Schneier on Security

Measuring Human Cryptanalysis Effort

Refract AI Intelligence Digest

BLUF

Publication volume is being turned into a rough measure of human cryptanalysis effort across leading public-key problems.

NEWS

The project starts from about 16,000 candidate papers and classifies cryptanalytic work on ECDLP, structured and plain lattices, syndrome decoding, and related comparators. It then uses a person-level author map to convert papers into estimated research-allocation years or cryptanalyst-hours.

Why I Care

This gives security teams, standards bodies, and researchers a more empirical way to compare how much scrutiny different cryptographic assumptions have received, which can inform confidence in algorithms and prioritization of post-quantum migration.

Next Steps

Cryptographers and standards reviewers should use the estimates as a heuristic rather than definitive evidence, validate them against known research groups and funding data, and incorporate them into algorithm-selection risk assessments; organizations should continue following NIST guidance and plan quantum-resistant transitions without assuming low published effort means low risk.

Matthew Green has a new site that tries to estimate the number of cryptanalyst-hours that have been spent analyzing different public-key algorithms: Abstract: We estimate how much public cryptanalysis each public-key assumption has received, using the literature itself as the instrument. From roughly sixteen thousand candidate papers we classify cryptanalytic work on ECDLP, structured and plain lattices, syndrome decoding and their comparators, then convert papers into estimated research-allocation years through a person-level author map. These publication-based estimates may substantially overstate actual time spent. Lattices have overtaken elliptic curves in this cumulative measure only recently; we express that history as inference budgets under stated productivity assumptions. The study was conducted by AI models: Claude Fable 5.1 and Claude Opus 5.5 built the pipeline, ran the analysis and wrote this page, with contributions from GPT-6 Astra. Matthew Green set the questions, made the key methodological decisions and oversaw the work...
Back to Blog Listing

Source: Schneier on Security ·

This digest was generated by Refract AI Collective to help the public sector security community stay informed.