Full Report
Matthew Green has a new site that tries to estimate the number of cryptanalyst-hours that have been spent analyzing different public-key algorithms: Abstract: We estimate how much public cryptanalysis each public-key assumption has received, using the literature itself as the instrument. From roughly sixteen thousand candidate papers we classify cryptanalytic work on ECDLP, structured and plain lattices, syndrome decoding and their comparators, then convert papers into estimated research-allocation years through a person-level author map. These publication-based estimates may substantially overstate actual time spent. Lattices have overtaken elliptic curves in this cumulative measure only recently; we express that history as inference budgets under stated productivity assumptions. The study was conducted by AI models: Claude Fable 5.1 and Claude Opus 5.5 built the pipeline, ran the analysis and wrote this page, with contributions from GPT-6 Astra. Matthew Green set the questions, made the key methodological decisions and oversaw the work...
Analysis Summary
# Research: Estimates of Public Cryptanalysis Effort for Public-Key Assumptions
## Metadata
- **Authors:** Matthew Green (Overseer/Methodology), Claude Fable 5.1, Claude Opus 5.5, GPT-6 Astra (Execution/Writing)
- **Institution:** Johns Hopkins University (implied by Matthew Green's affiliation)
- **Publication:** Independent research site / Matthew Green’s technical blog
- **Date:** May 2024 (Approximate, based on model versions referenced)
## Abstract
This study provides a quantitative estimate of the global human effort invested in the cryptanalysis of major public-key mathematical assumptions. By analyzing approximately 16,000 research papers, the project classifies work related to Elliptic Curve Discrete Logarithm Problems (ECDLP), lattices (plain and structured), and syndrome decoding. The study converts publication data into "cryptanalyst-hours" using a person-level author map to determine how much scrutiny each primitive has received over time.
## Research Objective
The research addresses a fundamental question in post-quantum cryptography (PQC) and classical security: **How "mature" is the cryptanalysis of a specific mathematical primitive?** Security is often an empirical measure of failed attacks; this study seeks to quantify that "effort of failure" to compare the relative confidence levels of classical (ECC) versus post-quantum (Lattice-based) algorithms.
## Methodology
### Approach
The study employs a bibliometric pipeline to map the cryptanalytic landscape:
1. **Classification:** Categorizing papers based on the specific mathematical hard problem they target.
2. **Author Mapping:** Tracking individual researchers across publications to estimate sustained effort.
3. **Labor Conversion:** Converting raw publication counts into "research-allocation years" based on productivity assumptions and the duration of an author's activity in a specific sub-field.
### Dataset/Environment
- A corpus of roughly **16,000 candidate academic papers** sourced from cryptographic literature (e.g., IACR Cryptology ePrint Archive, Eurocrypt, Crypto).
### Tools & Technologies
- **Large Language Models (LLMs):** Claude Fable 5.1 and Claude Opus 5.5 were used to build the data pipeline, perform the classification analysis, and generate the final reporting.
- **Inference Budgets:** Mathematical models used to express the history of cryptanalytic scrutiny under stated productivity assumptions.
## Key Findings
### Primary Results
1. **Lattice Dominance:** Public cryptanalysis effort for lattice-based cryptography has only recently overtaken the cumulative effort spent on Elliptic Curve cryptography.
2. **Effort Distribution:** The study identifies a significant shift in academic focus toward Post-Quantum Cryptography (PQC) primitives over the last decade.
3. **Syndrome Decoding Lags:** Compared to lattices and ECDLP, syndrome decoding (the basis for code-based cryptography) has received relatively less cumulative public cryptanalytic attention.
### Supporting Evidence
- The conversion of 16,000 papers into a person-level map provides a longitudinal view of how many "brains" have been focused on specific problems at any given year.
### Novel Contributions
- **AI-Driven Meta-Analysis:** One of the first large-scale cryptographic meta-analyses where the pipeline construction and data synthesis were primarily executed by advanced LLMs.
- **Labor-Hour Metric:** Moving beyond simple paper counts to a more nuanced "cryptanalyst-hour" metric.
## Technical Details
The study distinguishes between **Plain Lattices** and **Structured Lattices** (such as those used in Kyber/ML-KEM). This is a critical distinction, as structured lattices offer better performance but have faced theoretical concerns regarding whether their additional structure introduces vulnerabilities. The data tracks whether cryptanalytic effort is keeping pace with the deployment of these structured primitives.
## Practical Implications
### For Security Practitioners
- Provides a data-driven justification for the "maturity" of PQC. If lattices have received as much scrutiny as ECC, it bolsters confidence in migrating to ML-KEM.
### For Defenders
- Helps in risk assessment when choosing between different NIST PQC finalists by comparing the "attack-tested" status of each algorithm.
### For Researchers
- Highlights "under-studied" areas (e.g., syndrome decoding) where more cryptanalysis is needed to reach the same level of confidence as ECC or Lattices.
## Limitations
- **Public Bias:** The study only counts published academic work. It cannot account for "classified" cryptanalysis by state actors (e.g., NSA, GCHQ).
- **Overstatement Risk:** Publication-based estimates may overstate actual time spent, as not all papers represent the same level of depth or breakthrough.
- **Success vs. Effort:** High effort does not guarantee a primitive is secure; it only means it has been heavily tested.
## Comparison to Prior Work
Unlike traditional surveys that qualitatively describe attacks, this work is **quantitative and bibliometric**. It treats the entire body of cryptographic literature as a sensor to measure the "hardness" of a problem via the proxy of failed academic interest.
## Real-world Applications
- **Algorithm Standardization:** Assisting bodies like NIST in evaluating the longevity of standards.
- **Cryptographic Agility:** Informing organizations on which primitives are "battle-tested" enough for long-term data protection.
## Future Work
- Expanding the dataset to include newer primitives like isogenies.
- Refining the AI pipeline to distinguish between "incremental" papers and "breakthrough" cryptanalysis.
- Correlating cryptanalytic effort with the discovery of specific parameter weaknesses.
## References
- Green, M. (2024). *Cryptanalysis Effort Estimation Project.*
- Related Research: IACR ePrint Archive [https://eprint.iacr.org]
- NIST Post-Quantum Cryptography Standardization Project [https://csrc.nist.gov/projects/post-quantum-cryptography]