The Joy of Cryptography is a textbook for an undergraduate course in cryptography.
The pedagogical approach is anchored in formal definitions/proof of security, but in a way that I believe is more accessible than what is "traditional" in crypto. All security definitions are written in a unified and simplified "game-based" style. For an example of what security definitions look like in this style, see the index of security definitions (which will make more sense after reading chapters 2 & 4). For example proofs of security in this style, see the supplementary material below.
It is published under a Creative Commons license and is available for free on the author's website.
I read the "draft January 2021" version of this book, so the state that I am reviewing here may not be the final one. The preface immediately takes the promise if the title back: The way towards having joy with provable security may be thorny and not a joy for everyone. The review of required math in chapter 0 of the book is a good refreshment before starting, but it may not be sufficient if you need anything more than just a refreshment of prior knowledge, i.e.: Don't expect a full introduction to the mathematical foundations of cryptography. The type of proofs used in this book on provable security is quite natural for anybody coming from IT / computer science: The author calls them hybrid proofs and are made up from pseudo-code. As somebody who can (mostly) understand formal proofs but could hardly produce any myself, this was an interesting new concept. Though I didn't actually try to solve too many of the many exercises incorporated into this book, I do have the feeling, that I could cope with this type of proof more easily than with purely mathematical proofs (where I struggle mostly with coming up with a strategy, i. e. with deciding if I should try induction, counter-statement, etc.). The book covers the classical content of symmetric and public key cryptography and nothing beyond that, which is fine, as this textbook is intended for introductory college classes. It does that well, especially for those who feel comfortable with the hybrid proof strategy mentioned above. A good introduction for people interested in the formal design of crytographic procedures.
Really really enjoyed this. I'm not putting an end date on it because I didn't read it properly through per-se, but I read all the relevant sections in preparation for my Final Year Project and found it both really useful and also fascinating in-and-of itself, so might come back to it over the summer, and complete the extra exercise I hadn't finished as well. Rosulek does a fantastic job of introducing the reader to the field of theoretical cryptography --- I read this mostly over the summer (so, entirely self-study), and didn't feel the great loss of a teacher/similar to work it through with me. It's a good overview, the exercises are useful to actually sink your teeth into the topics, and I though Rosulek was really quite funny to boot. If you're interested in the field, would recommend. Will definitely help you to feel the joy!