Measuring Human Cryptanalysis Effort
A new site by Matthew Green attempts to quantify the cryptanalysis effort spent on various public-key algorithms, using published academic literature as its primary data source.
Intelligence analysis by Gemini 2.5 Flash
The study estimates cryptanalyst-hours by analyzing sixteen thousand papers on algorithms like ECDLP and lattices, converting publications into research-allocation years. Notably, it finds that lattices have recently surpassed elliptic curves in cumulative cryptanalysis, though the methodology, which relies heavily on AI models, comes with significant caveats regarding unpublished wor…
Imagine secret codes are like super tricky puzzles. This story is about a new way to count how many smart people have tried to solve different kinds of these puzzles over many years. It uses special computer programs, like super-smart robots, to read thousands of reports about puzzle-solving. It found that one type of puzzle, called 'lattices,' recently got more attention than another, 'elliptic curves.' But it only counts the puzzles people wrote reports about, not the secret ones!
Analysis
Matthew Green's new project introduces a pioneering approach to quantifying the cryptanalytic effort dedicated to public-key algorithms. By leveraging a vast corpus of academic literature, specifically sixteen thousand candidate papers, the study aims to provide a cumulative measure of research allocation. This involves classifying work on various cryptographic assumptions, including Elliptic Curve Discrete Logarithm Problem (ECDLP), structured and plain lattices, and syndrome decoding. The methodology then translates these classified papers into estimated research-allocation years, using a person-level author map to infer the time commitment.
Matthew Green's Methodology
Green's study represents a significant first step in developing a metric for cryptanalysis effort, offering a quantitative lens through which to view the security landscape. However, the analysis is accompanied by crucial caveats that temper its conclusions. The primary limitation is its exclusive reliance on published work, meaning any cryptanalysis conducted by intelligence agencies or academic research that did not result in a formal publication is not included. This omission could lead to a substantial overestimation or underestimation of actual time spent, as secret efforts might significantly alter the true distribution of cryptanalytic attention across different algorithms.
AI Models' Contribution
A notable aspect of this research is the extensive involvement of artificial intelligence. The study's pipeline, analysis, and even the generation of the explanatory page were built and executed by advanced AI models, specifically Claude Fable 5.1, Claude Opus 5.5, and GPT-6 Astra. Matthew Green's role was to define the questions, make key methodological decisions, and oversee the overall work. This reliance on AI has sparked discussion, with commentators raising valid concerns about the accuracy and reliability of AI-generated analysis, particularly given the inherent non-deterministic nature of large language models. The debate highlights the ongoing challenge of integrating AI into rigorous scientific research, where transparency and verifiable accuracy are paramount.
Cryptanalysis Trends
The study's findings reveal an interesting shift in the focus of cryptanalytic effort. Historically, elliptic curves have been a dominant area of research, but the analysis indicates that lattices have only recently surpassed elliptic curves in terms of cumulative cryptanalysis effort. This historical perspective, expressed as inference budgets under stated productivity assumptions, provides valuable insight into the evolving priorities within the cryptographic research community. Such trends are critical for understanding the long-term security posture of different cryptographic primitives, especially as the industry anticipates the advent of quantum computing and the need for post-quantum cryptography, where lattice-based schemes are prominent candidates.
Key points
- Matthew Green's new site estimates cryptanalyst-hours spent on public-key algorithms using academic literature.
- The study analyzed sixteen thousand papers on ECDLP, lattices, and syndrome decoding.
- Lattices have recently overtaken elliptic curves in cumulative cryptanalysis effort, according to the findings.
- The analysis was primarily conducted by AI models, including Claude Fable 5.1, Claude Opus 5.5, and GPT-6 Astra.
- Key caveats include the exclusion of unpublished academic and intelligence agency cryptanalysis.
This new metric could provide valuable insights for cryptographic researchers and developers, helping them allocate resources more effectively by identifying algorithms that have received less scrutiny. The use of AI in such a large-scale analysis also demonstrates a potential path for accelerating complex research tasks in the future.
The study's reliance solely on published work means it overlooks significant cryptanalytic efforts by intelligence agencies or unpublicized academic research, potentially leading to a skewed understanding of actual security strengths. Furthermore, concerns about the accuracy and oversight of AI-conducted analysis could undermine the credibility and utility of the findings.
