Mathematics: the strongest case for Cryptographic Agility

Five weeks in the summer of 2026 

Most of us look forward to summer.  

People get off work a little earlier, go on vacations, and take their minds away from the daily routines and stress. Cryptanalysts – people that dedicate their time to trying to find vulnerabilities in cryptographic schemes – aren’t like most people however, and the Summer of 2026 is the perfect example that proves the point.  

Within the past few weeks (five at the time of writing) there has been a wave of developments (attack claims and confirmed results) on important elements of post-quantum cryptography.  

Starting on July 23rd, Woselowski published a pre-print with an algorithm that improves on the best-known solution to the supersingular isogeny problem. This represents a reduction in the estimated security margin for schemes such as SQIsign – which is currently going through the standardization process by NIST. The concrete consequences on the parameters are yet to be settled. 

Just a few days later, on July 28th, an eye-catching blog by Anthropic was published containing two headline attacks. Anthropic claims the works were mostly driven by artificial intelligence and later verified by humans. The victims were HAWK – which was also in the standardization process by NIST – and shallow version of AES-128 – with 7 rounds instead of 10. While the latter result does not have any immediate ramifications on the full AES scheme, the corresponding attack on HAWK effectively halved the secret key, and the team withdrew it from the standardization process. 

On July 31st, a preliminary draft captured the headlines in the cryptographic community. Daniel Simon (known for his contributions to the early development of quantum computing) described a quantum algorithm that would solve the dihedral coset problem (DCP) in polynomial time. While such algorithm might not sound scary to most people at first, it would in fact represent a big blow to lattice cryptography – threatening the confidence that we have in the quantum security of ML-KEM (FIPS 203), ML-DSA (FIPS 204), FalconDSA (FIPS 206), etc. About two weeks later, Gupte, Ragavan and Zhandry proved that this argument cannot lead to any sort of efficient solution to DCP, and thus the would be affected schemes remain unscathed. 

The most recent development came from Ghoshal, Ishai, Jain and Sun on August 10th regarding Classic McEliece. The contribution has two sides. The first one is a quasipolynomial-time (i.e. quasi-efficient) classical distinguisher for a public-key – an algorithm that can tell apart a public key from random noise. There was no distinguisher of the kind prior to this paper; however, it also does not have immediate implications on the security of the scheme. The second contribution is a heuristic decryption attack with the same asymptotic complexity. Neither algorithm is practical, and the correctness of the latter has not yet been confirmed. Nonetheless, if the decryption attack is confirmed to be true, it could represent a complete re-evaluation of the security and parameters of the scheme. A follow-up work by Vedenev proposed a way to turn the distinguisher into a key recovery attack, but this strategy was later found to be remarkably inefficient by Daniel Apon. 

This summer has, undoubtedly, been one to remember. 

Broken is not a Boolean 

Cryptography is constantly under attack.  

The security of public key cryptographic schemes depends on certain mathematical problems being hard to solve. These problems become easier with time – with new insights into the mathematics, new algorithmic tricks and improved computational capabilities. The cryptographic community is constantly working on improving the algorithms that solve these hard problems – making an attempt to break them or, at least, solve them faster. These attacks do not always result in a complete break, on the contrary, the large majority of them are incremental improvements, but most importantly, they contribute to the better understanding of what makes the problem hard. 

That being said, each one of the attacks presented in the past few weeks had different implications to the corresponding scheme, and to the users and people that deploy the scheme. 

Works in cryptanalysis have different kinds/levels of impact.  We outline an informal list of categories ordered by how consequential they are.  

1. No weakness found. These can be, for example, unsuccessful attempts at solving foundational problems (Simon’s recent work, Chen’s 2024 paper, Eldar and Shor’s 2016 paper) or results that reinforce hardness assumptions (OpenAI result on CVP). 

1. Weakness found in a closely related construction. These are efforts to understand the security of an important construction by attacking a closely related variant (Anthropic’s recent AES analysis).  

1. Asymptotic security erosion and small algorithmic improvements. These can be marginal but direct attacks to the main construction, or results that refine the estimation of resources required for a given attack. The contributions of works in this category are small enough to not make the news, and their impact is often hard to quantify (Woselowski’s work on isogenies). 

1. Significant security degradation and unexpected resource estimates. These can be direct attacks (often coming from underexplored directions) that have significant implications on the security of the scheme (Anthropic’s recent attack on HAWK); or they can also be a new resource estimate that changes the paradigm for how real attacks are modeled (Google’s estimate on solving DLP early this year, moving the goalposts and leading to tighter PQC migration deadlines). 

1. Total break. These are attacks that completely invalidate the security assumption of a particular scheme (Castryck and Decru attack on SIKE in 2022). 

1. Foundational assumption collapse. This happens when an imminent threat to the foundations of one or more schemes (Shor’s quantum algorithm to solve factoring and DLog), which leads to the migration away from all the affected schemes. 

Progressive erosion and abrupt failure: what is hard to prepare for. 

Erosion is invisible from one day to the next, but strikingly evident after a few years. 

From the (unofficial) categories above, I and II have little-to-no immediate practical consequences on security; on the other hand, IV, V, and VI are quite rare, but also important enough to catch the attention of people inside and outside the field. The one type of consequential result that never makes headlines is III, and this, in a sense, makes it the most dangerous. When a work in category III appears, nothing is really broken; things still work, there is no CVE, or official advisory, or concrete deadline for migration. The only thing that happened is that the cost of solving the central hard problem moved, it became easier. In many of these cases, translating the theoretical result into concrete parameters is left as an open question, which makes it hard for everyone to know what the actual consequences are.  

Keeping up with constant developments in cryptanalysis is exhausting, even more so when it is necessary to evaluate the concrete implications of each result. It is, therefore, unreasonable to expect security teams to keep an eye on the progressive security erosion of their cryptographic infrastructure. It is also unreasonable to expect anyone to predict the future. 

HAWK was proposed as a scheme in 2022. It was eventually withdrawn from NIST standardization in 2026 – three rounds into the process – after having suffered a significant (and unexpected) reduction in its security. But a more extraordinary story is that of SIKE. The scheme itself was initially proposed in 2011, and it was not until 2022 – in the fourth and final round of the NIST standardization process for KEMs – when a full classical break was found. No quantum computers needed. While, for some cryptographers, this was not a complete surprise, it was certainly unexpected for the majority of people working on the standards. It would not have made it to the last round otherwise. This serves as a remarkable example of how vulnerabilities can be found unexpectedly, even after having more than a decade of analysis. 

The clock speed has changed, the time window is shrinking 

AI is changing the game. 

We all have felt the pace of development accelerating – in all areas – ever since the emergence of generative AI. Agentic workloads, harnesses, and increasingly more powerful frontier models have further amplified what AI can do. What used to take years can now take only a few weeks. What used to require several experts can now be carried by a few smart people with access to frontier models. This is also true for cryptanalysis. We are already on target to reach close to 400 works on cryptanalysis (on eprint.iacr.org) for this year, compared to 325 total for 2025, and 318 for 2024. On top of that, these new attacks that are assisted or led by AI are often also of better quality. Agents with access to formal verification tools like lean or tamarin can use them to find vulnerabilities in cryptographic protocols and primitives.  And we can see this acceleration by looking at HAWK’s timeline: the construction survived two full rounds and four years of human expert review, but it only took 60 hours of AI work (and $100K in API usage) to find a significant vulnerability.  

Cryptanalysts will not pass on the opportunity to use these tools. Moreover – and somewhat more alarmingly – many constructions that are currently in use have received less attention and scrutiny than they deserve, and it is safe to bet that many of them are holding weaknesses that have remained dormant so far. For NIST standards and other constructions that have been out for decades, this is unlikely. But for bespoke protocols, obscure vendor-proprietary solutions, homebrewed libraries, and standards that are only lightly reviewed, you best be confident that vulnerabilities will be found at an unprecedented pace. The cryptanalytic tools have never been more powerful and accessible, and the barriers to entry for cryptanalysis have never been this low. 

And it is not only AI. 

The understanding of how to implement algorithms in real quantum computers has also significantly improved in the past few months. Works coming grom the Google’s Quantum AI group, Iceberg Quantum, and Oratomic have moved the quantum goalposts closer, showing that a quantum computer that is “large enough” to break cryptographic algorithms is actually much smaller than we previously thought. As a response, several companies such as Google, Microsoft and Cloudflare, as well as the US Government, have re-evaluated and tightened their quantum migration plans. The goal is now 2029.  

Agility, what lets you sleep at night 

You cannot worry about everything. You still need to sleep. 

If you are a CISO, a Chief Risk Officer, a Head of Security, or anyone responsible for security in your company, you cannot lose sleep over every possible attack. What should actually keep you awake is not the question “Is ML-KEM secure?”. That question is not for you, and neither is for anyone else in your organization. All the experts in the world that are qualified to review Simon’s attack on lattice cryptography can probably fit inside a room. You are in charge of the security of your company, and the thought that should be keeping you awake is  

“If ML-KEM is not secure, what happens on Monday?”  

If you find yourself in that situation, how you act and what you can do will depend on the infrastructure that you have in place. Ideally, you will have access to a button that says “Swap ML-KEM out, and use a secure KEM instead”. That concept is called cryptographic agility. It is not meant to prevent attacks, or to make any cryptographic scheme more secure. Agility is meant to give anyone responsible for security a concrete and actionable plan for what to do in case any cryptographic component is no longer secure – either because security was progressively eroded away, or because an unexpected, serious vulnerability was found. 

Thankfully, ML-KEM remains secure, so you still have time to get yourself that magical swapping button.  

Agility is not enough 

There is no magic bullet. 

Cryptographic agility is a forward-looking tool, and you can feel that with regards to confidentiality. If a key establishment or an encryption scheme is compromised, every ciphertext depending on that scheme is already readable – it is gone – no matter how fast you rotate the scheme after the break has happened. Agility will protect future sessions, as well as signatures and certificates, but it will not recover lost confidentiality. Harvest Now, Decrypt Later attacks are not exclusive to quantum adversaries, and only conservative choices – such as hybrid schemes – can realistically help with that. 

Agility without visibility is a fire brigade with no map of the city. You may be able to quickly swap any scheme at the click of a button, but that button can only swap the scheme where it knows it is being used. Discovery and inventory is, therefore, the first and most fundamental step to take any action within your cryptographic infrastructure. A CBOM is not enough. In order to be effective, you need a current inventory that gives you visibility to the most important cryptographic elements in the organization. 

One last aspect that must be considered is that agility, if not implemented correctly, can cause more harm than good. Agility done wrong is a potential point of failure; it can be subject to downgrade attacks, parameter manipulation, algorithm substitution, etc. Agility itself becomes a target for attacks, therefore it is necessary to deploy it correctly, test it, and maintain it appropriately.  

Your plan for Monday morning 

Get yourself a good cup of coffee. It will be a long but rewarding day.  

Cryptographic agility is the outcome of having an entire system structured properly around your cryptographic infrastructure. Monday morning is the perfect time to start putting it together. You can make yourself and your team the following questions to guide you along. 

• Do you have enough visibility? Do you have a process to assess and prioritize risk? Establishing cryptographic discovery and building a centralized comprehensive current inventory is the first and most fundamental step to move forward. 

• Is everything that needs to be protected, indeed, protected? Find workloads and AI agents without proper identification and issue the necessary certificates; find devices and pipelines using obsolete cryptography and update it; find the trust boundaries that require code signing.  

• Do you have centralized and sufficient control on your cryptographic infrastructure? Is lifecycle of keys and certificates properly automated? Cryptography is everywhere, and manual decentralized management does not scale. What does scale? Automated centralized control. 

That is how you build agility. 

Your plan for the weekend 

Rest up, ML-KEM is safe. 

Simon’s attack on lattices has been proven wrong after only a couple of weeks of it being in the public domain. This is not the first time a prominent researcher makes an honest attempt at breaking the fundamentals of widely deployed cryptography: in 2022, Yilei Chen proposed a quantum algorithm to break lattices; Claus P Schnorr tried to break RSA in 2021 classically; Lior Eldar and Peter Schorr also proposed a different quantum method to break lattices in 2016. For all of them, a flaw was found within weeks by the wider community. The system works. But, in this case, “the system works” describes the discovery side of cryptanalysis – you can leave that to cryptographers – it does not describe the remediation side, and the remediation side is the part you own. 

After cryptographic agility is set in place, you can take the weekend to yourself.