Researchers Quantify Cryptanalysis Effort on Public-Key Algorithms

"These publication-based estimates may substantially overstate actual time spent." — Matthew Green

Matthew Green's methodology and dataset

Cryptographer Matthew Green published an effort to quantify how much human cryptanalysis has been applied to competing public-key assumptions by using the academic literature itself as the measuring instrument. The project begins from roughly sixteen thousand candidate papers and applies a process of classification to identify cryptanalytic work relevant to particular assumptions, then converts those classified papers into estimated "research-allocation years" using a person-level author map. The study expresses cumulative histories as "inference budgets" under stated productivity assumptions, translating publication counts and authorship patterns into a single, comparable metric of human effort.

Algorithms measured: ECDLP, structured and plain lattices, syndrome decoding

The work explicitly classifies cryptanalytic output for a set of public-key assumptions, including ECDLP, both structured and plain lattices, and syndrome decoding, and compares each against relevant alternatives. By focusing on these named comparators the analysis creates a common frame for allocating published cryptanalytic activity into the different assumption buckets that underpin much public-key cryptography.

AI models built the pipeline and wrote the page

The technical pipeline and much of the write-up were produced by AI models. Matthew Green reports that Claude Fable 5.1 and Claude Opus 5.5 built the pipeline, ran the analysis, and wrote the page, with additional contributions from GPT-6 Astra. Green, in turn, set the research questions, made key methodological decisions, and oversaw the work. That combination—human oversight layered over an AI-built analysis chain—produced the published estimates and the decisions embedded in the conversion from papers to researcher-years.

Key finding: lattices have overtaken elliptic curves in cumulative published effort

One of the study's headline outcomes is that, by this publication-based cumulative measure, lattices have overtaken elliptic curves only recently. The presentation frames that history as a shifting "inference budget" under the project's productivity assumptions, making explicit how changes in publication patterns map onto relative research effort across assumptions. The analysis does not claim to be a direct measure of total cryptanalytic capability, but it does document a distinct shift in the allocation of published cryptanalytic attention toward lattice-based problems.

Caveats and exclusions: unpublished work and secret agency analysis

Green emphasizes several caveats: the approach relies on published work, so anything not published is excluded from the tally. That omission covers two classes the author calls out explicitly: academic cryptanalysis that did not result in a paper, and intelligence-agency cryptanalysis conducted in secret. The project itself warns that the publication-based estimates "may substantially overstate actual time spent" and describes the output as "a good first stab at a metric of this sort." In short, the metric captures visible, bibliographic effort but cannot account for private or unreported cryptanalytic labor.

What this means for technologists, policymakers, and adversaries

• Technologists and security teams: The reported shift toward lattice-focused published work signals where visible scholarly attention has concentrated; teams vetting post-quantum options can use the inference-budget framing to inform risk discussions but should remember the metric excludes unpublished effort.
• Policymakers and regulators: Because the study omits classified and unpublished work, regulators considering resource or resilience questions should treat these numbers as a lower bound on total cryptanalytic capacity and as an indicator of public research trends rather than a complete inventory.
• Adversaries and intelligence actors: The analysis does not attempt to measure secret capability. The author explicitly notes that intelligence-agency cryptanalysis done in secret is not captured, a reminder that publicly documented research and covert work can move on different timelines and with different resource commitments.

Matthew Green's project provides a narrowly focused, transparent attempt to translate scholarly output into an intuitively comparable measure of human cryptanalysis effort. It documents a recent, publication-visible reallocation of attention toward lattices and offers a repeatable pipeline for further refinement—but it leaves open the larger question the author acknowledges: how much cryptanalytic work remains invisible because it never passes through the literature? Read the original write-up here: https://www.schneier.com/blog/archives/2026/10/measuring-human-cryptanalysis-effort.html