# How the Whole Stack Would Break: SIDH, Correlated Assumptions, and the Cryptography We Are Betting the Next Thirty Years On
> No post-quantum algorithm is proven hard. The stack's only real defense is a deliberately uncorrelated portfolio of lattice, code, and hash assumptions.
*Published: 2026-07-19*
*Canonical: https://paragmali.com/blog/how-the-whole-stack-would-break-sidh-correlated-assumptions-*
*© Parag Mali. All rights reserved.*
---
The security of the post-quantum stack is not the hardness of any single algorithm -- **none of them is proven hard**. It is a deliberately *uncorrelated* portfolio: lattice (ML-KEM, ML-DSA, Falcon), hash (SLH-DSA), and code (HQC, Classic McEliece), chosen so a break of one family leaves the others standing. Shor was the original correlated failure -- factoring and discrete log fell together because they were one bet -- and the 2022 SIDH/SIKE collapse (classical, about ten minutes, no warning) proved a well-vetted family can still vanish overnight. This capstone maps where the surviving bets are genuinely correlated (the lattice cluster, the Module-LWE pair at its center) and argues that, for a science that can prove nothing hard, diversity is the entire defense.
## 1. Nine Teardowns, One Question
In late July 2022, a key-exchange scheme that had survived eleven years of public cryptanalysis was broken. Not by a quantum computer. Not gradually. It fell on a single laptop core in about ten minutes, using a theorem from pure mathematics published in 1997 [@castryck-decru-2022]. The scheme was SIKE, the instantiation of SIDH first proposed in 2011 [@jao-defeo-2011], and just three and a half weeks earlier NIST had promoted it to the fourth and final round of its post-quantum standardization effort for continued study [@nist-2022-selection].
Read the status carefully, because the precise words carry the whole point. SIKE was never a standard. It was a Round-4 *alternate candidate*, still under evaluation, key-recovered before any selection was made [@ir-8413]. That makes the collapse worse, not better: this was cryptography failing while under the most intense scrutiny our field knows how to apply.
Two or more cryptographic primitives that fail together because they secretly depend on the same piece of mathematics. The schemes look independent -- different names, different standards, different teams -- but a single advance takes all of them at once. It is the failure mode a diverse portfolio exists to prevent.
This series has spent nine articles taking post-quantum primitives apart one at a time: how ML-KEM would break, how ML-DSA would break, how each candidate meets its mathematical limit. This final part does what none of the nine could do alone: it steps back and asks whether they fail *independently*. Because a stack is not nine separate bets that each has to be strong. It is one system, and its real question is whether two of those bets might secretly be the same bet.
> **Key idea:** A cryptosystem is a wager that one math problem is hard. A cryptographic *stack* is a portfolio of such wagers -- and the only thing that ultimately matters is whether the wagers are correlated. The stack is secure not because any assumption is proven hard (none is), but only to the degree that a break of one leaves the others standing.
That is the lens for everything below -- a sentence you will earn by the end.
A cryptographic stack is a portfolio of bets -- and the only thing that ultimately matters is whether the bets are correlated.
Before we map the stack, one boundary. The break we just described was *structural*: an attack on SIDH's own mathematics, not on a buggy implementation of it.SIDH is not CSIDH. SIDH collapsed classically in 2022; CSIDH is a separate isogeny construction that survives, with its own separately-contested *quantum* security -- Kuperberg's algorithm applies to CSIDH, never to lattices [@kuperberg-2005]. Never let one family's obituary be read as the other's. That distinction is the boundary every section below holds to.
The thirty-year story we are about to trace is a spiral, not a line. Three times the field concentrated its security onto one kind of mathematics, and three times a shock forced it to spread out again.
flowchart LR
A["1978 McEliece: the first code-based bet"] --> B["1994 Shor: two bets share one spine"]
B --> C["2005 LWE: the lattice core arrives"]
C --> D["2016 NIST competition: five families enter"]
D --> E["2022 SIDH collapses, classically"]
E --> F["2024 FIPS 203, 204, 205 published"]
F --> G["2025 HQC selected as the code hedge"]
To answer whether the *new* bets are correlated, we first have to understand the last time they were -- the one moment when a single idea took the entire classical stack at once.
## 2. Shor: The Original Correlated Failure
For twenty years the field slept soundly because breaking RSA seemed to say nothing about breaking elliptic-curve cryptography. That comfort was an illusion -- the most important one to understand here, because the entire post-quantum project is an attempt not to fall for it twice.
The numbers told a reassuring story. The best classical attack on RSA was the general number field sieve, with a sub-exponential running time; the best classical attack on elliptic curves was Pollard's rho, a square-root method [@gnfs-pollard]. Two problems, two unrelated algorithms, two independent-looking bets. If someone found a faster way to factor, elliptic curves would be untouched, and vice versa. Diversify across both and you were doubly safe -- or so the reasoning went.
The foundation of all public-key cryptography: security rests on the belief that some specific problem -- factoring a 2048-bit number, recovering a short lattice vector -- is too expensive to solve on average, for anyone, with any known method. The operative word is *belief*. "Nobody has broken it yet" is evidence, not a proof; almost nothing in cryptography is proven hard.
Then, in 1994, Peter Shor showed that both bets were the same bet. His [polynomial-time quantum algorithm](/blog/how-q-day-breaks-everything-shors-algorithm-and-the-simultan/) solved integer factoring *and* discrete logarithm, because underneath their different surfaces both are instances of a single mathematical object: the abelian hidden-subgroup problem [@shor-1994]. Find the hidden periodic structure and you have solved the factoring instance, the discrete-log instance, and the elliptic-curve instance alike.
A general problem about finding hidden periodic structure in a function defined over an abelian (commutative) group. Integer factoring and discrete logarithm are both special cases of it. Shor's 1994 algorithm solves the abelian HSP in polynomial time on a quantum computer, which is why one result dissolved two problems that looked entirely unrelated.
flowchart TD
RSA["RSA: integer factoring"] --> HSP{"Abelian hidden-subgroup problem"}
ECC["ECC: discrete logarithm"] --> HSP
HSP --> SHOR["Shor, 1994: polynomial-time quantum HSP"]
SHOR --> Z1["RSA falls"]
SHOR --> Z2["ECC falls"]
This is the template for everything this article fears. Two primitives can each be individually strong -- decades of failed attacks, careful parameter choices, universal deployment -- and still fall together, in one stroke, because their strength was never really two separate things.
> **Note:** RSA and elliptic-curve cryptography were never two bets. They were one bet on the abelian hidden-subgroup problem, wearing two costumes. The security question was never "is each algorithm strong?" It was always "do the algorithms secretly share a spine?" Strength is measured per algorithm; *failure is measured per assumption*.
Two honest caveats keep this precise. First, Shor's algorithm needs a large, fault-tolerant quantum computer that does not yet exist; its threat is future, not present, and it does *not* threaten any of the lattice, code, or hash schemes we will meet below.Grover's algorithm is the other quantum result people cite. It gives only a generic quadratic, $2^{n/2}$, speedup for unstructured search -- effectively halving a symmetric key's strength, so a 256-bit key still offers about 128 bits against a quantum attacker [@grover-1996]. That is absorbed by larger parameters, not a structural break, and the last we will say of it. Second, the reason Shor matters here is historical, not technical: it is the event that created the field. The looming "Q-Day," when a quantum computer runs Shor at scale, is precisely *the* correlated failure that made everyone go looking for replacements.
If the lesson of Shor is that independent-looking bets can share a hidden spine, then the obvious first move after 1994 -- just swap RSA and elliptic curves for one quantum-safe algorithm -- walks straight back into the same trap.
## 3. The Naive Swap Rebuilt the Single Point of Failure
The first instinct after Shor was the worst one: treat it as a component swap. Rip out RSA and elliptic curves, find one quantum-safe replacement, and declare victory. The instinct is understandable -- engineers replace broken parts every day -- but it is exactly the mistake the correlation lens tells you to avoid.
The raw material was already on the shelf. The candidate problems with no exploitable abelian-HSP structure had existed for decades: McEliece's code-based cryptosystem from 1978 [@mceliece-1978], Merkle's hash-based signatures from 1979 [@merkle-1979], the NTRU lattice system from 1998 [@ntru-1998], and Regev's Learning With Errors problem from 2005, which would become the workhorse of the entire modern stack [@regev-lwe-2005]. Any of them could resist Shor. The temptation was to pick the most efficient one and standardize it alone.
A deployed stack whose security, however many algorithms it contains, ultimately rests on a single hard-problem family. Like a field planted with one genetic strain, it can look healthy right up until a single blight -- one mathematical advance -- takes all of it at once.
Here is why a single replacement is not a fix but a relocation of the risk. Shor did not punish RSA for being weak; it punished the *stack* for concentrating on one kind of mathematics. Swap in a lone lattice scheme and you have rebuilt precisely that: a monoculture with a new problem underneath, one advance away from total failure. You did not escape the Shor pattern. You reissued it.
To be honest about the epistemics: no paper proves the theorem "monocultures always fail." This is a design argument, and its evidence is circumstantial rather than deductive -- the Shor precedent behind us, and, as we will see, the collapses of SIKE and Rainbow still ahead.
The people who saw it earliest said so in plain terms. Daniel Bernstein and Tanja Lange argued for years that committing to a single system courts a "cryptographic monoculture," and built NTRU Prime partly as a standing objection to it [@ntruprime-diversity]. That position, once a minority view, is the intellectual seed of everything NIST eventually did.
Because NIST did not swap. It ran a competition.
> **Note:** The deepest design lesson of the post-Shor era is counterintuitive: a standardization effort should not try to crown the single best algorithm. It should assemble a diversified set whose members would have to fail for independent reasons. A lone "winner" is a monoculture waiting to happen.
NIST bet on breadth -- five families, an open process, trust earned by attrition. But breadth on paper is not diversity in fact. A competition can start with five families and still funnel almost all of its real-world weight onto one of them. To see whether that happened, you have to stop reading the roster and start reading the map -- exactly what the survivors ended up standing on.
## 4. The Map of What Rests on What
Here is the uncomfortable picture, drawn as a map. Take the standardized and selected post-quantum stack, ignore the marketing names, and color each scheme by the hard problem it actually rests on. Where is the concentration?
The modern public-key primitive for agreeing on a shared secret. Rather than encrypting a chosen message, the sender *encapsulates* a fresh random key against the recipient's public key, producing a ciphertext; the recipient decapsulates it to recover the same key. ML-KEM, HQC, and Classic McEliece are all KEMs.
Six schemes carry the weight. ML-KEM (FIPS 203) is a lattice KEM whose security is tied to Module-LWE at modulus q = 3329 [@fips-203]. ML-DSA (FIPS 204) is a lattice signature resting on Module-LWE *and* Module-SIS at modulus q = 8380417 [@fips-204]. [Falcon](/blog/how-falcon-would-break-ntru-lattices-and-the-structure-nobod/) (draft FIPS 206) is a lattice signature too, but on the NTRU short-vector problem rather than Module-LWE [@ntru-1998].
SLH-DSA (FIPS 205) is a signature whose security reduces entirely to the strength of a hash function [@fips-205]. Classic McEliece rests on decoding random binary Goppa codes [@mceliece-1978], and HQC -- selected by NIST in March 2025 -- rests on decoding quasi-cyclic codes [@ir-8545].
flowchart TD
subgraph Lattice
MLKEM["ML-KEM on Module-LWE"]
MLDSA["ML-DSA on Module-LWE plus Module-SIS"]
FAL["Falcon on the NTRU lattice"]
end
subgraph Hash
SLH["SLH-DSA on hash security only"]
end
subgraph Code
HQC["HQC on quasi-cyclic decoding"]
MCE["Classic McEliece on binary-Goppa decoding"]
end
MLKEM -.->|shared Module LWE assumption| MLDSA
The hard problem underneath both ML-KEM and ML-DSA. Informally it is noisy linear algebra over structured (module) lattices: you are shown many linear equations whose right-hand sides have each been nudged by a small random error, and asked to recover the secret. "Module" is the middle setting between fully unstructured LWE (slow but conservative) and fully structured Ring-LWE (fast but more algebraic surface for an attacker to grab).
The map makes one fact impossible to miss: **three of the six schemes stand on lattices.** That concentration is not an accident. It is the payoff of a twenty-year efficiency arc -- Ajtai's 1996 worst-case-to-average-case reduction [@ajtai-1996], Regev's LWE in 2005 [@regev-lwe-2005], Ring-LWE's dramatic size reductions in 2010 [@ring-lwe-2010], and the Module-LWE middle ground in 2015 [@module-lwe-2015] that Kyber and Dilithium adopted in 2017 to become today's ML-KEM and ML-DSA [@kyber-2017; @dilithium-2017]. Lattices won the efficiency argument, and that is why they became the core.
But notice the precise shape of the correlation, because misstating it is the single most common error about this stack. [ML-KEM and ML-DSA](/blog/two-standards-one-lattice-how-ml-kem-and-ml-dsa-would-break/) are the genuinely correlated *pair*: both rest on Module-LWE. That does **not** mean any attack on one instantly breaks the other. They use different parameters -- different moduli (3329 versus 8380417), different module ranks,The rank is roughly how many ring elements stack into the secret vector; a higher rank means a harder instance and a larger key. different noise -- so a *parameter-specific* attack need not transfer, and ML-DSA carries an additional Module-SIS assumption that ML-KEM does not [@fips-204].
What they share is the *assumption family*. A generic, structural advance against Module-LWE would reach both at once; a narrow trick tuned to one parameter set might reach neither.Falcon is NTRU, not Module-LWE -- a third and structurally distinct lattice bet, and the least conservative of the three because its NTRU lattices carry extra algebraic structure. It is also the one still unfinished: draft FIPS 206 (FN-DSA) remained unreleased as of this writing [@nist-pqc-project].
You can turn that observation into a two-line audit. Do not count algorithms; count *assumptions*.
{`
// Map each deployed scheme to the hard problem it truly rests on.
const assumption = {
'ML-KEM-768': 'lattice',
'ML-DSA-65': 'lattice',
'Falcon-512': 'lattice',
'SLH-DSA-128s': 'hash',
'HQC-128': 'code',
'Classic-McEliece': 'code'
};
// A stack is only as diverse as its set of DISTINCT assumptions.
function auditStack(schemes) {
const families = new Set(schemes.map(function (s) { return assumption[s]; }));
console.log('Deployed: ' + schemes.join(', '));
console.log('Distinct assumption families: ' + Array.from(families).join(', '));
if (families.size === 1) {
console.log('WARNING: monoculture. One advance against ' +
Array.from(families)[0] + ' takes the whole stack.');
} else {
console.log('OK: a break must cross ' + families.size +
' unrelated families to take everything.');
}
}
auditStack(['ML-KEM-768', 'ML-DSA-65', 'Falcon-512']); // looks diverse, is not
auditStack(['ML-KEM-768', 'SLH-DSA-128s', 'HQC-128']); // lattice + hash + code
`}
The first stack has three different algorithm names and one assumption. The second has three names and three assumptions. Only the second is a portfolio.
> **Key idea:** The map is the thesis. Every scheme sits in exactly one assumption band -- lattice, hash, or code -- and every break lives in a band too. To take the whole stack down, a single break would have to cross bands, reaching mathematics unrelated to where it started. Diversity is not decoration on top of the security argument. It *is* the security argument.
The map, laid out precisely, and the five generations of thinking that produced it:
| Scheme (standard) | Role | Family | Specific assumption | Best-known attack | Representative size | Correlation group |
|---|---|---|---|---|---|---|
| ML-KEM (FIPS 203) | KEM workhorse | Lattice | Module-LWE, q = 3329 | Lattice sieving / BKZ [@core-svp] | ~1 KB public key | Lattice core |
| ML-DSA (FIPS 204) | Signature workhorse | Lattice | Module-LWE + Module-SIS, q = 8380417 | Lattice sieving / BKZ [@core-svp] | ~3 KB signature | Lattice core (paired) |
| Falcon (draft FIPS 206) | Compact signature | Lattice | NTRU short vector | Lattice sieving / BKZ [@core-svp] | sub-kilobyte signature | Lattice (distinct) |
| SLH-DSA (FIPS 205) | Conservative signature | Hash | Hash preimage / collision resistance | Generic hash attacks | several to tens of KB signature | Hash anchor (uncorrelated) |
| HQC (NIST IR 8545) | KEM hedge | Code | Quasi-cyclic syndrome decoding | Information-set decoding [@bjmm-2012] | few-KB public key | Code hedge |
| Classic McEliece (ISO-track) [@classic-mceliece-iso] | KEM deep hedge | Code | Binary-Goppa syndrome decoding | Information-set decoding [@bjmm-2012] | 0.26-1.36 MB public key [@classic-mceliece-site] | Code hedge |
| Generation | Era | What we bet on | How we avoided concentrating | Why it was superseded |
|---|---|---|---|---|
| Number-theoretic monoculture | pre-1994 | Factoring and discrete log (RSA, ECC) | We did not -- two problems were believed independent | Shor: both are one abelian-HSP bet [@shor-1994] |
| Naive one-for-one swap | 1994-2016 | A single quantum-safe replacement | Not at all -- one new problem underneath | Rebuilds the monoculture Shor punished |
| Five-family bake-off | 2016-2022 | An open competition across five families | Breadth of candidates [@ir-8240] | Attrition thinned it toward a lattice-heavy core |
| Lattice-centric core | 2022-2024 | Module-LWE efficiency (ML-KEM, ML-DSA) | Partly -- hash-based SLH-DSA retained | Concentration risk: three lattice schemes |
| Diversified portfolio | 2024-2025 | Lattice, hash, and code, explicitly | Dated policy: SLH-DSA, then HQC [@ir-8545] | Current -- the correction made explicit |
A map like this is only a worry until a family actually vanishes from it. That is not hypothetical. An entire family that reached NIST's Round-4 shortlist -- isogenies -- did exactly that, while sitting under the most intense scrutiny the field can muster.
## 5. SIDH: How a Family Vanished in an Afternoon
Return to the ten-minute break and look at exactly how it worked, because the mechanism is the warning. A scheme that survived more than a decade did not fall to a new theory, a faster computer, or a lucky guess. It fell to arithmetic that had been sitting in a 1997 journal, waiting.
SIDH's hard problem is to find a secret isogeny -- a structured map -- between two supersingular elliptic curves. That problem, taken bare, still looks hard today. But a protocol has to do more than pose a hard problem; it has to let two honest parties reach the same key. To make that possible, SIDH publishes extra data alongside its public key: the images of certain torsion points under the secret isogeny [@jao-defeo-2011]. That auxiliary information is not part of the underlying hard problem. It is a gift the protocol hands the attacker in order to function.
An isogeny is a structure-preserving map between two elliptic curves. SIDH hides its secret in a specific isogeny and dares attackers to find it. But to let two parties agree on a key, the protocol must also publish the images of certain torsion points under that secret map. Those published images are auxiliary data the bare hard problem never had to reveal -- and they are exactly what the attack fed on.
In late July 2022, Wouter Castryck and Thomas Decru showed how to weaponize that gift. They applied Kani's reducibility criterion -- a result in arithmetic geometry published in 1997 and essentially unused in cryptography for twenty-five years [@kani-1997] -- to the published torsion-point images. The criterion lets you glue the curves into a higher-dimensional abelian surface and test whether it splits, and from that test recover the secret isogeny. On SIKEp434 it ran in about ten minutes on a single classical core [@castryck-decru-2022].
sequenceDiagram
participant P as Protocol
participant A as Attacker
P->>A: Publishes torsion-point images (required to function)
A->>A: Apply Kani reducibility criterion from 1997
A->>A: Glue curves into an abelian surface, test reducibility
A->>P: Recover the secret isogeny (the private key)
Note over A: About ten minutes, one core, classical, not quantum
It was not a fluke of one parameter set. Within weeks, Damien Robert proved the attack runs in classical *polynomial* time from any starting curve, sealing the result as structural rather than patchable [@robert-2022], and Luciano Maino and Chloe Martindale generalized it while carefully bounding it away from neighboring constructions [@maino-martindale-2022].
Now sit with the three facts that make this the emotional center of the article. It was not Shor and not a quantum computer -- an ordinary laptop did it.The interval is the whole point. SIKE advanced to Round 4 on 5 July 2022 and was broken around 30 July 2022 -- roughly three and a half weeks later [@nist-2022-selection; @castryck-decru-2022]. Years of survival bought time, not safety. It was not gradual erosion -- one paper took the family from "final round" to "dead." And the vulnerability was structural from birth: SIDH published its own attack surface on day one, and the tool that read it had existed, fully public, since 1997.
> **Note:** The attack was **classical**. It ran on an ordinary core using Kani's criterion, with no quantum computer anywhere in the story. And SIDH is **not** CSIDH: this result key-recovered SIDH and SIKE, but does not apply to CSIDH, CSI-FiSh, or SQIsign [@maino-martindale-2022]. Blaming a quantum machine, or extending the collapse to every isogeny scheme, are both wrong.
Here is the shift. Most of us treat heavy vetting as evidence of durability: if a scheme survives years of expert attack, surely it is safe. SIKE says otherwise. Vetting measures how long a family has resisted the tools people *thought to try*. It cannot measure the tool nobody connected yet -- and that tool can already be published, in a field the cryptographers were not reading.
The mathematics that collapses a quantum-safe family can already exist, fully published, decades before anyone connects it to the target.
If a whole family can vanish like this -- classically, in an afternoon, at the peak of its scrutiny -- then the only rational response is to never bet the stack on one. That is precisely, and deliberately, what NIST built next.
## 6. The Portfolio NIST Actually Built
The standardized stack is not a winner. It is a portfolio, and it was designed rather than stumbled into. Read across the three families and you can see the strategy in the shape.
The lattice pair, ML-KEM and ML-DSA, are the efficient workhorses -- small keys, fast operations, the default choice for general traffic [@fips-203; @fips-204]. Next to them sits the maximally conservative anchor: [SLH-DSA](/blog/how-slh-dsa-would-break-the-signature-that-can-only-fall-if-/), a signature whose security reduces entirely to the strength of a hash function and shares no algebraic structure with lattices at all [@fips-205]. Its lineage runs straight back to the SPHINCS stateless hash-based signature of 2015 [@sphincs-2015]. If every lattice assumption on the map fell tomorrow, SLH-DSA would not notice.
The hard problem behind code-based cryptography. Given a random-looking linear code and a corrupted codeword, recover the small error pattern that was added. That recovery is a decoding problem which has resisted efficient solution since the 1970s. HQC and Classic McEliece both rest on variants of it.
The third family is the encryption hedge. Classic McEliece has stood essentially unbroken as a structure for roughly 47 years, the deepest-studied bet on the board [@classic-mceliece-site].McEliece's conservatism has a price: its public keys run from about 0.26 MB to 1.36 MB depending on parameters [@classic-mceliece-site], roughly two to three orders of magnitude larger than ML-KEM's. That bandwidth is the price of a structure unbroken for nearly half a century. And in March 2025, NIST added HQC, a newer code-based KEM built on quasi-cyclic codes [@hqc-site], precisely to have a standardized encryption path that does not touch lattices.
> **Note:** The clearest proof that diversity is a deliberate strategy and not an accident is the calendar. On 11 March 2025, NIST selected HQC as a second standardized KEM -- explicitly because it rests on codes rather than lattices, so that a future lattice break cannot bring down all post-quantum encryption at once. NIST even documented why it chose HQC over BIKE and why it did not select Classic McEliece [@ir-8545].
That selection is the thesis rendered as a signed, dated decision. A monoculture-minded process would have shipped one KEM -- the fastest -- and moved on. NIST shipped a second one on a different hard problem, and said out loud that non-correlation was the reason.
NIST did not choose HQC because it was the fastest or the smallest. It chose HQC because it is not a lattice.
Here is the whole portfolio as an engineering comparison. The last row -- correlation to the lattice core -- is the one this article cares about most.
| Dimension | Lattice core (ML-KEM / ML-DSA) | Lattice (Falcon) | Hash (SLH-DSA) | Code (HQC) | Code (McEliece) |
|---|---|---|---|---|---|
| Worst-case structural threat | Generic Module-LWE advance | Advance on NTRU lattices | Break of the underlying hash | ISD advance on quasi-cyclic codes | ISD advance on Goppa codes |
| Best-known attack cost | Sieving $2^{0.292\beta}$ [@core-svp] | Sieving $2^{0.292\beta}$ [@core-svp] | Generic hash bounds | ISD $2^{\Theta(n)}$ [@bjmm-2012] | ISD $2^{\Theta(n)}$ [@bjmm-2012] |
| Representative size | ~1 KB pk, ~3 KB sig | sub-KB signature | KB-scale signature | few-KB public key | 0.26-1.36 MB public key [@classic-mceliece-site] |
| Performance | Fast | Compact, fast verify | Slower, larger signatures | Moderate | Fast operations, very large keys |
| Attack-cost verifiability | Contested margin [@classic-mceliece-site] | Contested margin | High (hash-based) | Machine-checkable | Machine-checkable, most stable |
| Correlation to lattice core | It is the core | High (lattice) | None (hash) | Low (code) | Low (code) |
A portfolio on paper only becomes a defense when it is fielded, and this one is. On the wire, the dominant deployment is a *hybrid*: a classical key exchange and a lattice KEM run together, most commonly the X25519MLKEM768 group, which pairs X25519 with ML-KEM-768, the two primitives it shares with the general-purpose X-Wing combiner [@xwing-2024].
Running a classical key exchange (say X25519) and a post-quantum KEM (say ML-KEM) side by side, then combining their two shared secrets through a key-derivation function. The result is secure as long as *either* half is unbroken, so a surprise break of the post-quantum piece does not, on its own, expose the session.
The adoption is real and recent. By early 2024, roughly 2 percent of TLS 1.3 connections to Cloudflare used post-quantum key exchange, with over 99 percent of that traffic driven by Chrome [@cloudflare-pq-2024]. Apple's iMessage PQ3 and Signal's PQXDH shipped post-quantum protection into production messaging [@apple-pq3; @signal-pqxdh]. And the NSA's CNSA 2.0 suite mandates ML-KEM and ML-DSA, plus the stateful hash-based signatures LMS and XMSS for software- and firmware-signing, for national security systems on a timeline running to 2033 [@cnsa-2.0]. The portfolio is not a whiteboard proposal; it is being poured into the foundations of the internet right now.
A portfolio is only a defense, though, if its bets are genuinely uncorrelated. So the honest question -- the one that separates comfort from security -- is whether these bets are independent. They are not all as independent as the map makes them look.
## 7. Are the Bets Actually Uncorrelated?
This is where the map earns its keep. Press on each band and watch how far the crack spreads. There are three verdicts to reach and one uncomfortable caveat that undercuts all of them.
**The lattice cluster is genuinely correlated -- and it is the largest correlated surface on the map.** A sufficiently general advance against structured lattices, or a real quantum algorithm for Module-LWE, would not stay contained. It would reach ML-KEM and ML-DSA through their shared Module-LWE assumption and very likely Falcon through its NTRU lattices as well.
The caveats from Section 4 still hold and still matter -- Falcon is NTRU rather than Module-LWE, the parameters differ, and ML-DSA carries an extra Module-SIS route -- so not every lattice result hits all three. But the honest summary is stark: the single most valuable target on the board is "lattices in general," and three standardized schemes sit behind it.
flowchart TD
GEN["Generic Module-LWE break"] --> MLKEM["ML-KEM"]
GEN --> MLDSA["ML-DSA"]
LR["Large lattice-reduction advance"] --> MLKEM
LR --> MLDSA
LR --> FAL["Falcon"]
ISD["Information-set decoding advance"] --> HQC["HQC"]
ISD --> MCE["Classic McEliece"]
HASH["Hash function break"] --> SLH["SLH-DSA"]
NN["Nearest-neighbor search"] -.-> LR
NN -.-> ISD
**The code pair is partially correlated.** HQC and Classic McEliece are both code-based, but they are different structural bets -- quasi-cyclic codes versus binary Goppa codes. They share an attack ruler: improvements to information-set decoding erode both [@bjmm-2012]. But a structure-specific attack, one that exploits the quasi-cyclic shape or the Goppa structure in particular, need not transfer between them. Same family, two different bets inside it.
The best-known family of attacks against code-based cryptography. ISD guesses a subset of coordinates it hopes are error-free, solves the resulting linear system, and checks whether the implied error is small enough, repeating until it succeeds. Fifty years of refinement have chipped at its exponent without changing its exponential character -- which is exactly why the code margin is considered stable.
**The hash anchor is the least correlated bet on the map, but not perfectly isolated.** SLH-DSA shares no algebraic structure with lattices or codes at all; its only correlation is to the strength of the [SHA-2 and SHA-3 families](/blog/how-sha-2-and-sha-3-would-break-merkle-damgard-collisions-le/) it is built on. And those carry the largest, most-attacked security margins in all of cryptography. If you wanted the closest thing to an assumption that fails for reasons entirely its own, this is it.The lattice margin, by contrast, is not settled. Concrete-security estimates that NIST itself has published for Kyber-512 have spanned roughly $2^{140}$ to $2^{180}$ gates depending on modeling assumptions [@classic-mceliece-site]; the code margin is comparatively stable and can be checked by attack-cost simulators.
Now the caveat that keeps this section honest. Lattice sieving and code-based ISD, at their algorithmic cores, both reduce to the same primitive: finding very close vectors in a huge set, a nearest-neighbor search. The best sieving algorithms and the best decoding algorithms have both been sharpened by advances in nearest-neighbor techniques [@core-svp]. So it is *conceivable* that one deep breakthrough in nearest-neighbor search could sharpen attacks in both the lattice band and the code band at once -- a meta-correlation the tidy three-color map hides.
I have to mark that claim precisely, because overstating it would betray the whole argument. No published result demonstrates an attack that transfers between the families, and no reduction is known in either direction. This is an *inferred* caution, not a documented failure.
> **Note:** "No known reduction between two assumptions" is a statement about today's literature, not about mathematics. It means nobody has *published* a way to turn a break of one into a break of the other. It does not mean no such way exists. Mistaking "we have not found a link" for "there is no link" is exactly the overconfidence that Shor and SIDH punished.
So the encryption diversity is real but not proven, and the lattice concentration is real and only partly hedged. Which raises the deepest question in the article, the one no better algorithm can answer: could we ever *prove* two assumptions uncorrelated, even in principle?
## 8. Why You Cannot Prove the Portfolio Uncorrelated
Now the bad news that no better algorithm can fix. There are two impossibilities here, and they ascend: the first is well known and merely humbling; the second is specific to this article's thesis and is, in a strict sense, permanent.
The first: **nothing in the stack is proven hard.** Module-LWE, syndrome decoding, and hash security all rest on the same foundation -- "nobody has broken it yet." The best-known positive result is Regev's: a *quantum* reduction from worst-case lattice problems to average-case LWE [@regev-lwe-2005]. That is genuine, beautiful evidence: if you could solve random LWE instances efficiently, you could solve the worst case of certain lattice problems too. But it is not a hardness proof, because those worst-case problems are themselves only *believed* hard.
A problem is worst-case hard if *some* inputs are hard; it is average-case hard if a *randomly chosen* input is hard. Cryptography needs the second, stronger property, because keys are random. General decoding is NP-complete in the worst case, but that says nothing about the average random instance a code-based scheme actually uses -- which is why "NP-complete" is a weaker comfort here than it first sounds.
It goes deeper than "we have not gotten around to it." The lattice problems live in a place that makes a proof structurally unavailable.
The class of problems whose yes-answers and no-answers both have short, checkable certificates. The worst-case lattice problems (approximate GapSVP and GapSIVP) that LWE reduces from sit here [@aharonov-regev-2005]. That location is itself a clue: problems in NP intersect coNP are believed *not* to be NP-complete, so lattice hardness cannot simply be inherited from NP-completeness -- and a real hardness proof would have to settle questions about P, NP, and coNP that have resisted half a century of effort.
Suppose you proved that Module-LWE requires exponential time. You would then have exhibited a problem in NP that is not in P -- which proves P is not equal to NP, the most famous open question in computer science, with a million-dollar prize attached. Every cryptographic hardness assumption is, in this exact sense, a bet on how a Millennium Problem resolves. We build the internet on conjectures because proofs are unavailable, not because anyone is being careless.
The second impossibility is the one this whole article has been circling, and it is worse than the first. Even if, by some miracle, we could prove each assumption individually hard, we still could not prove them *uncorrelated*. Uncorrelatedness is a statement about all possible future mathematics: that no single idea, in any field, ever reaches two of these problems at once. You can accumulate evidence for it -- watch two assumptions resist different tools, wielded by different communities, for different lengths of time. You can never close it.
SIDH is the proof of the danger: the tool that took it was a 1997 theorem nobody had connected to cryptography. There is no theorem that says "and there are no more surprises like that one."
> **Key idea:** You cannot prove the portfolio uncorrelated. You can observe that two assumptions have resisted different tools for different lengths of time, but you can never rule out a single future idea that reaches both -- that is not a gap in today's knowledge, it is unprovable in principle. Diversity is therefore risk management, not proof. The portfolio is not a solution to the hardness problem; it is the best available discipline in the permanent absence of one.
This is the moment the comfortable reading breaks. Diversity felt like a solution -- hold different assumptions and relax. It is not a solution. It is a disciplined bet made under permanent uncertainty, chosen precisely because certainty is not on the menu and never will be.
Diversity is the closest thing to a security proof this science permits -- and it is not a proof at all.
If we can neither prove the bets hard nor prove them independent, the only rational questions left are practical ones: where would a correlated break actually come from, and how much time is on the clock?
## 9. Where the Correlated Break Would Come From
If you wanted to take down the whole stack, here is where you would aim. Three of these questions are open mathematics; the fourth is a clock.
**A "Shor for lattices."** An efficient quantum algorithm for Module-LWE would be the nightmare scenario: a single result reaching ML-KEM, ML-DSA, and by extension the lattice core all at once -- the correlated break the map warns about. And this is not a thought experiment. In April 2024, Yilei Chen posted a paper claiming exactly such an algorithm.In little more than a week Chen withdrew the claim: a flaw in Step 9, found independently by Hongxun Wu and Thomas Vidick, could not be repaired [@chen-2024; @green-chen-2024]. It must be cited only as retracted, never as a live break [@quantum-insider-chen].
The algorithm did not survive contact with other experts -- but for a little over a week, serious people believed the lattice core might be gone. That interval is the point. The feared correlated break is unrealized, not impossible, and the field felt exactly how much rides on one assumption.
**Shared structure between lattices and codes.** As Section 7 noted, lattice sieving and code decoding both lean on nearest-neighbor search. Whether that shared tooling hides a deeper connection -- a single advance that erodes both bands -- is genuinely open. No reduction is known, no transfer has been demonstrated, and "no known reduction" is not "no possible link."
**Whether the signature on-ramp adds real diversity.** NIST is still recruiting more signature families, and the roster is a live test of the whole thesis.
**The clock.** Everything above would be an academic seminar if the timeline were comfortable. It is not, because of a single idea.
The attack that makes migration urgent today even though no quantum computer exists yet. An adversary records encrypted traffic now and stores it, waiting for a future quantum computer to decrypt it retroactively. Any secret that must stay confidential for longer than the time-to-quantum is already exposed, no matter how strong today's key exchange looks.
Michele Mosca turned this into a one-line risk test, $X + Y \geq Z$: if the years your data must stay secret ($X$) plus the years you need to migrate ($Y$) meet or exceed the years until a cryptographically relevant quantum computer ($Z$), your data is already at risk today [@mosca-2015].
{`
# Mosca's inequality: if secrecy_life + migration_time >= time_to_quantum,
# your data is already exposed to harvest-now-decrypt-later.
def already_exposed(secrecy_life_years, migration_years, years_to_quantum):
exposure = secrecy_life_years + migration_years
print("Secrecy lifetime (X): " + str(secrecy_life_years) + " yr")
print("Migration time (Y): " + str(migration_years) + " yr")
print("Time to quantum (Z): " + str(years_to_quantum) + " yr")
if exposure >= years_to_quantum:
print("EXPOSED: X + Y exceeds Z by " + str(exposure - years_to_quantum) + " yr. Migrate now.")
else:
print("Safe for now by " + str(years_to_quantum - exposure) + " yr. Keep watching Z.")
# A record that must stay secret 15 years, a 5-year migration, quantum in 12 years:
already_exposed(15, 5, 12)
`}
For many long-lived secrets the inequality already bites, which is why the migration is being written into law rather than left to preference. The alarm is not new -- the NSA signaled it as early as 2015, when it announced plans to move away from its existing Suite B algorithms [@nsa-2015]. It has since hardened into deadlines: CNSA 2.0 sets a 2025-to-2033 timeline for national security systems [@cnsa-2.0], and Executive Order 14412 codifies migration requirements and the [harvest-now-decrypt-later](/blog/q-day-has-not-happened-the-incident-already-has-harvest-now-/) threat directly into federal policy [@eo-14412].
None of the open questions is settled, and the clock is already running. So the only responsible move is to build a stack today that survives being wrong about any one of them. That turns out to be a concrete engineering task.
## 10. Building an Uncorrelated Stack on Monday
Strip away the theory. Here is what to deploy, and the single rule that ties it together: watch the *assumption*, not the algorithm name.
**Deploy hybrids.** Run a classical key exchange and a post-quantum KEM together and combine their secrets, so that a break of the post-quantum half is not, by itself, a break of the session. The dominant TLS deployment is the hybrid group X25519MLKEM768; the closely related general-purpose combiner X-Wing [@xwing-2024] is built on the same X25519 and ML-KEM-768 primitives.
flowchart LR
X["X25519 shared secret"] --> KDF["Combiner / KDF"]
K["ML-KEM-768 shared secret"] --> KDF
KDF --> S["Session key (secure if either input holds)"]
This is not a hypothetical benefit.The empirical case for hybrids is already written. Cloudflare's earlier CECPQ2b experiment paired X25519 with the isogeny KEM SIKE, and any traffic recorded then stayed safe when SIKE broke -- the classical half still held [@cloudflare-pq-2024]. A hybrid turned a total break into a non-event. A hybrid is the correlation lens applied to a single connection.
{`
// A hybrid combines a classical secret and a post-quantum secret.
// The session key is safe as long as EITHER half is still unbroken.
function hybridSafe(classicalBroken, pqBroken) {
return !(classicalBroken && pqBroken);
}
for (const classicalBroken of [false, true]) {
for (const pqBroken of [false, true]) {
const verdict = hybridSafe(classicalBroken, pqBroken) ? 'SAFE' : 'EXPOSED';
console.log('classical broken=' + classicalBroken +
', PQ broken=' + pqBroken + ' -> ' + verdict);
}
}
// Only the final row, where both are broken, prints EXPOSED.
`}
**Refuse a lattice monoculture.** This is the mistake the whole article exists to prevent.
> **Note:** Replacing RSA with ML-KEM, and ECDSA with ML-DSA and Falcon, feels like a thorough migration. In assumption terms it is a lattice monoculture: one good enough advance against structured lattices reaches all of it. "Post-quantum" is not the same thing as "diversified."
Pair the efficient lattice core with a backstop that shares nothing with it: SLH-DSA for signatures you need to trust for decades, and a code-based KEM -- HQC or Classic McEliece -- kept available for encryption. And because the lattice margin is the contested one, prefer the higher-margin parameter sets (ML-KEM-768 or 1024) over the smallest.
**Build for replacement.** No choice here is permanent, so the system must be able to change its mind.
The engineering property of being able to swap a cryptographic primitive without re-architecting the system around it. If your protocol treats "the KEM" as a replaceable module rather than a hardwired choice, then an assumption that starts to erode can be dropped for another before it fails -- which is the operational form of holding a portfolio.
Put together, the decision guide is short, and every row is chosen by *assumption*, not by benchmark:
| Need | Deploy | Why |
|---|---|---|
| General key exchange | ML-KEM-768, hybridized with X25519 | Efficient lattice core plus a classical backstop |
| Maximum-conservatism encryption | Classic McEliece or HQC | Code assumption, uncorrelated with lattices |
| General signatures | ML-DSA-65, hybridized | Efficient lattice signature with a classical hedge |
| Firmware and root-of-trust signing | SLH-DSA | Hash-only, shares nothing with the rest, longest-lived trust |
| Bandwidth-critical signing | Falcon | Smallest signatures, at the cost of a third lattice bet |
> **Note:** When you audit a stack for diversity, ignore the product names and list the *assumptions*. Three lattice schemes with three different names are one bet. A lattice KEM, a hash signature, and a code KEM are three. The name tells you the vendor; the assumption tells you what actually has to break.
One boundary, named once and handed off: the ways these schemes break *in practice* -- [timing leaks in KEM decapsulation](/blog/how-ml-kem-breaks-in-real-life-the-machine-leaked-while-the-/), the delicate floating-point sampling inside Falcon's signer, fault and power attacks -- are implementation attacks, a different and equally real surface owned by the sibling track. This section is about the mathematics you choose to deploy, not the code that runs it.
Every one of these moves is a refusal to concentrate -- the same refusal, at the level of a single deployment, that the whole standardization effort was reaching for. Which brings us back to the thesis, now with all the evidence in.
## 11. Common Misconceptions, Corrected
The fastest way to misread everything above is to reach for one of these seven conclusions. Each is a precise trap, and each answer defends the portfolio rather than any single scheme.
No. Every standardized scheme -- ML-KEM, ML-DSA, SLH-DSA -- currently stands, and HQC has been selected on top of them [@ir-8545]. The argument of this article is not that the stack is weak. It is that the stack's safety is a *diversified portfolio*, not the proven hardness of any one algorithm, because none of them is proven hard.
No. The 2022 break was entirely *classical*: it applied Kani's 1997 reducibility criterion to the torsion-point data that SIDH publishes by design, and recovered the key in about ten minutes on a single ordinary core [@castryck-decru-2022; @kani-1997]. No quantum computer was involved. It was not Shor and it was not quantum.
No. SIKE was a Round-4 *alternate candidate* still under evaluation, and it was broken before any selection was made [@ir-8413; @nist-2022-selection]. It was never standardized. The correct lesson is that a late-stage, heavily vetted candidate can fall without warning -- which is worse, not better, than a fringe scheme failing.
A *generic, structural* break of Module-LWE would indeed threaten both -- that is the correlated-pair risk at the center of the map. But they use different parameters (moduli 3329 versus 8380417, different ranks and noise), and ML-DSA additionally rests on Module-SIS, so a *parameter-specific* attack on one need not transfer to the other [@fips-203; @fips-204]. The correlation is at the level of the shared assumption family, not identical instances.
Its security *is* hash security -- that is the design, not a weakness [@fips-205]. And SHA-2 and SHA-3 carry the largest, most-scrutinized security margins in all of cryptography. Reducing entirely to that well-studied foundation, while sharing no algebraic structure with lattices or codes, is exactly why SLH-DSA is the conservative anchor of the portfolio.
Because the trust is not placed in one assumption; it is placed in diversity. Lattice, code, and hash rest on unrelated mathematics developed by different communities, and are unlikely to all fall for the same reason at the same time. A break of one leaves the others standing. That is risk management under permanent uncertainty, which is the most any cryptographic science can offer.
No -- it is HQC. Classic McEliece is standardized on the ISO track [@classic-mceliece-iso] and was not selected in this round; NIST's IR 8545 explains why it chose HQC over BIKE and why it did not select McEliece [@ir-8545]. Both are code-based, but the newly selected NIST KEM is HQC.
Notice what every answer has in common: not one of them defends a single algorithm. They defend the portfolio.
## 12. The Portfolio Is the Product
Put the evidence back together. Shor proved that two bets which looked independent -- factoring and discrete log -- were one bet on the abelian hidden-subgroup problem, and fell together the moment the right machine existed [@shor-1994]. SIDH proved that a family can vanish in an afternoon, classically, with no warning, when a 1997 theorem finally met the auxiliary data the protocol had been publishing all along [@castryck-decru-2022]. And the standardized stack, colored by assumption, clusters onto three families -- lattice, hash, and code -- with a genuinely correlated Module-LWE pair, ML-KEM and ML-DSA, sitting at its efficient center [@fips-203; @fips-204].
None of those assumptions is proven hard. None ever will be, short of settling questions about P, NP, and coNPP is the class of problems solvable quickly; NP the class whose solutions can be verified quickly. Whether the two are equal is the central unsolved question of computer science. that have resisted fifty years of effort. And even if they were proven hard one at a time, no theorem could certify them uncorrelated, because uncorrelatedness is a promise about mathematics not yet invented. That is the humbling floor under the entire post-quantum project.
So the security of the stack was never going to be the strength of its strongest algorithm. It is the deliberate, dated refusal to let its bets be correlated: hash-only SLH-DSA standing apart from everything, the March 2025 selection of code-based HQC precisely *because* it is not a lattice, and an on-ramp still searching for more uncorrelated bets [@fips-205; @ir-8545]. Diversity here is not a hedge bolted onto the design. It is the design.
That reframes what we have actually been buying all along. Not a proof. A portfolio.
We cannot prove the stack secure. But we can, and did, refuse to bet it all on one piece of mathematics.
This is the sentence you were handed in the first section, now earned. We are not betting on a proof. We are betting that lattice, code, and hash will not all fail for the same reason on the same day -- and we have arranged things so that if we are wrong about one, we are not wrong about all three. For a science that can prove nothing hard, that disciplined refusal to concentrate is not a consolation prize. It is the whole defense, and it is the best one available for the thirty years we are wagering on it.