This is a fantastic writeup covering a large amount of cryptography, both in and outside the context of the web.  Reading about all of this summarized in a practical context including all of the real-world nasties like ARP spoofing is both great, and double-great for getting a feel about why utterances like &quot;hm, this <i>should</i> be okay given <i>this</i> circumstance&quot; should always put fear in your heart when talking about security.<p>Also, wow, I&#x27;d never seen that link to The Cryptographic Doom principle before, despite trying to elucidate that concept before myself (badly).  That&#x27;s a fantastic bookmark to keep for inclusion in explanations on tickets filed against dubious crypto.<p>Likewise, this link is going in my bookmarks for immediate deployment when I need a litany of padding oracles and timing attacks to explain why indistinguishability is essential to a friend.  Thanks, author!