipped by Amazon when we checked. Check the current price on Amazon.
5. Demystifying Cryptography with OpenSSL 3.0
Alexei Khlebnikov wrote the most hands-on book here for anyone who lives in the openssl command. Packt’s code repository says it teaches sysadmins and DevOps engineers to handle keys and certificates on the command line and to run a mini certificate authority. Developers get the C API, with every code example written in C.
Read the errata in that repository before you copy commands. The signature verification command on page 128 should load the public key with -pubin -inkey ec_public_key.pem, and the openssl ca call on page 302 needs -extensions v3_ocsp_cert, or the OCSP responder certificate comes out wrong. If you’d rather start with a smaller local CA, our mkcert guide gets you trusted development certificates in minutes.
The bigger catch is the version. OpenSSL 3.0 is no longer supported by the OpenSSL project, and the ML-KEM, ML-DSA and SLH-DSA algorithms only arrived in 3.5, so nothing here covers them. OpenSSL guarantees API and ABI compatibility within the 3.x series, so the book’s C examples should still build against the 3.5 that Ubuntu 26.04 and Rocky Linux 10.1 and later ship. The paperback was about $44 and in stock when we checked. Check the current price on Amazon.
6. Practical Data Privacy
Katharine Jarmul has worked on privacy in machine learning and data systems since 2017, and her book covers the data protection side that pure cryptography books skip. Data teams that hold personal data need to know what “anonymized” really means before a regulator asks, and encryption at rest doesn’t answer that question.
According to the book’s own site, it works through what GDPR and CCPA mean for data workflows, how to actually anonymize data, differential privacy, federated learning and analysis, and whether homomorphic and other encrypted computation is ready for production. The companion notebooks on GitHub follow the chapters, but they assume a data science background, and some later notebooks need Apache Spark and Rust-based libraries with conflicting requirements, so plan on separate virtual environments.
It is the wrong book if your data protection job is disks and keys rather than datasets. For that side, our guides to LUKS disk encryption with cryptsetup and running a HashiCorp Vault server cover encryption at rest and key storage. The paperback was about $38 and sold by Amazon when we checked. Check the current price on Amazon.
7. Becoming Quantum Safe
Jai Singh Arun, Ray Harishankar and Walid Rjaibi wrote the post-quantum book for the people who own the migration plan rather than the code. Wiley pitches it at CISOs, CTOs and security leaders, and Whitfield Diffie, co-inventor of public key cryptography, wrote the foreword.
Wiley’s description covers how Shor’s and Grover’s algorithms threaten RSA and ECC, what crypto-agility means in an enterprise, a step-by-step roadmap from classical to quantum-safe cryptography, and case studies from banking, government, telecoms, healthcare and retail. At 208 pages it is the shortest book here, and you can read it in a weekend before a planning meeting.
Engineers will find it thin, because it has no math and no commands. If you run the servers, our post-quantum SSH hardening guide for Ubuntu 26.04 is the practical half of the same migration. The September 2025 hardcover was about $32 from a third-party seller when we checked. Check the current price on Amazon.
8. Hacking Cryptography
Kamran Khan and Bill Cox take the opposite route to every other book here: they implement cryptography badly on purpose, then break it. Cox has spent nearly forty years securing hardware and software and runs a crypto-writing workshop at Google, and Khan has a decade at Salesforce, Google and Microsoft behind him.
Manning’s page lists the attacks you build and then break:
- backdoored constants in DUAL_EC_DRBG
- RC4 as used in WEP
- padding oracles and IV manipulation in block ciphers
- hash length extension and rainbow tables
- the Wiener attack on RSA keys with short private exponents
- Bleichenbacher’s PKCS#1 v1.5 signature forgery
The examples are in Go, so you will read faster if you know it. The Sony PlayStation 3 root key compromise shows up as a case study: Sony’s ECDSA signer used the same nonce for every signature instead of a fresh one, which let attackers solve for the private signing key.
Read it second, after Serious Cryptography or Real-World Cryptography, because it assumes you know what a padding scheme is for. The 2025 paperback was about $51 from a third-party seller when we checked. Check the current price on Amazon.
Test what changed since these books were printed
All but one of the eight books went to press before OpenSSL 3.5, so we ran their assumptions against the OpenSSL that Ubuntu 26.04 ships today. The TLS group, the ML-DSA signature and the AES-GCM refusal gave the same result on Rocky Linux 10.2; the key sizes and the key derivation checks were captured on Ubuntu only.
Start with the key exchange. A plain TLS connection from a stock Ubuntu 26.04 box shows which group the handshake negotiated:
openssl s_client -connect cloudflare.com:443 -servername cloudflare.com -brief < /dev/null 2>&1 | grep -E "Protocol|Ciphersuite|Verification|group"The last line is the post-quantum part. X25519MLKEM768 is a hybrid that runs classic X25519 and ML-KEM-768 together, and OpenSSL 3.5 offers it first by default, so no configuration was needed:
Protocol version: TLSv1.3
Ciphersuite: TLS_AES_256_GCM_SHA384
Verification: OK
Negotiated TLS1.3 group: X25519MLKEM768Google’s front end negotiated the same group, and so did Rocky Linux 10.2 with its DEFAULT crypto policy. On Rocky and RHEL 10.0 the post-quantum algorithms were only a Technology Preview, so this needs 10.1 or later. None of the TLS books on this list describe that handshake, but the symmetric half (TLS_AES_256_GCM_SHA384) is exactly what they teach. Signatures are the other change. OpenSSL 3.5 can now generate an ML-DSA key and sign a test file with it:
echo "quarterly payroll export" > msg.txt
openssl genpkey -algorithm ML-DSA-65 -out mldsa65.pem
openssl pkeyutl -sign -rawin -inkey mldsa65.pem -in msg.txt -out msg.mldsa.sig
openssl pkeyutl -verify -rawin -inkey mldsa65.pem -in msg.txt -sigfile msg.mldsa.sigThe verify step should confirm the signature:
Signature Verified SuccessfullyFor comparison, sign the same 25-byte file with Ed25519:
openssl genpkey -algorithm ED25519 -out ed25519.pem
openssl pkeyutl -sign -rawin -inkey ed25519.pem -in msg.txt -out msg.ed.sigThe sizes explain why the migration is harder than swapping an algorithm name. These are the byte counts from our Ubuntu run:
| Algorithm | Signature size | Public key size (DER) |
|---|---|---|
| Ed25519 | 64 bytes | 44 bytes |
| ML-DSA-65 | 3,309 bytes | 1,974 bytes |
An ML-DSA-65 signature is about 52 times larger than an Ed25519 one, and every certificate in a chain carries a public key and a signature. That’s one reason the web moved key exchange to hybrid ML-KEM first and left certificate signatures classical for now. The bigger one is harvest now, decrypt later: traffic recorded today can be decrypted once a large quantum computer exists, while a signature only has to hold at the moment it is checked, and it’s the kind of staged change Becoming Quantum Safe means by crypto-agility.
Error: “enc: AEAD ciphers not supported”
Every primitives book here tells you to prefer authenticated encryption such as AES-GCM, so the natural move is to try it with openssl enc. On Ubuntu 26.04 and Rocky Linux 10.2 that fails before it reads the file:
openssl enc -aes-256-gcm -pbkdf2 -in msg.txt -out msg.gcm -pass pass:Lab2026demoThe command exits with status 1 and this message:
enc: AEAD ciphers not supported
enc: Use -help for summary.The enc tool has no way to store a GCM authentication tag, so it refuses AEAD modes outright. Use it with CBC and a proper key derivation as shown next, or use a tool built for file encryption such as GnuPG or age when you need authenticated encryption on the command line.
Warning: “deprecated key derivation used”
Older tutorials and book examples pass a password to openssl enc without a key derivation option. It still works, but OpenSSL warns that the key came from one fast SHA-256 round through EVP_BytesToKey:
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.Add -pbkdf2 with a high iteration count, and pass the same options when you decrypt, because the iteration count is not stored in the file:
openssl enc -aes-256-cbc -salt -pbkdf2 -iter 600000 -in msg.txt -out msg.enc -pass pass:Lab2026demo
openssl enc -d -aes-256-cbc -pbkdf2 -iter 600000 -in msg.enc -pass pass:Lab2026demoThe decrypt prints the original text with no warning, which is your sign that both sides agreed on the derivation. When we decrypted on Ubuntu with -iter 10000, OpenSSL wrote a few bytes of garbage and printed “bad decrypt”. Don’t rely on that error, though: about one wrong key in 256 happens to pass the CBC padding check, and then you get garbage and a clean exit, which is another reason to reach for age or GnuPG. Run the same s_client check against your own servers too. If the group comes back as plain X25519, the server side is not offering ML-KEM: its TLS library, a pinned ssl_ecdh_curve or Groups setting (Mozilla’s intermediate config only added X25519MLKEM768 in guidelines 6.0), or the load balancer or CDN that terminates TLS in front of it.
