How the Whole Stack Would Break: SIDH, Correlated Assumptions, and the Cryptography We Are Betting the Next Thirty Years On

1. Nine Teardowns, One Question#

In late July 2022, a key-exchange scheme that had survived eleven years of public cryptanalysis was broken. Not by a quantum computer. Not gradually. It fell on a single laptop core in about ten minutes, using a theorem from pure mathematics published in 1997 ^[1]. The scheme was SIKE, the instantiation of SIDH first proposed in 2011 ^[2], and just three and a half weeks earlier NIST had promoted it to the fourth and final round of its post-quantum standardization effort for continued study ^[3].

Read the status carefully, because the precise words carry the whole point. SIKE was never a standard. It was a Round-4 alternate candidate, still under evaluation, key-recovered before any selection was made ^[4]. That makes the collapse worse, not better: this was cryptography failing while under the most intense scrutiny our field knows how to apply.

This series has spent nine articles taking post-quantum primitives apart one at a time: how ML-KEM would break, how ML-DSA would break, how each candidate meets its mathematical limit. This final part does what none of the nine could do alone: it steps back and asks whether they fail independently. Because a stack is not nine separate bets that each has to be strong. It is one system, and its real question is whether two of those bets might secretly be the same bet.

A cryptosystem is a wager that one math problem is hard. A cryptographic stack is a portfolio of such wagers -- and the only thing that ultimately matters is whether the wagers are correlated. The stack is secure not because any assumption is proven hard (none is), but only to the degree that a break of one leaves the others standing.

That is the lens for everything below -- a sentence you will earn by the end.

A cryptographic stack is a portfolio of bets -- and the only thing that ultimately matters is whether the bets are correlated.

Before we map the stack, one boundary. The break we just described was structural: an attack on SIDH's own mathematics, not on a buggy implementation of it. SIDH is not CSIDH. SIDH collapsed classically in 2022; CSIDH is a separate isogeny construction that survives, with its own separately-contested quantum security -- Kuperberg's algorithm applies to CSIDH, never to lattices ^[5]. Never let one family's obituary be read as the other's. That distinction is the boundary every section below holds to.

The thirty-year story we are about to trace is a spiral, not a line. Three times the field concentrated its security onto one kind of mathematics, and three times a shock forced it to spread out again.

flowchart LR
A["1978 McEliece: the first code-based bet"] --> B["1994 Shor: two bets share one spine"]
B --> C["2005 LWE: the lattice core arrives"]
C --> D["2016 NIST competition: five families enter"]
D --> E["2022 SIDH collapses, classically"]
E --> F["2024 FIPS 203, 204, 205 published"]
F --> G["2025 HQC selected as the code hedge"]

To answer whether the new bets are correlated, we first have to understand the last time they were -- the one moment when a single idea took the entire classical stack at once.

2. Shor: The Original Correlated Failure#

For twenty years the field slept soundly because breaking RSA seemed to say nothing about breaking elliptic-curve cryptography. That comfort was an illusion -- the most important one to understand here, because the entire post-quantum project is an attempt not to fall for it twice.

The numbers told a reassuring story. The best classical attack on RSA was the general number field sieve, with a sub-exponential running time; the best classical attack on elliptic curves was Pollard's rho, a square-root method ^[6]. Two problems, two unrelated algorithms, two independent-looking bets. If someone found a faster way to factor, elliptic curves would be untouched, and vice versa. Diversify across both and you were doubly safe -- or so the reasoning went.

Then, in 1994, Peter Shor showed that both bets were the same bet. His polynomial-time quantum algorithm solved integer factoring and discrete logarithm, because underneath their different surfaces both are instances of a single mathematical object: the abelian hidden-subgroup problem ^[7]. Find the hidden periodic structure and you have solved the factoring instance, the discrete-log instance, and the elliptic-curve instance alike.

flowchart TD
RSA["RSA: integer factoring"] --> HSP{"Abelian hidden-subgroup problem"}
ECC["ECC: discrete logarithm"] --> HSP
HSP --> SHOR["Shor, 1994: polynomial-time quantum HSP"]
SHOR --> Z1["RSA falls"]
SHOR --> Z2["ECC falls"]

This is the template for everything this article fears. Two primitives can each be individually strong -- decades of failed attacks, careful parameter choices, universal deployment -- and still fall together, in one stroke, because their strength was never really two separate things.

Two honest caveats keep this precise. First, Shor's algorithm needs a large, fault-tolerant quantum computer that does not yet exist; its threat is future, not present, and it does not threaten any of the lattice, code, or hash schemes we will meet below. Grover's algorithm is the other quantum result people cite. It gives only a generic quadratic, $2^{n/2}$, speedup for unstructured search -- effectively halving a symmetric key's strength, so a 256-bit key still offers about 128 bits against a quantum attacker ^[8]. That is absorbed by larger parameters, not a structural break, and the last we will say of it. Second, the reason Shor matters here is historical, not technical: it is the event that created the field. The looming "Q-Day," when a quantum computer runs Shor at scale, is precisely the correlated failure that made everyone go looking for replacements.

If the lesson of Shor is that independent-looking bets can share a hidden spine, then the obvious first move after 1994 -- just swap RSA and elliptic curves for one quantum-safe algorithm -- walks straight back into the same trap.

3. The Naive Swap Rebuilt the Single Point of Failure#

The first instinct after Shor was the worst one: treat it as a component swap. Rip out RSA and elliptic curves, find one quantum-safe replacement, and declare victory. The instinct is understandable -- engineers replace broken parts every day -- but it is exactly the mistake the correlation lens tells you to avoid.

The raw material was already on the shelf. The candidate problems with no exploitable abelian-HSP structure had existed for decades: McEliece's code-based cryptosystem from 1978 ^[9], Merkle's hash-based signatures from 1979 ^[10], the NTRU lattice system from 1998 ^[11], and Regev's Learning With Errors problem from 2005, which would become the workhorse of the entire modern stack ^[12]. Any of them could resist Shor. The temptation was to pick the most efficient one and standardize it alone.

Here is why a single replacement is not a fix but a relocation of the risk. Shor did not punish RSA for being weak; it punished the stack for concentrating on one kind of mathematics. Swap in a lone lattice scheme and you have rebuilt precisely that: a monoculture with a new problem underneath, one advance away from total failure. You did not escape the Shor pattern. You reissued it.

To be honest about the epistemics: no paper proves the theorem "monocultures always fail." This is a design argument, and its evidence is circumstantial rather than deductive -- the Shor precedent behind us, and, as we will see, the collapses of SIKE and Rainbow still ahead.

The people who saw it earliest said so in plain terms. Daniel Bernstein and Tanja Lange argued for years that committing to a single system courts a "cryptographic monoculture," and built NTRU Prime partly as a standing objection to it ^[13]. That position, once a minority view, is the intellectual seed of everything NIST eventually did.

Because NIST did not swap. It ran a competition.

NIST bet on breadth -- five families, an open process, trust earned by attrition. But breadth on paper is not diversity in fact. A competition can start with five families and still funnel almost all of its real-world weight onto one of them. To see whether that happened, you have to stop reading the roster and start reading the map -- exactly what the survivors ended up standing on.

4. The Map of What Rests on What#

Here is the uncomfortable picture, drawn as a map. Take the standardized and selected post-quantum stack, ignore the marketing names, and color each scheme by the hard problem it actually rests on. Where is the concentration?

Six schemes carry the weight. ML-KEM (FIPS 203) is a lattice KEM whose security is tied to Module-LWE at modulus q = 3329 ^[16]. ML-DSA (FIPS 204) is a lattice signature resting on Module-LWE and Module-SIS at modulus q = 8380417 ^[17]. Falcon (draft FIPS 206) is a lattice signature too, but on the NTRU short-vector problem rather than Module-LWE ^[11].

SLH-DSA (FIPS 205) is a signature whose security reduces entirely to the strength of a hash function ^[18]. Classic McEliece rests on decoding random binary Goppa codes ^[9], and HQC -- selected by NIST in March 2025 -- rests on decoding quasi-cyclic codes ^[19].

flowchart TD
subgraph Lattice
MLKEM["ML-KEM on Module-LWE"]
MLDSA["ML-DSA on Module-LWE plus Module-SIS"]
FAL["Falcon on the NTRU lattice"]
end
subgraph Hash
SLH["SLH-DSA on hash security only"]
end
subgraph Code
HQC["HQC on quasi-cyclic decoding"]
MCE["Classic McEliece on binary-Goppa decoding"]
end
MLKEM -.->|shared Module LWE assumption| MLDSA

The map makes one fact impossible to miss: three of the six schemes stand on lattices. That concentration is not an accident. It is the payoff of a twenty-year efficiency arc -- Ajtai's 1996 worst-case-to-average-case reduction ^[20], Regev's LWE in 2005 ^[12], Ring-LWE's dramatic size reductions in 2010 ^[21], and the Module-LWE middle ground in 2015 ^[22] that Kyber and Dilithium adopted in 2017 to become today's ML-KEM and ML-DSA ^{[23, 24]}. Lattices won the efficiency argument, and that is why they became the core.

But notice the precise shape of the correlation, because misstating it is the single most common error about this stack. ML-KEM and ML-DSA are the genuinely correlated pair: both rest on Module-LWE. That does not mean any attack on one instantly breaks the other. They use different parameters -- different moduli (3329 versus 8380417), different module ranks, ※ The rank is roughly how many ring elements stack into the secret vector; a higher rank means a harder instance and a larger key. different noise -- so a parameter-specific attack need not transfer, and ML-DSA carries an additional Module-SIS assumption that ML-KEM does not ^[17].

What they share is the assumption family. A generic, structural advance against Module-LWE would reach both at once; a narrow trick tuned to one parameter set might reach neither. Falcon is NTRU, not Module-LWE -- a third and structurally distinct lattice bet, and the least conservative of the three because its NTRU lattices carry extra algebraic structure. It is also the one still unfinished: draft FIPS 206 (FN-DSA) remained unreleased as of this writing ^[15].

You can turn that observation into a two-line audit. Do not count algorithms; count assumptions.

// Map each deployed scheme to the hard problem it truly rests on.
const assumption = {
'ML-KEM-768':        'lattice',
'ML-DSA-65':         'lattice',
'Falcon-512':        'lattice',
'SLH-DSA-128s':      'hash',
'HQC-128':           'code',
'Classic-McEliece':  'code'
};

// A stack is only as diverse as its set of DISTINCT assumptions.
function auditStack(schemes) {
const families = new Set(schemes.map(function (s) { return assumption[s]; }));
console.log('Deployed: ' + schemes.join(', '));
console.log('Distinct assumption families: ' + Array.from(families).join(', '));
if (families.size === 1) {
  console.log('WARNING: monoculture. One advance against ' +
              Array.from(families)[0] + ' takes the whole stack.');
} else {
  console.log('OK: a break must cross ' + families.size +
              ' unrelated families to take everything.');
}
}

auditStack(['ML-KEM-768', 'ML-DSA-65', 'Falcon-512']);    // looks diverse, is not
auditStack(['ML-KEM-768', 'SLH-DSA-128s', 'HQC-128']);    // lattice + hash + code

The first stack has three different algorithm names and one assumption. The second has three names and three assumptions. Only the second is a portfolio.

The map is the thesis. Every scheme sits in exactly one assumption band -- lattice, hash, or code -- and every break lives in a band too. To take the whole stack down, a single break would have to cross bands, reaching mathematics unrelated to where it started. Diversity is not decoration on top of the security argument. It is the security argument.

The map, laid out precisely, and the five generations of thinking that produced it:

A map like this is only a worry until a family actually vanishes from it. That is not hypothetical. An entire family that reached NIST's Round-4 shortlist -- isogenies -- did exactly that, while sitting under the most intense scrutiny the field can muster.

5. SIDH: How a Family Vanished in an Afternoon#

Return to the ten-minute break and look at exactly how it worked, because the mechanism is the warning. A scheme that survived more than a decade did not fall to a new theory, a faster computer, or a lucky guess. It fell to arithmetic that had been sitting in a 1997 journal, waiting.

SIDH's hard problem is to find a secret isogeny -- a structured map -- between two supersingular elliptic curves. That problem, taken bare, still looks hard today. But a protocol has to do more than pose a hard problem; it has to let two honest parties reach the same key. To make that possible, SIDH publishes extra data alongside its public key: the images of certain torsion points under the secret isogeny ^[2]. That auxiliary information is not part of the underlying hard problem. It is a gift the protocol hands the attacker in order to function.

In late July 2022, Wouter Castryck and Thomas Decru showed how to weaponize that gift. They applied Kani's reducibility criterion -- a result in arithmetic geometry published in 1997 and essentially unused in cryptography for twenty-five years ^[29] -- to the published torsion-point images. The criterion lets you glue the curves into a higher-dimensional abelian surface and test whether it splits, and from that test recover the secret isogeny. On SIKEp434 it ran in about ten minutes on a single classical core ^[1].

sequenceDiagram
participant P as Protocol
participant A as Attacker
P->>A: Publishes torsion-point images (required to function)
A->>A: Apply Kani reducibility criterion from 1997
A->>A: Glue curves into an abelian surface, test reducibility
A->>P: Recover the secret isogeny (the private key)
Note over A: About ten minutes, one core, classical, not quantum

It was not a fluke of one parameter set. Within weeks, Damien Robert proved the attack runs in classical polynomial time from any starting curve, sealing the result as structural rather than patchable ^[30], and Luciano Maino and Chloe Martindale generalized it while carefully bounding it away from neighboring constructions ^[31].

Now sit with the three facts that make this the emotional center of the article. It was not Shor and not a quantum computer -- an ordinary laptop did it. The interval is the whole point. SIKE advanced to Round 4 on 5 July 2022 and was broken around 30 July 2022 -- roughly three and a half weeks later ^{[3, 1]}. Years of survival bought time, not safety. It was not gradual erosion -- one paper took the family from "final round" to "dead." And the vulnerability was structural from birth: SIDH published its own attack surface on day one, and the tool that read it had existed, fully public, since 1997.

Here is the shift. Most of us treat heavy vetting as evidence of durability: if a scheme survives years of expert attack, surely it is safe. SIKE says otherwise. Vetting measures how long a family has resisted the tools people thought to try. It cannot measure the tool nobody connected yet -- and that tool can already be published, in a field the cryptographers were not reading.

The mathematics that collapses a quantum-safe family can already exist, fully published, decades before anyone connects it to the target.

If a whole family can vanish like this -- classically, in an afternoon, at the peak of its scrutiny -- then the only rational response is to never bet the stack on one. That is precisely, and deliberately, what NIST built next.

6. The Portfolio NIST Actually Built#

The standardized stack is not a winner. It is a portfolio, and it was designed rather than stumbled into. Read across the three families and you can see the strategy in the shape.

The lattice pair, ML-KEM and ML-DSA, are the efficient workhorses -- small keys, fast operations, the default choice for general traffic ^{[16, 17]}. Next to them sits the maximally conservative anchor: SLH-DSA, a signature whose security reduces entirely to the strength of a hash function and shares no algebraic structure with lattices at all ^[18]. Its lineage runs straight back to the SPHINCS stateless hash-based signature of 2015 ^[32]. If every lattice assumption on the map fell tomorrow, SLH-DSA would not notice.

The third family is the encryption hedge. Classic McEliece has stood essentially unbroken as a structure for roughly 47 years, the deepest-studied bet on the board ^[28]. McEliece's conservatism has a price: its public keys run from about 0.26 MB to 1.36 MB depending on parameters ^[28], roughly two to three orders of magnitude larger than ML-KEM's. That bandwidth is the price of a structure unbroken for nearly half a century. And in March 2025, NIST added HQC, a newer code-based KEM built on quasi-cyclic codes ^[33], precisely to have a standardized encryption path that does not touch lattices.

That selection is the thesis rendered as a signed, dated decision. A monoculture-minded process would have shipped one KEM -- the fastest -- and moved on. NIST shipped a second one on a different hard problem, and said out loud that non-correlation was the reason.

NIST did not choose HQC because it was the fastest or the smallest. It chose HQC because it is not a lattice.

Here is the whole portfolio as an engineering comparison. The last row -- correlation to the lattice core -- is the one this article cares about most.

A portfolio on paper only becomes a defense when it is fielded, and this one is. On the wire, the dominant deployment is a hybrid: a classical key exchange and a lattice KEM run together, most commonly the X25519MLKEM768 group, which pairs X25519 with ML-KEM-768, the two primitives it shares with the general-purpose X-Wing combiner ^[34].

The adoption is real and recent. By early 2024, roughly 2 percent of TLS 1.3 connections to Cloudflare used post-quantum key exchange, with over 99 percent of that traffic driven by Chrome ^[35]. Apple's iMessage PQ3 and Signal's PQXDH shipped post-quantum protection into production messaging ^{[36, 37]}. And the NSA's CNSA 2.0 suite mandates ML-KEM and ML-DSA, plus the stateful hash-based signatures LMS and XMSS for software- and firmware-signing, for national security systems on a timeline running to 2033 ^[38]. The portfolio is not a whiteboard proposal; it is being poured into the foundations of the internet right now.

A portfolio is only a defense, though, if its bets are genuinely uncorrelated. So the honest question -- the one that separates comfort from security -- is whether these bets are independent. They are not all as independent as the map makes them look.

7. Are the Bets Actually Uncorrelated?#

This is where the map earns its keep. Press on each band and watch how far the crack spreads. There are three verdicts to reach and one uncomfortable caveat that undercuts all of them.

The lattice cluster is genuinely correlated -- and it is the largest correlated surface on the map. A sufficiently general advance against structured lattices, or a real quantum algorithm for Module-LWE, would not stay contained. It would reach ML-KEM and ML-DSA through their shared Module-LWE assumption and very likely Falcon through its NTRU lattices as well.

The caveats from Section 4 still hold and still matter -- Falcon is NTRU rather than Module-LWE, the parameters differ, and ML-DSA carries an extra Module-SIS route -- so not every lattice result hits all three. But the honest summary is stark: the single most valuable target on the board is "lattices in general," and three standardized schemes sit behind it.

flowchart TD
GEN["Generic Module-LWE break"] --> MLKEM["ML-KEM"]
GEN --> MLDSA["ML-DSA"]
LR["Large lattice-reduction advance"] --> MLKEM
LR --> MLDSA
LR --> FAL["Falcon"]
ISD["Information-set decoding advance"] --> HQC["HQC"]
ISD --> MCE["Classic McEliece"]
HASH["Hash function break"] --> SLH["SLH-DSA"]
NN["Nearest-neighbor search"] -.-> LR
NN -.-> ISD

The code pair is partially correlated. HQC and Classic McEliece are both code-based, but they are different structural bets -- quasi-cyclic codes versus binary Goppa codes. They share an attack ruler: improvements to information-set decoding erode both ^[26]. But a structure-specific attack, one that exploits the quasi-cyclic shape or the Goppa structure in particular, need not transfer between them. Same family, two different bets inside it.

The hash anchor is the least correlated bet on the map, but not perfectly isolated. SLH-DSA shares no algebraic structure with lattices or codes at all; its only correlation is to the strength of the SHA-2 and SHA-3 families it is built on. And those carry the largest, most-attacked security margins in all of cryptography. If you wanted the closest thing to an assumption that fails for reasons entirely its own, this is it. The lattice margin, by contrast, is not settled. Concrete-security estimates that NIST itself has published for Kyber-512 have spanned roughly $2^{140}$ to $2^{180}$ gates depending on modeling assumptions ^[28]; the code margin is comparatively stable and can be checked by attack-cost simulators.

Now the caveat that keeps this section honest. Lattice sieving and code-based ISD, at their algorithmic cores, both reduce to the same primitive: finding very close vectors in a huge set, a nearest-neighbor search. The best sieving algorithms and the best decoding algorithms have both been sharpened by advances in nearest-neighbor techniques ^[25]. So it is conceivable that one deep breakthrough in nearest-neighbor search could sharpen attacks in both the lattice band and the code band at once -- a meta-correlation the tidy three-color map hides.

I have to mark that claim precisely, because overstating it would betray the whole argument. No published result demonstrates an attack that transfers between the families, and no reduction is known in either direction. This is an inferred caution, not a documented failure.

So the encryption diversity is real but not proven, and the lattice concentration is real and only partly hedged. Which raises the deepest question in the article, the one no better algorithm can answer: could we ever prove two assumptions uncorrelated, even in principle?

8. Why You Cannot Prove the Portfolio Uncorrelated#

Now the bad news that no better algorithm can fix. There are two impossibilities here, and they ascend: the first is well known and merely humbling; the second is specific to this article's thesis and is, in a strict sense, permanent.

The first: nothing in the stack is proven hard. Module-LWE, syndrome decoding, and hash security all rest on the same foundation -- "nobody has broken it yet." The best-known positive result is Regev's: a quantum reduction from worst-case lattice problems to average-case LWE ^[12]. That is genuine, beautiful evidence: if you could solve random LWE instances efficiently, you could solve the worst case of certain lattice problems too. But it is not a hardness proof, because those worst-case problems are themselves only believed hard.

It goes deeper than "we have not gotten around to it." The lattice problems live in a place that makes a proof structurally unavailable.

The second impossibility is the one this whole article has been circling, and it is worse than the first. Even if, by some miracle, we could prove each assumption individually hard, we still could not prove them uncorrelated. Uncorrelatedness is a statement about all possible future mathematics: that no single idea, in any field, ever reaches two of these problems at once. You can accumulate evidence for it -- watch two assumptions resist different tools, wielded by different communities, for different lengths of time. You can never close it.

SIDH is the proof of the danger: the tool that took it was a 1997 theorem nobody had connected to cryptography. There is no theorem that says "and there are no more surprises like that one."

You cannot prove the portfolio uncorrelated. You can observe that two assumptions have resisted different tools for different lengths of time, but you can never rule out a single future idea that reaches both -- that is not a gap in today's knowledge, it is unprovable in principle. Diversity is therefore risk management, not proof. The portfolio is not a solution to the hardness problem; it is the best available discipline in the permanent absence of one.

This is the moment the comfortable reading breaks. Diversity felt like a solution -- hold different assumptions and relax. It is not a solution. It is a disciplined bet made under permanent uncertainty, chosen precisely because certainty is not on the menu and never will be.

Diversity is the closest thing to a security proof this science permits -- and it is not a proof at all.

If we can neither prove the bets hard nor prove them independent, the only rational questions left are practical ones: where would a correlated break actually come from, and how much time is on the clock?

9. Where the Correlated Break Would Come From#

If you wanted to take down the whole stack, here is where you would aim. Three of these questions are open mathematics; the fourth is a clock.

A "Shor for lattices." An efficient quantum algorithm for Module-LWE would be the nightmare scenario: a single result reaching ML-KEM, ML-DSA, and by extension the lattice core all at once -- the correlated break the map warns about. And this is not a thought experiment. In April 2024, Yilei Chen posted a paper claiming exactly such an algorithm. In little more than a week Chen withdrew the claim: a flaw in Step 9, found independently by Hongxun Wu and Thomas Vidick, could not be repaired ^{[40, 41]}. It must be cited only as retracted, never as a live break ^[42].

The algorithm did not survive contact with other experts -- but for a little over a week, serious people believed the lattice core might be gone. That interval is the point. The feared correlated break is unrealized, not impossible, and the field felt exactly how much rides on one assumption.

Shared structure between lattices and codes. As Section 7 noted, lattice sieving and code decoding both lean on nearest-neighbor search. Whether that shared tooling hides a deeper connection -- a single advance that erodes both bands -- is genuinely open. No reduction is known, no transfer has been demonstrated, and "no known reduction" is not "no possible link."

Whether the signature on-ramp adds real diversity. NIST is still recruiting more signature families, and the roster is a live test of the whole thesis.

The clock. Everything above would be an academic seminar if the timeline were comfortable. It is not, because of a single idea.

Michele Mosca turned this into a one-line risk test, $X + Y \geq Z$: if the years your data must stay secret ($X$) plus the years you need to migrate ($Y$) meet or exceed the years until a cryptographically relevant quantum computer ($Z$), your data is already at risk today ^[45].

# Mosca's inequality: if secrecy_life + migration_time >= time_to_quantum,
# your data is already exposed to harvest-now-decrypt-later.

def already_exposed(secrecy_life_years, migration_years, years_to_quantum):
  exposure = secrecy_life_years + migration_years
  print("Secrecy lifetime (X): " + str(secrecy_life_years) + " yr")
  print("Migration time  (Y):  " + str(migration_years) + " yr")
  print("Time to quantum (Z):  " + str(years_to_quantum) + " yr")
  if exposure >= years_to_quantum:
      print("EXPOSED: X + Y exceeds Z by " + str(exposure - years_to_quantum) + " yr. Migrate now.")
  else:
      print("Safe for now by " + str(years_to_quantum - exposure) + " yr. Keep watching Z.")

# A record that must stay secret 15 years, a 5-year migration, quantum in 12 years:
already_exposed(15, 5, 12)

For many long-lived secrets the inequality already bites, which is why the migration is being written into law rather than left to preference. The alarm is not new -- the NSA signaled it as early as 2015, when it announced plans to move away from its existing Suite B algorithms ^[46]. It has since hardened into deadlines: CNSA 2.0 sets a 2025-to-2033 timeline for national security systems ^[38], and Executive Order 14412 codifies migration requirements and the harvest-now-decrypt-later threat directly into federal policy ^[47].

None of the open questions is settled, and the clock is already running. So the only responsible move is to build a stack today that survives being wrong about any one of them. That turns out to be a concrete engineering task.

10. Building an Uncorrelated Stack on Monday#

Strip away the theory. Here is what to deploy, and the single rule that ties it together: watch the assumption, not the algorithm name.

Deploy hybrids. Run a classical key exchange and a post-quantum KEM together and combine their secrets, so that a break of the post-quantum half is not, by itself, a break of the session. The dominant TLS deployment is the hybrid group X25519MLKEM768; the closely related general-purpose combiner X-Wing ^[34] is built on the same X25519 and ML-KEM-768 primitives.

flowchart LR
X["X25519 shared secret"] --> KDF["Combiner / KDF"]
K["ML-KEM-768 shared secret"] --> KDF
KDF --> S["Session key (secure if either input holds)"]

This is not a hypothetical benefit. The empirical case for hybrids is already written. Cloudflare's earlier CECPQ2b experiment paired X25519 with the isogeny KEM SIKE, and any traffic recorded then stayed safe when SIKE broke -- the classical half still held ^[35]. A hybrid turned a total break into a non-event. A hybrid is the correlation lens applied to a single connection.

// A hybrid combines a classical secret and a post-quantum secret.
// The session key is safe as long as EITHER half is still unbroken.
function hybridSafe(classicalBroken, pqBroken) {
return !(classicalBroken && pqBroken);
}

for (const classicalBroken of [false, true]) {
for (const pqBroken of [false, true]) {
  const verdict = hybridSafe(classicalBroken, pqBroken) ? 'SAFE' : 'EXPOSED';
  console.log('classical broken=' + classicalBroken +
              ', PQ broken=' + pqBroken + '  ->  ' + verdict);
}
}
// Only the final row, where both are broken, prints EXPOSED.

Refuse a lattice monoculture. This is the mistake the whole article exists to prevent.

Pair the efficient lattice core with a backstop that shares nothing with it: SLH-DSA for signatures you need to trust for decades, and a code-based KEM -- HQC or Classic McEliece -- kept available for encryption. And because the lattice margin is the contested one, prefer the higher-margin parameter sets (ML-KEM-768 or 1024) over the smallest.

Build for replacement. No choice here is permanent, so the system must be able to change its mind.

Put together, the decision guide is short, and every row is chosen by assumption, not by benchmark:

One boundary, named once and handed off: the ways these schemes break in practice -- timing leaks in KEM decapsulation, the delicate floating-point sampling inside Falcon's signer, fault and power attacks -- are implementation attacks, a different and equally real surface owned by the sibling track. This section is about the mathematics you choose to deploy, not the code that runs it.

Every one of these moves is a refusal to concentrate -- the same refusal, at the level of a single deployment, that the whole standardization effort was reaching for. Which brings us back to the thesis, now with all the evidence in.

11. Common Misconceptions, Corrected#

The fastest way to misread everything above is to reach for one of these seven conclusions. Each is a precise trap, and each answer defends the portfolio rather than any single scheme.

Notice what every answer has in common: not one of them defends a single algorithm. They defend the portfolio.

12. The Portfolio Is the Product#

Put the evidence back together. Shor proved that two bets which looked independent -- factoring and discrete log -- were one bet on the abelian hidden-subgroup problem, and fell together the moment the right machine existed ^[7]. SIDH proved that a family can vanish in an afternoon, classically, with no warning, when a 1997 theorem finally met the auxiliary data the protocol had been publishing all along ^[1]. And the standardized stack, colored by assumption, clusters onto three families -- lattice, hash, and code -- with a genuinely correlated Module-LWE pair, ML-KEM and ML-DSA, sitting at its efficient center ^{[16, 17]}.

None of those assumptions is proven hard. None ever will be, short of settling questions about P, NP, and coNP ※ P is the class of problems solvable quickly; NP the class whose solutions can be verified quickly. Whether the two are equal is the central unsolved question of computer science. that have resisted fifty years of effort. And even if they were proven hard one at a time, no theorem could certify them uncorrelated, because uncorrelatedness is a promise about mathematics not yet invented. That is the humbling floor under the entire post-quantum project.

So the security of the stack was never going to be the strength of its strongest algorithm. It is the deliberate, dated refusal to let its bets be correlated: hash-only SLH-DSA standing apart from everything, the March 2025 selection of code-based HQC precisely because it is not a lattice, and an on-ramp still searching for more uncorrelated bets ^{[18, 19]}. Diversity here is not a hedge bolted onto the design. It is the design.

That reframes what we have actually been buying all along. Not a proof. A portfolio.

We cannot prove the stack secure. But we can, and did, refuse to bet it all on one piece of mathematics.

This is the sentence you were handed in the first section, now earned. We are not betting on a proof. We are betting that lattice, code, and hash will not all fail for the same reason on the same day -- and we have arranged things so that if we are wrong about one, we are not wrong about all three. For a science that can prove nothing hard, that disciplined refusal to concentrate is not a consolation prize. It is the whole defense, and it is the best one available for the thirty years we are wagering on it.