Parag Mali - tag: nist-pqc

How the NIST Finalists Broke: Rainbow in a Weekend, SIKE in an Afternoon, and the Graveyard of Post-Quantum Candidates

noreply@paragmali.com (Parag Mali) — Sun, 19 Jul 2026 00:00:00 GMT

Between February and August 2022, two vetted NIST post-quantum candidates were key-recovered on ordinary hardware by classical mathematics: **Rainbow**, an actual Round 3 signature finalist, in about 53 hours -- "a weekend" -- on a laptop; and **SIKE**, a key-exchange that had just advanced to Round 4, in about ten minutes on a single core, using a 1997 theorem that predates the scheme it destroyed. Neither fell to a quantum computer, an implementation bug, or a bad random number. The breaks hit the primitives' own algebra, and in both cases the exact feature that made the scheme competitive was the feature the attack exploited. That is not the competition failing. It is the competition working exactly as designed -- an industrial-scale, public cryptanalysis engine that runs unproven new primitives at the whole research community until the weak ones break cheaply, in the open, before anyone deploys them. The survivors we now standardize (ML-KEM, ML-DSA, SLH-DSA) earned their trust by attrition, not by proof -- and understanding that difference is the point of the whole story.

1. Rainbow in a weekend, SIKE in an afternoon

Over one weekend in February 2022, a laptop -- an ordinary one -- recovered the secret key of Rainbow, a digital-signature scheme that had survived five years of public scrutiny to stand as one of three finalists in NIST's competition to choose the cryptography that will outlive the quantum computer [@beullens-rainbow-2022-214]. Five months later, a second NIST candidate named SIKE fell in about ten minutes on a single processor core -- and not to a quantum computer, but to a theorem published in 1997, before the scheme it destroyed had even been invented [@castryck-decru-2022-975].

Neither break was a bug in the code, a leaked random number, or a padding mistake. Both were the mathematics of the primitive itself coming apart in public. And, improbably, that was the plan all along.

That sentence should stop you. Every earlier part of this series, "How It Breaks in Real Life," told the same reassuring story from a different angle: the mathematics held, and the machine around it leaked -- a predictable nonce, a downgrade, a validation bug, a random-number generator that was not random. The primitive almost never broke. This is the one chapter where it did. Rainbow and SIKE were not broken by their implementations. They were broken by their own algebra, on schedule, by a global research community that had been invited to try.

Key idea: A public cryptographic competition is not a bracket that picks the best design. It is an industrial-scale cryptanalysis engine. It runs unproven new primitives at the entire research community until the weak ones break on paper -- cheaply, classically, in the open -- so that the survivors are trusted not because anyone proved them secure, but because they are the ones nobody could break in time. Trust by attrition, not by proof.

Two facts of precision matter before we go further, because the popular retellings blur them. Rainbow was a genuine finalist: one of three signature schemes NIST named as finalists in July 2020, the last stop before standardization [@nistir-8309]. SIKE was not. SIKE was an alternate that advanced to a fourth round of study in July 2022 for its unusually small keys; it was never a finalist [@nistir-8413].The distinction is load-bearing. "Finalist" means Rainbow was on the short list NIST was prepared to standardize. "Alternate" means SIKE was kept in reserve. Both were vetted, public, and taken seriously -- which is exactly why their falls are evidence and not embarrassment. The gap between them is part of the point: two schemes at different tiers of the same competition, broken by two unrelated ideas, weeks apart.

One more honesty note frames everything below. These are not production incidents. There is no CVE for Rainbow, no vendor advisory for SIKE, no breach report. The incident class here is different and, for cryptographers, more interesting: the documented cryptanalytic collapse of candidate primitives during standardization, each grounded in its primary academic paper and the matching NIST status report. Nobody's data was stolen. Two pieces of proposed mathematics were shown, in public, to be weaker than their designers claimed.

"Rainbow is one of the three finalist signature schemes... our attack returns the corresponding secret key after on average 53 hours (one weekend) of computation time on a standard laptop." -- Ward Beullens, Breaking Rainbow Takes a Weekend on a Laptop, 2022

To see why two schemes this scrutinized could fall this cheaply -- and why cryptographers half-expected something like it -- you have to start with the thing that forced us onto young, untested mathematics in the first place.

2. Why hold a competition at all?

In 1994, Peter Shor proved that a large enough quantum computer could factor integers and compute discrete logarithms in polynomial time [@shor-1994]. That single result condemned almost all of the public-key cryptography the internet runs on. RSA, Diffie-Hellman, and elliptic-curve cryptography all rest on exactly those two problems, so they all die at once -- someday, when the hardware exists. The public-key internet was suddenly living on borrowed time.

The replacements had to come from somewhere else: hard problems with no known quantum shortcut. Five families volunteered. Lattices (find a short vector in a high-dimensional grid), error-correcting codes (decode a random-looking linear code), multivariate quadratics (solve a big system of quadratic equations over a finite field), isogenies (find a secret map between elliptic curves), and hash functions (invert nothing, just chain one-way functions together). Each family offered a problem believed to resist both classical and quantum attack.

The two public-key roles the competition had to refill. A **KEM** lets two parties agree on a shared secret key over a public channel -- the job Diffie-Hellman and RSA key transport do today. A **digital signature** lets anyone verify that a message came from the holder of a private key, without revealing it. Rainbow was a candidate signature scheme; SIKE was a candidate KEM. Different jobs, different mathematics, both broken.

Here is the tension the whole story turns on. "No known quantum attack" is a far weaker statement than "no known attack." These five families were young. Their classical security -- how they hold up against ordinary, non-quantum mathematics -- had been studied for years, not the decades of relentless attention that number theory had absorbed since RSA in 1977. Swapping a well-understood problem for a poorly-understood one to dodge a future threat is a trade that quietly imports a present risk. You have escaped Shor, but you have moved onto ground nobody has finished mapping.

A cryptographic building block whose security rests on a problem with no known efficient algorithm on either a classical or a quantum computer. "Post-quantum" is a claim about the *absence* of a known attack, not a proof of security -- a distinction that turns out to be the moral of the entire article.

NIST's answer to that imported risk was procedural, not mathematical: convert unknown risk into public cryptanalysis. In December 2016 it issued a formal Call for Proposals for post-quantum KEMs and signatures, with a submission deadline of 30 November 2017 [@nist-cfp-2016]. By that deadline, 82 algorithms had been submitted; 69 met the acceptance criteria and were posted as first-round candidates on 20 December 2017, spread across all five families [@nistir-8240]. The competition had begun with 69 live bets on unproven mathematics.

timeline title NIST PQC competition and the breaks it produced 2016 : NIST issues the Call for Proposals 2017 : 82 submissions, 69 first-round candidates 2019 : Round 2 narrows the field to 26 2020 : Round 3 names 7 finalists and 8 alternates : Rainbow a finalist, SIKE an alternate 2022 : Rainbow key-recovered in February : SIKE advances to Round 4 in July : SIKE key-recovered in July and August : first four standards selected 2024 : FIPS 203, 204 and 205 published in August 2025 : HQC selected as the fifth standard

Shor is the reason this contest exists, but his algorithm plays no further part in what follows.The mechanics of Shor's algorithm -- period-finding, the quantum Fourier transform, why a working quantum computer would end RSA -- belong to the companion "Q-Day" piece in this series. Here Shor is motivation only. Every break in this article is classical. None of the breaks below use a quantum computer. That is worth holding onto, because it is easy to assume "post-quantum scheme broken" means "broken by a quantum machine." It means the opposite: these schemes were supposed to resist quantum computers, and they fell to ordinary ones.

NIST had run this exact play twice before, with AES in the late 1990s and SHA-3 a decade later [@nist-aes-development, @nist-sha3-project]. Both times the goal was not to pick the cleverest design on paper -- it was to let the whole world attack every design until the weak ones fell. That is a stranger idea than it sounds, and it is worth taking seriously on its own terms.

3. A broken scheme is a deliverable, not a scandal

Reframe the whole exercise this way: in an open cryptographic competition, a broken candidate is not a failure. It is a product. The question the competition asks is never "will any of these schemes break?" -- of course some will -- but "how far does each one get before it does?" A scheme that breaks in Round 1 has done its job by revealing a bad idea cheaply. A scheme that survives to Round 3 and then breaks has done something more useful: it has told the community that an idea which looked strong for years was still not strong enough.

NIST did not invent this method for post-quantum cryptography. The Advanced Encryption Standard (1997 to 2001) and SHA-3 (2007 to 2012) were both chosen by open, multi-year public contests in which the world's cryptanalysts were invited to attack every submission. The winners -- Rijndael and Keccak -- were trusted precisely because they had run that gauntlet in the open and survived [@nist-aes-development, @nist-sha3-project]. Closed-door design by a single authority carries the opposite reputation for good historical reasons. Sunlight is the security argument.

This is the interpretive key to everything that follows, so it deserves a name.

The only kind of confidence a competition can actually produce: not a proof that a scheme is secure, but the accumulated observation that the entire research community, given years and strong incentives, failed to break it. Attrition yields *evidence* of hardness. It never yields *proof*. A scheme trusted by attrition is one that has been attacked in the open and has not yet fallen -- with the emphasis on "yet."

Read against that definition, the funnel of the NIST competition is not a story of disappointing losses. It is the machine running. Sixty-nine first-round candidates narrowed to 26 in the second round, then to 15 in the third -- seven finalists and eight alternates -- then to a handful of standards [@nistir-8240]. Each narrowing is a batch of schemes that either broke, weakened under analysis, or lost on performance to a survivor. The attrition rate is the yield of the engine, and you can compute it directly.

{` // NIST PQC standardization, headcount at each stage const rounds = [ { name: 'Submitted 2017', count: 82 }, { name: 'Round 1 accepted', count: 69 }, { name: 'Round 2', count: 26 }, { name: 'Round 3 (7 finalists + 8 alternates)', count: 15 }, { name: 'Selected for standardization by 2025', count: 5 }, ];

for (let i = 1; i < rounds.length; i++) { const prev = rounds[i - 1]; const cur = rounds[i]; const rate = ((cur.count / prev.count) * 100).toFixed(0); console.log(prev.name + ' -> ' + cur.name + ': ' + cur.count + ' of ' + prev.count + ' survived (' + rate + '%)'); }

// The signature cohort specifically: 9 schemes entered Round 2, only 3 reached standardization const sigStart = 9, sigSurvived = 3; const sigRate = ((sigSurvived / sigStart) * 100).toFixed(0); console.log('Signatures: ' + sigSurvived + ' of ' + sigStart + ' Round-2 schemes survived = ' + sigRate + '%');

// End to end console.log('Overall: ' + ((5 / 82) * 100).toFixed(1) + '% of submissions reached standardization'); `}

Run it and the abstraction becomes concrete. Two-thirds of the signature schemes that reached the second round did not survive to standardization. "New-primitive breaks are frequent" stops being a slogan and becomes a measured survival rate.

Note: It is tempting to read a candidate's collapse as the competition catching a mistake. The sharper reading is that producing the collapse -- in public, on paper, before deployment -- is the competition's entire reason to exist. The engine's output is not the winner. Its output is every break that happened along the way, each one a bad primitive removed from the world's future at the cost of a research paper instead of a breach.

So let us walk the graveyard the way the competition actually produced it -- round by round -- and watch two entire families of "quantum-proof" mathematics come apart.

4. The graveyard, round by round

Picture the competition as a funnel. Eighty-two schemes go in at the top; five come out the bottom as standards. In between, the walls of the funnel are lined with the schemes that did not make it -- and the two families we are about to follow were not merely thinned. They were emptied.

flowchart TD A["82 submissions in 2017"] --> B["69 first-round candidates"] B --> C["26 second-round candidates"] C --> D["15 in Round 3: 7 finalists and 8 alternates"] D --> E["4 selected in 2022"] E --> F["5th standard HQC in 2025"] D --> G["Rainbow: finalist, broken February 2022"] D --> H["SIKE: alternate to Round 4, broken July 2022"]

Round 1 was a high-throughput first pass. Between the December 2017 opening and the January 2019 cut to 26, a steady stream of first-round candidates fell to analysis, and many of the losses were individually minor -- a parameter set adjusted here, a scheme withdrawn there [@nistir-8240]. This is the engine idling at full speed: cheap early breaks that cost a preprint apiece and cleared out the obviously fragile before serious attention concentrated on the rest. The interesting deaths came later, once schemes had earned enough trust that breaking them actually meant something.

The multivariate family thins

To watch the first family die, you need one black-box idea.

A multivariate signature scheme publishes, as its public key, a system of quadratic equations over a finite field that looks random. Solving a generic such system is believed hard -- the MQ problem is NP-hard in the worst case. The secret key is a hidden change of variables that splits the variables into "oil" and "vinegar" so that the system becomes easy to solve in one direction. The whole family lives or dies on one question: does the hidden structure that makes the trapdoor work leave a detectable fingerprint in the public key?

It does, and the family's history is a chain of such fingerprints. Jacques Patarin's balanced Oil-and-Vinegar was broken by Aviad Kipnis and Adi Shamir in 1998 [@ks-ov-1998], which forced the unbalanced redesign published as UOV in 1999 [@uov-1999]; a separate big-field branch, Hidden Field Equations, had appeared in 1996 [@hfe-1996].

The first casualty of the NIST era itself was LUOV, a "lifted" Unbalanced Oil-and-Vinegar scheme whose public map was defined cleverly over the field with two elements to shrink keys. In December 2019, Jintai Ding and colleagues showed that this lifted structure could be pushed down into a smaller subfield, dropping the cost of key recovery below the security levels LUOV had claimed [@luov-2019-1490]. LUOV did not survive to the third round.

A year later, in November 2020, the other surviving multivariate signature -- GeMSS, a Round 3 alternate built on the big-field HFE branch of the family -- was key-recovered by Chengdong Tao, Albrecht Petzoldt, and Jintai Ding, who showed the scheme's "Minus" and "Vinegar" modifiers added essentially no security and left GeMSS "not as secure as claimed" [@gemss-hfev-2020-1424].

Two more signatures, MQDSS (multivariate) and qTESLA (lattice-based), dropped out at the Round 3 selection without a single dramatic break paper: MQDSS under pressure on its five-pass Fiat-Shamir construction, qTESLA superseded on size and performance by the lattice signatures Dilithium and Falcon. NIST's status report records their elimination; honesty requires noting there is no verified key-recovery paper for either, only the competition quietly declining to advance them [@nistir-8309]. The family was being emptied from several directions at once.

flowchart TD OV["Oil and Vinegar, 1997"] -->|Kipnis-Shamir break, 1998| UOV["Unbalanced Oil and Vinegar, 1999"] UOV --> RB["Rainbow: layered UOV 2005, broken 2022"] UOV --> LUOV["LUOV: lifted UOV, broken 2019"] UOV --> SURV["Plain UOV and MAYO: survive"] HFE["Hidden Field Equations, 1996"] --> GEMSS["GeMSS and HFEv-, broken 2020"]

One person threads through this whole graveyard, and the irony is worth pausing on.Ward Beullens co-designed LUOV, one of the schemes the multivariate family lost. He then wrote the attacks that weakened and broke Rainbow, the family's finalist. He now designs MAYO, a plain-UOV revival competing in NIST's signature on-ramp. The same researcher helped build, dismantle, and rebuild the family across a decade -- which is exactly what a healthy cryptanalytic community looks like. By late 2020, every multivariate signature in the competition except one had been broken or dropped. The exception was sitting on the finalist podium.

Rainbow: weakened, then broken

Rainbow is a layered Unbalanced Oil-and-Vinegar scheme designed by Jintai Ding and Dieter Schmidt in 2005 [@rainbow-2005]. Stacking several Oil-and-Vinegar maps in layers let it shrink its keys and signatures, which is exactly why it was competitive enough to reach the finalist round in 2020. That layering is also the extra structure the attack would grip.

The break came in two acts. In October 2020, while Rainbow sat among the three signature finalists, Ward Beullens published two new attacks -- an "intersection" attack and a "rectangular MinRank" attack -- that reduced the cost of Rainbow key recovery by factors reported as large as $,2^{73}$, enough to show that every submitted Rainbow parameter set fell short of the NIST security level it claimed [@beullens-2020-1343]. Rainbow was wounded but not yet dead; NIST kept it as a finalist while its parameters were re-examined.

Then, in February 2022, Beullens finished the job. Building on the same rectangular-MinRank idea, he recovered a full Rainbow secret key for the level-1 parameters in, on average, 53 hours -- one weekend -- on a standard laptop [@beullens-rainbow-2022-214]. Not a supercomputer. Not a cluster. A laptop, over a weekend. With that, the multivariate signature cohort as submitted to NIST was effectively extinct.

Round 4: SIKE, and the 1997 theorem

The second family died faster and more strangely. To follow it you need two more black-box ideas.

An **isogeny** is a structure-preserving map between two elliptic curves. In Supersingular Isogeny Diffie-Hellman (**SIDH**), proposed by David Jao and Luca De Feo in 2011 [@sidh-2011] and detailed in a 2014 journal version [@defeo-jao-plut-2014], each party's secret is a walk through a graph of supersingular curves, and the shared secret comes from combining the two walks. Its appeal was bandwidth: SIDH, packaged as the KEM named **SIKE**, had the smallest keys of any post-quantum key exchange in the competition [@sidh-2011, @round4-news-2022]. For SIDH to work, each party must publish not just the curve their secret walk ended on, but the *images* of certain public reference points (torsion points) under that secret walk. This auxiliary data is required for correctness -- the two parties cannot combine their walks without it. It is also, as of 2022, the exact information an attacker needs. The data the protocol must publish to function is the lever that breaks it.

On 5 July 2022, NIST selected its first four standards and advanced four KEMs -- including SIKE -- into a fourth round for continued study [@nistir-8413]. SIKE went in as an alternate, attractive for its small keys, never a finalist [@round4-news-2022].

Twenty-five days later, on 30 July 2022, Wouter Castryck and Thomas Decru posted a classical key-recovery attack on SIDH that broke SIKEp434 -- the level-1 parameter set -- in about ten minutes on a single core [@castryck-decru-2022-975]. Their method rested on a reducibility criterion Ernst Kani had proved in 1997, a pure result about when a genus-2 curve's Jacobian splits into a product of elliptic curves, written 14 years before SIDH existed and with no cryptographic intent whatsoever [@kani-1997]. The attack fed SIDH's published torsion-point images into Kani's criterion and reconstructed the secret walk step by step.The timing is the thesis in miniature: SIKE advanced on 5 July 2022 and was broken on 30 July 2022. Twenty-five days as a NIST Round 4 candidate, then key-recovered on one processor core. The competition did not fail to catch SIKE. The competition caught SIKE, precisely on the schedule an open cryptanalytic process runs on.

What happened next is why the isogeny KEM line did not merely stumble but collapsed. Within nine days, Luciano Maino and Chloe Martindale removed the attack's dependence on SIKE's special starting curve, generalizing it to an arbitrary starting curve at subexponential cost [@maino-martindale-2022-1026]. Two days after that, on 10 August 2022, Damien Robert closed the door completely: SIDH can be broken in classical polynomial time, even from a random starting curve [@robert-2022-1038]. Eleven days, three papers, and an entire family of key exchange was finished.

Note: Say it plainly, because the name misleads: no quantum computer was involved in breaking SIKE. The attack is classical mathematics running on ordinary hardware. A five-year warning even existed -- Christophe Petit had shown in 2017 that publishing torsion-point images makes isogeny problems easier to solve [@petit-2017-571]. And this attack targets SIDH, not CSIDH: the commutative isogeny scheme CSIDH does not publish torsion images, so Kani's lever does not reach it. SIDH fell; CSIDH still stands.

One more clarification keeps the record honest. A separate SIKE attack, Hertzbleed, had been disclosed about six weeks earlier, on 14 June 2022 -- but that was a frequency side channel leaking keys from an implementation, an entirely different failure class that belongs to the implementation-break sibling in this series, not to the mathematics break we are tracing here [@hertzbleed].Keeping the two apart is essential to the series' argument. Hertzbleed is "the machine leaked." Castryck-Decru is "the math broke." They happened to hit the same scheme six weeks apart, which makes the contrast unusually clean.

Scheme	Competition standing	Break (primary source)	Cost / result	Mechanism
LUOV	Round 2 signature candidate	Ding et al., 2019 [@luov-2019-1490]	Below claimed NIST levels	Subfield attack on the "lifted" structure
GeMSS (HFEv-)	Round 3 alternate	Tao, Petzoldt, Ding, 2020 [@gemss-hfev-2020-1424]	"Not as secure as claimed"	Modifiers add little security
Rainbow	Round 3 finalist	Beullens, 2022 [@beullens-rainbow-2022-214]	Level-1 key in ~53 h on a laptop	Rectangular MinRank on layered Oil-and-Vinegar
MQDSS	Round 2 signature candidate	Eliminated per NISTIR 8309 [@nistir-8309]	Not advanced to Round 3	Pressured (five-pass Fiat-Shamir)
qTESLA	Round 2 signature candidate	Eliminated per NISTIR 8309 [@nistir-8309]	Not advanced to Round 3	Superseded by Dilithium and Falcon
SIKE	Round 3 alternate to Round 4	Castryck, Decru, 2022 [@castryck-decru-2022-975]	SIKEp434 key in ~10 min on one core	Kani's criterion on published torsion images

Two families, emptied by two ideas. Strip away the scheme names and the same shape appears in both: the exact feature that made each scheme competitive -- Rainbow's layering, SIDH's published torsion images -- is the exact feature the attack used to break it. That pattern is the real story, and it is worth slowing down to see clearly.

5. Two ideas, and the idea behind them

Great cryptanalytic breaks are almost never brute force. They are a change of viewpoint -- a moment where someone looks at a public key and sees a different, easier problem hiding inside it. Both 2022 breaks are one sentence long once you see them. Here is each, made legible without the heavy machinery.

Rainbow: the low-rank fingerprint

Start with what a multivariate public key actually is. Each of its quadratic equations can be written as a symmetric matrix, so the public key is a list of matrices $P_1, P_2, \ldots, P_m$. Rainbow's hidden trapdoor -- the layered oil-and-vinegar structure that lets the signer invert the system -- forces something specific to be true about those matrices: a particular linear combination $\sum_i x_i P_i$ of them has unusually low rank. Find that low-rank combination and you have found a shadow of the secret.

Given a collection of matrices, find a linear combination of them that has rank at most some small target $r$. MinRank is NP-hard in general, but for a scheme whose secret *plants* a low-rank combination, the problem is not generic -- the structure is there to be found. Recovering a multivariate trapdoor repeatedly reduces to MinRank, which is why cryptographers call it the family's recurring weapon.

Beullens' insight was to reshape Rainbow's specific layered structure as a rectangular MinRank instance -- a form of the problem that is dramatically easier to solve than the general case -- and to combine it with an "intersection" step on the scheme's oil subspaces. Together these collapse the search space until the secret key falls out on commodity hardware [@beullens-2020-1343, @beullens-rainbow-2022-214]. The move that matters is subtle and central: Rainbow's layering was added to make keys small, and that same layering is the low-rank structure the attack reads. The optimization did not sit alongside the vulnerability. The optimization was the vulnerability.

flowchart LR A["Read the public key as quadratic forms, i.e. matrices"] --> B["Use Rainbow's layering to set up a rectangular MinRank instance"] B --> C["Solve MinRank: find the low-rank combination"] C --> D["Recover the hidden oil subspace"] D --> E["Peel the layers, recover an equivalent secret key"]

None of this was born in 2022. MinRank has been the murder weapon of the multivariate family since 1999, when Aviad Kipnis and Adi Shamir showed that recovering the key of the HFE cryptosystem reduces to a MinRank instance [@ks-hfe-relin-1999]. Every subsequent optimization of the family -- layering in Rainbow, lifting in LUOV, the modifiers in GeMSS -- added structure that some MinRank-flavored attack could eventually grip. Beullens did not invent a new weapon. He found a better way to aim an old one.

SIKE: the data the protocol had to publish

The SIKE break has the same shape, dressed in different mathematics. Recall that SIDH cannot run without publishing the torsion-point images -- the images of fixed public points under each party's secret isogeny. That auxiliary data is not optional; it is what makes the key exchange combine correctly. Castryck and Decru's move was to feed exactly that data into a criterion Kani proved in 1997.

A 1997 theorem in the arithmetic of abelian surfaces that tells you when an abelian surface (a two-dimensional abelian variety) splits as a product of elliptic curves. The attack builds an auxiliary isogeny in dimension two (later, higher dimensions) out of SIDH's published torsion images, then uses Kani's criterion as a yes/no test: does this object split? A "yes" confirms a guessed piece of the secret isogeny, so the criterion becomes an oracle that reconstructs the secret walk one step at a time. flowchart LR A["Take the torsion-point images SIDH publishes"] --> B["Build an auxiliary higher-dimensional isogeny from them"] B --> C["Apply Kani's criterion: does it split as a product?"] C --> D["Each split confirms a piece of the secret walk"] D --> E["Walk the secret isogeny to full key recovery"]

Robert soon proved the general version runs in classical polynomial time from any starting curve [@robert-2022-1038]. And the warning had been on the record for years: in 2017, Christophe Petit had explicitly shown that the extra torsion-point information SIDH exposes makes its underlying problem easier, a five-year flare that the field noticed but could not yet turn into a full break [@petit-2017-571].

The deeper point is not "quantum computers are here." It is that a scheme can be perfectly safe against the threat you designed for and fatally exposed to the ordinary mathematics you did not.

The lever, again, was the feature. SIDH published torsion images because it had to; that requirement is what Kani's criterion turned into a key. And the criterion itself is the most striking detail of the whole affair.Kani wrote his 1997 paper about the number of genus-2 curves with elliptic differentials. It had no cryptographic purpose. The mathematical object that would recover a SIKE key in ten minutes sat, fully formed, in a number-theory journal for 25 years, waiting for someone to notice it applied.

The Castryck-Decru attack "breaks SIKEp434... in about ten minutes on a single core" -- and it does so with mathematics published before the scheme it destroyed existed.

The idea behind the ideas

Step back and notice what neither break required. Neither Beullens nor Castryck-Decru invented exotic new machinery. Each recognized that mathematics already sitting in the literature -- MinRank reductions from 1999, Kani's criterion from 1997 -- applied to the specific structure the target scheme was forced to expose. The breakthrough was recognition, not invention.

Key idea: The optimization was the leak. Rainbow's layering and SIDH's published torsion images were not incidental weaknesses next to the good parts of each design -- they were the good parts. Every feature that made these schemes competitive was structure, and structure is exactly what a cryptanalyst reads. The conservative, un-optimized ancestors survived; the clever, efficient descendants died.

This is what a competition industrializes. Cheap, public, classical cryptanalysis, run at global scale for years, is the machine that converts "we believe this is hard" into "this fell on a laptop." The competition is not the stage on which these breaks happened to occur. It is the instrument that produced them -- the reason someone finally looked at SIDH's torsion images through the lens of a 25-year-old theorem. If a machine this effective at breaking things left some schemes standing, the obvious question is what those survivors are, and whether we should trust them any more than we trusted Rainbow the week before it fell.

{` // A toy over GF(7): a random combination of matrices is full rank, // but a "planted" combination (the trapdoor's shadow) is low rank. const P = 7; const mod = x => ((x % P) + P) % P; const inv = a => { let r = 1, b = mod(a), e = P - 2; while (e > 0) { if (e & 1) r = mod(r * b); b = mod(b * b); e >>= 1; } return r; };

const n = 5; const randVec = () => Array.from({ length: n }, () => Math.floor(Math.random() * P)); const outer = a => a.map(ai => a.map(aj => mod(ai * aj))); // rank-1 symmetric const add = (A, B) => A.map((r, i) => r.map((x, j) => mod(x + B[i][j]))); const sub = (A, B) => A.map((r, i) => r.map((x, j) => mod(x - B[i][j]))); const randSym = () => { const M = outer(randVec()); return add(M, outer(randVec())); };

// Plant a rank-2 target L = a a^T + b b^T, then force the sum of 4 matrices to equal it. const L = add(outer(randVec()), outer(randVec())); // rank <= 2 const mats = [randSym(), randSym(), randSym()]; mats.push(sub(L, add(add(mats[0], mats[1]), mats[2]))); // now mats sum to L

const combine = (c) => mats.reduce((acc, Mk, k) => acc.map((r, i) => r.map((x, j) => mod(x + c[k] * Mk[i][j]))), Array.from({ length: n }, () => new Array(n).fill(0)));

const randCoeffs = Array.from({ length: 4 }, () => 1 + Math.floor(Math.random() * (P - 1))); console.log('rank of a random combination :', rank(combine(randCoeffs))); // typically 5 console.log('rank of the planted combination:', rank(combine([1, 1, 1, 1]))); // 2 -- the fingerprint `}

6. The survivors, and why we provisionally trust them

On 13 August 2024, NIST published the survivors: the first three finalized post-quantum standards [@nist-press-2024]. It is worth being precise about what they are. They are not the schemes that were proven safe -- none of them were. They are the schemes that nobody could break in time.

Three came first. ML-KEM (FIPS 203) [@fips-203], the key-encapsulation mechanism derived from CRYSTALS-Kyber [@pqcrystals-kyber], is the lattice workhorse: keys and ciphertexts of roughly one kilobyte, fast enough to be a near drop-in for elliptic-curve key agreement. ML-DSA (FIPS 204) [@fips-204], from CRYSTALS-Dilithium [@pqcrystals-dilithium], is the default signature, chosen for a balance of size, speed, and implementation safety.

SLH-DSA (FIPS 205) [@fips-205], from SPHINCS+ [@sphincs-org], is the conservative hedge: it signs using nothing but hash functions, so its keys are tiny (32 to 64 bytes) but its signatures are enormous and slow, running from about 8 kilobytes to nearly 50. A fourth lattice signature, FN-DSA (Falcon), is still in draft as FIPS 206 -- it produces the smallest signatures of the group but is delayed because its floating-point sampling is hard to implement safely [@cloudflare-pq-2024].

NIST rates each parameter set against a familiar yardstick rather than an absolute bit count. Category 1 means "at least as hard to break as recovering an AES-128 key by exhaustive search"; category 3 pegs to AES-192; category 5 to AES-256. Categories 2 and 4 peg to the difficulty of finding a SHA collision. This lets wildly different mathematics -- lattices, codes, hashes -- be compared on one scale. The assumption under both ML-KEM and ML-DSA. Given a public matrix $A$ over a polynomial ring and a value $b = A s + e$, where the secret $s$ and the noise $e$ are small, recovering $s$ is believed hard. "Module" refers to the algebraic structure that makes the scheme efficient -- and, as we will see, is also the structure whose security is not fully covered by the field's best hardness theorems.

The two code-based KEMs tell the conservatism story most clearly. Classic McEliece rests on the hardness of decoding a random-looking linear code -- a scrambled binary Goppa code assumed indistinguishable from random -- an idea Robert McEliece proposed in 1978; the cost of the best attack against it has barely moved in more than 45 years of trying [@classic-mceliece-org], and its one-way encryption is turned into a modern key-encapsulation mechanism by a tight security reduction [@kem-unification-2018-526]. Its price is a public key measured in hundreds of kilobytes to well over a megabyte, which is why NIST in 2025 declined to standardize it directly and deferred to an ISO effort already underway [@nistir-8545].

Its structural cousin HQC, based on decoding quasi-cyclic codes, was selected in March 2025 as the fifth standard [@hqc-news-2025].HQC is the second KEM NIST standardized, and its selection is a deliberate hedge: if a structural idea ever breaks the lattice assumption under ML-KEM, HQC is a code-based fallback resting on entirely different mathematics. A portfolio only insures you if its members can fail independently.

Survivor	Family	Role	Sizes (approx)	Assumption maturity	NIST status
ML-KEM (FIPS 203)	Lattice (Module-LWE)	KEM	keys and ciphertext ~0.8 to 1.6 KB	High (most-attacked young assumption)	Final, Aug 2024
ML-DSA (FIPS 204)	Lattice (Module-LWE + SIS)	Signature	pk 1.3 to 2.6 KB, sig 2.4 to 4.6 KB	High	Final, Aug 2024
FN-DSA / Falcon	Lattice (NTRU)	Signature	sig ~0.7 to 1.3 KB (smallest)	High	Draft FIPS 206 (delayed)
SLH-DSA (FIPS 205)	Hash	Signature	pk 32 to 64 B, sig ~8 to 49 KB	Highest (hash-only)	Final, Aug 2024
Classic McEliece	Code (binary Goppa)	KEM	pk 261 KB to 1.36 MB, ct ~0.1 to 0.2 KB	Highest (since 1978)	Deferred to ISO
HQC	Code (quasi-cyclic)	KEM	pk ~2.2 KB, ct ~4.5 KB	Medium	Selected 2025, draft

The on-thesis reading of this list is the whole point of the section. "State of the art" here does not mean "proven best." It means residue of attrition -- the primitives the offensive engine of the last decade could not reach in time. That distinction is not academic hand-wringing. It is the honest status of every algorithm now being deployed at internet scale: ML-KEM hybrids already carry real traffic in Chrome, Cloudflare, Apple's iMessage PQ3, and Signal, and the migration is accelerating on the assumption that these schemes will hold [@cloudflare-pq-2024].

Note: The survivors have been hit, but not on their mathematics. Timing and fault side channels with names like KyberSlash have leaked secrets from specific ML-KEM implementations [@cloudflare-pq-2024]. Those are exactly the "the machine leaked" failures the rest of this series covers -- the companion piece "How ML-KEM Breaks in Real Life" is their proper home. They do not touch the Module-LWE assumption itself, and this article is strictly about breaks of the mathematics.

There is one more thing the word "survived" hides. These schemes survived as several separate bets, not one. To see why NIST standardized a whole portfolio rather than crowning a single winner, you have to look at the five families side by side -- and pay attention to which two are missing.

7. Five families, five bets

NIST never intended to crown one algorithm. It intended to place several independent bets on unrelated mathematics, so that a single new idea could not sink the entire standard at once. Read that way, the competition is a portfolio, and 2022 was the year two of its holdings went to zero. The value of the diversification stopped being a hypothetical and started paying out in real time.

Walk the five families by how much of the engine each one survived.

Lattices are the biggest bet, and they held. Module-LWE was the most-attacked young assumption in the whole competition, and it produced the KEM and the default signature. It survived not by being old but by absorbing the most punishment and still standing. Codes survived by pedigree: Classic McEliece has been under attack since 1978, and HQC gives the standard a second, structurally distinct code-based option [@classic-mceliece-org].Robert McEliece proposed his code-based cryptosystem in 1978, one year after RSA -- and unlike RSA, it has no known quantum shortcut. Its best attack has barely improved in more than four decades [@mceliece-1978]. The conservatism dividend is real: the oldest idea in the room is the one nobody has laid a finger on. Hashes survived by minimalism: SLH-DSA assumes only that a hash function behaves like a hash function, the most conservative bet available.

The other two families are the graveyards we walked. Multivariate signatures are near-extinct in their submitted forms: Rainbow, GeMSS, LUOV, and MQDSS are all gone, emptied by the MinRank weapon and by competitive pressure. Isogeny key exchange collapsed with SIDH and SIKE.

flowchart TD ROOT["Five hard-problem families"] --> LAT["Lattices: survived (ML-KEM, ML-DSA)"] ROOT --> COD["Codes: survived (Classic McEliece, HQC)"] ROOT --> HSH["Hashes: survived (SLH-DSA)"] ROOT --> MV["Multivariate: pruned by MinRank"] ROOT --> ISO["Isogeny KEM: pruned by Kani's criterion"] MV --> MVD["Rainbow, GeMSS, LUOV dead"] ISO --> ISOD["SIKE dead, CSIDH and SQIsign survive"]

But "family dead" is too coarse, and the nuance is the most instructive part. Within the isogeny family, the collapse was specific to schemes that publish torsion-point images. CSIDH, a commutative isogeny scheme, does not publish that data, so Kani's lever never reaches it [@csidh-2018-383]. SQIsign, an isogeny signature built from endomorphism rings rather than torsion images, also survives, and it offers the smallest post-quantum signatures of any candidate [@sqisign-2020-1240]. SIDH fell; two of its cousins are still standing. The multivariate family shows the same pattern in reverse: plain, un-optimized Unbalanced Oil-and-Vinegar with its large keys resists MinRank, and Beullens' own MAYO -- a plain-UOV revival -- is now competing in NIST's signature on-ramp [@mayo-2021-1144]. The clever descendants died. The conservative ancestors lived.

Family	Hard problem	Optimized for	Outcome in the competition
Lattices	Module-LWE / NTRU	Balance of size and speed	Survived: ML-KEM, ML-DSA, Falcon
Codes	Syndrome decoding	Decades of stability	Survived: Classic McEliece (ISO), HQC
Hashes	Hash preimage resistance	Minimal assumptions	Survived: SLH-DSA
Multivariate	Structured MQ trapdoors	Small keys and signatures	Near-extinct: Rainbow, GeMSS, LUOV dead
Isogenies	Supersingular isogeny walk	Smallest keys	KEM line dead (SIKE); CSIDH, SQIsign live

The Round 3 record makes the diversification argument concrete. When Rainbow and SIKE were named finalist and alternate respectively, they were live bets [@nistir-8309]. When they broke, the standard did not break with them, because the other bets were still there [@nistir-8413]. That is the entire case for a portfolio, demonstrated under fire.

NIST did not fail to pick a single winner. It refused to bet the internet's future on one idea -- and in 2022, two of its five ideas proved exactly why that refusal was wise.

A portfolio hedges against surprise. What it cannot do is prove that anything in it is safe -- and it is worth being precise about exactly what all this attrition does and does not buy us.

8. What a competition can prove, and what it cannot

Here is the sentence the whole field quietly lives with: not one of the survivors has been proven secure. Not ML-KEM, not ML-DSA, not SLH-DSA, not any of them. Every one rests on an assumption that no one has proved -- that Module-LWE is hard, that syndrome decoding is hard, that the underlying hash behaves ideally. Attrition gave us strong evidence for those assumptions. It gave us no proof.

Lattices have the best theoretical footing in the portfolio, and it is worth understanding exactly how far that footing extends -- because it stops short of where intuition wants it to go. Lattice schemes enjoy a worst-case-to-average-case reduction: Regev's original result, extended to module lattices by Langlois and Stehle, shows that breaking a random instance of Module-LWE is at least as hard as solving certain lattice problems in the worst case [@langlois-stehle-2012-090]. That is a genuinely strong guarantee, and no other family has anything like it.

But read the fine print. The reduction lands on module-lattice problems, a restricted class, and the quantum hardness of even those problems is itself unproven. That reduction is also asymptotic and, in its original form, quantum: it vouches for the family's structure, not for the concrete parameters ML-KEM and ML-DSA actually ship. Codes and multivariate schemes have no average-case reduction at all; their security is precisely "no one has found a good enough attack yet."

A proof that breaking a *randomly chosen* instance of a problem is at least as hard as solving the *hardest* instance of a related problem. It matters because cryptography needs random keys to be hard, not just some cherry-picked key. Lattices have such a reduction; codes and multivariate schemes do not, which is part of why the multivariate family's structured instances turned out to be so much weaker than the worst case suggested.

What sets the other boundary is complexity theory itself. The best known attacks are the yardsticks the parameters are chosen against: lattice sieving at a heuristic cost of $,2^{0.292,\beta + o(\beta)}$ in the blocksize $\beta$ [@bdgl-2015-1128]Blocksize is the dimension of the sub-lattice the reduction algorithm tackles at each step. A larger blocksize means a stronger attack but exponentially more work, which is exactly the tradeoff parameter-setters exploit to fix a security level., information-set decoding for codes, and Grover's quadratic speedup as the only quantum lever against a hash-based signature -- a speedup too shallow to matter at real parameter sizes [@grover-1996]. None of these has broken a standardized parameter set. But "has not broken" is the operative phrase, and it cannot be upgraded to "cannot break" by any theorem we possess.

Key idea: Standardized means survived the engine. It does not mean proven secure. A real proof of security for any of these schemes would imply $P \neq NP$ -- and more than that in the quantum setting -- so provably secure post-quantum cryptography is out of reach on principle today. Absence of a break is not a proof of security. It is the best evidence we can get, and it is not the same thing.

The bedrock results underneath do not close the gap either. Solving a generic system of multivariate quadratics is NP-hard; decoding a general linear code is NP-complete [@syndrome-decoding-1978]. Those are worst-case statements, and the entire multivariate graveyard is the story of what happens when a scheme needs a trapdoor and therefore uses structured, non-worst-case instances. The NP-hardness of the general problem never protected the specific scheme.

This is where this article reconciles with the rest of the series. For shipping, decades-vetted primitives -- AES, RSA, the TLS you use today -- the mathematics almost never breaks; when those systems fail, the machine around them leaks. That hedge stands. But "almost never" is not "never," and this chapter is the "not never." Inside an open competition, running young and unvetted primitives at the whole world on purpose, the mathematics genuinely did break -- twice, in one year. That is not a contradiction of the series. It is the boundary condition the series always implied, made visible. The survivors are trusted not because anyone proved them secure, but because they are the ones nobody could break in time. Trust by attrition, not by proof.

If proof is impossible and the only evidence we have is "nobody has broken it yet," the natural next question is uncomfortable: is one of the survivors already living on borrowed time, the way Rainbow was in 2021?

9. Is any survivor next?

The engine did not switch off when the standards published. It is still running, now aimed at the survivors -- and in April 2024 it briefly looked as if it had caught one.

That month, Yilei Chen posted "Quantum Algorithms for Lattice Problems," claiming a polynomial-time quantum algorithm for LWE [@chen-2024-555]. If it held, it would have threatened ML-KEM and ML-DSA at once -- the KEM and the default signature, the majority of the entire migration, gone in a single paper. For a few days the lattice world held its breath. Then the engine did what the engine does. Within days, Hongxun Wu and, independently, Thomas Vidick found a fatal bug in the algorithm's Step 9, and Chen appended a note that the claim "does not hold" [@chen-2024-555].The Chen episode is the thesis in fast-forward. A claimed break of the survivors appeared, the community attacked it in the open, and the claim itself broke within days -- Wu and Vidick locating the flaw in Step 9. The same cheap, public, classical cryptanalysis that emptied the multivariate family now runs continuously over the schemes we standardized.

Note: It is a mistake to read the Chen scare as a near-miss that we got lucky on. The right reading is that the machine worked exactly as designed, one more time: no claim about these primitives -- for or against -- goes unchecked for long. That is the only thing standing between "we trust ML-KEM" and "we were wrong about ML-KEM," and it never stops.

The same machine is visibly still emptying the multivariate family. Because the graveyard thinned the signature portfolio so badly, NIST opened an "additional signatures" on-ramp in 2023 [@nist-addsig-call]. Of its 40 first-round submissions, about 10 were broken within months [@cloudflare-pq-2024]. The exact rectangular-MinRank weapon that finished Rainbow transferred straight to the key-compressed successors: the parameters of VOX fell to a padded-MinRank attack that broke eight of nine sets in under a minute [@vox-2024-166], while MAYO, QR-UOV, and SNOVA saw parameter-weakening analyses. Plain, large-key UOV kept resisting. When NIST advanced 14 candidates to the on-ramp's second round in October 2024, the pattern from the first competition was repeating in miniature [@digsig-round2-news-2024]. The "not never" is not a historical footnote. It is ongoing.

Two deeper questions hang over the survivors. The first is structural: SQIsign, the lone surviving isogeny signature, has to be made practical without reintroducing the kind of exposed structure that doomed SIDH -- and it comes from the very family that produced SIKE [@sqisign-2020-1240].

The second is the one that should keep architects awake: how correlated are the survivors' assumptions? ML-KEM and ML-DSA both rest on module-lattice hardness. A single structural idea -- a MinRank- or Kani-class surprise for lattices -- could in principle take both at once, and the portfolio's insurance is only as good as the independence of its bets. That forward-looking argument is the subject of this series' structural companion, "How the Whole Stack Would Break: SIDH, Correlated Assumptions, and the Cryptography We Are Betting the Next Thirty Years On"; this empirical capstone is the historical evidence that grounds it.

The pressure is not abstract, either. An adversary can record encrypted traffic today and decrypt it later if a break ever lands -- the "harvest now, decrypt later" problem -- so uncertainty about the survivors has a cost that is being paid right now, not someday [@cloudflare-pq-2024]. None of this tells a practitioner to panic. It tells them to deploy as if the survivors might still fall -- which, it turns out, is a specific and achievable discipline.

10. What the graveyard tells you to do

Everything above collapses into four rules a practitioner can act on this quarter.

Prefer the most-vetted families. For key exchange, ML-KEM; for signatures, ML-DSA by default and SLH-DSA where you want the most conservative assumption; Classic McEliece where keys are static and bandwidth is cheap. Treat "standardized" as "survived the engine" -- strong evidence, not a proof -- and you will hold these tools with the right amount of confidence.

Always hybridize. Deploy a classical and a post-quantum primitive together -- X25519 with ML-KEM, for instance -- so that breaking the post-quantum half does not break the session. SIKE is the empirical proof that this is not paranoia.

Almost, and the near-miss is the argument for hybrids. Around 2019, Cloudflare and Google ran an experiment called CECPQ2b that paired X25519 with SIKE in real TLS connections. When SIKE was catastrophically broken in 2022, every recorded CECPQ2b session stayed secure -- because the classical X25519 half held, and the session key needed both [@cloudflare-pq-2024]. The break did not exploit the experiment; it broke the primitive on paper. But had anyone shipped SIKE alone, those sessions would have been retroactively exposed. The hybrid absorbed a total break of one of its halves.

{` // A hybrid session key mixes BOTH shared secrets. Breaking one half is not enough. function kdf(a, b) { // toy mixer (not a real KDF) -- only illustrates dependence on both inputs let h = 2166136261 >>> 0; for (const s of [a, b]) for (let i = 0; i < s.length; i++) { h ^= s.charCodeAt(i); h = Math.imul(h, 16777619) >>> 0; } return h.toString(16).padStart(8, '0'); }

const ssClassical = 'x25519-shared-secret-stays-private'; const ssPq = 'sike-shared-secret'; const sessionKey = kdf(ssClassical, ssPq); console.log('legitimate session key :', sessionKey);

// 2022: SIKE is broken. The attacker recovers the post-quantum half in full... const attackerPq = ssPq; // ...but the classical half is still secret, so the attacker must guess it: const attackerKey = kdf('attacker-cannot-see-x25519', attackerPq); console.log('attacker key (PQ fully known):', attackerKey); console.log('does the attacker recover the session?', attackerKey === sessionKey); `}

Never build on a pre-standardization candidate. Rainbow and SIKE were both live, respected candidates when they fell. A scheme that has not run the full gauntlet may break tomorrow, and anything you deployed on it breaks with it.

Note: The single most expensive mistake the graveyard warns against is treating "advanced to the next round" as "safe to deploy." Rainbow was a finalist and SIKE a Round 4 candidate at the moment each was key-recovered. Pre-standardization status is an invitation to attack a scheme, not a certificate that it survived.

Track the status reports. NIST's status reports (NISTIR 8240, 8309, 8413, and 8545) and the signature on-ramp are the public record of what is still standing and what just fell [@nistir-8545]. Reading them is the cheapest security work you can do.

Recent browsers negotiate a hybrid key-exchange group named X25519MLKEM768 (earlier builds used X25519Kyber768) [@cloudflare-pq-2024]. In Chrome or Firefox, open the connection or security details panel and look at the negotiated key-exchange group; a current build of OpenSSL's `s_client` also reports the negotiated group in its handshake summary. If you see an ML-KEM or Kyber hybrid, both the classical and the post-quantum halves are protecting that session -- exactly the arrangement that saved CECPQ2b.

If you need	Use	Trust basis	Hybrid?
TLS / key agreement	ML-KEM-768, in an X25519+ML-KEM hybrid	most-studied young assumption	Yes, always
A code-based KEM hedge	HQC (when final) or Classic McEliece (static keys)	distinct from lattices	Yes
Default signature	ML-DSA-65	balanced, implementation-safe	with a classical signature where feasible
Smallest signatures (CA roots)	FN-DSA / Falcon (after FIPS 206)	small, but sampling hazard	Yes
Maximum assurance / firmware	SLH-DSA	hash-only, most conservative	optional
Anything pre-standardization	do not build on it	none -- may break tomorrow	not applicable

The root causes reduce to one lesson wearing five hats.

Broken scheme	Root-cause mathematics	Lesson
Rainbow	Layering created a low-rank MinRank instance [@beullens-rainbow-2022-214]	Key-shrinking structure is attack structure
GeMSS / HFEv-	Modifiers added little real security [@gemss-hfev-2020-1424]	Patching a weak trapdoor does not strengthen it
LUOV	Lifted structure reduced to a subfield [@luov-2019-1490]	Efficiency tricks can shrink the attacker's search
SIKE	Published torsion images fed Kani's criterion [@castryck-decru-2022-975]	Data you must publish is data an attacker has
VOX (on-ramp)	Padded MinRank on compressed UOV keys [@vox-2024-166]	The same weapon still fires today

These four rules are really one rule wearing four hats: respect the difference between "unbroken" and "unbreakable." The graveyard is what that difference looks like when you ignore it.

11. Frequently asked questions

The breaks generate a predictable set of misconceptions. Here are the seven worth settling.

No. Both were broken while they were candidates in a standardization process, before any general deployment, so there is no CVE and no vendor advisory for either. The one real-world appearance was SIKE inside the time-boxed CECPQ2b experiment, which paired it with X25519 -- and even there, the break did not exploit the deployment, and the sessions stayed secure because the classical half held [@cloudflare-pq-2024]. No. The break is classical mathematics -- Kani's 1997 reducibility criterion applied to the torsion-point images SIDH publishes -- and Robert showed it runs in classical polynomial time [@castryck-decru-2022-975, @robert-2022-1038]. Shor's algorithm was not involved. Note also that this attack hits SIDH, not the commutative scheme CSIDH, which does not publish torsion images. The opposite. Cheap, public, classical cryptanalysis of candidates -- before anyone deploys them -- is the entire point of an open competition. Rainbow and SIKE breaking on paper is the process working exactly as designed, not failing. A competition that produced no breaks would be the worrying outcome. No. They are trusted by attrition, not by proof. No one has proved Module-LWE or syndrome decoding hard; a real proof would imply $P \neq NP$ and more in the quantum setting. Absence of a known break is the best evidence available, and it is not the same as a guarantee. The families were pruned, not eliminated. The specific submitted schemes -- Rainbow, GeMSS, LUOV, and SIDH/SIKE -- are dead. But plain Unbalanced Oil-and-Vinegar and its revival MAYO resist the MinRank attack [@mayo-2021-1144], and the isogeny schemes CSIDH and SQIsign survive because they do not expose the torsion images that doomed SIDH [@csidh-2018-383, @sqisign-2020-1240]. The cryptanalytic engine still runs on the survivors, and no one can rule it out. In 2024 a claimed quantum algorithm against LWE briefly threatened both, then self-destructed within days when a bug was found [@chen-2024-555]. No working break is known today -- but "no known break" is evidence, not a promise. Four things: prefer the most-vetted families (lattice, hash, and Classic McEliece); always hybridize a classical primitive with the post-quantum one so a future break cannot expose today's traffic; track NIST's status reports and the signature on-ramp; and never build on a pre-standardization candidate [@cloudflare-pq-2024, @nistir-8545].

Trust by attrition

Count the funnel one last time. Eighty-two submissions became 69 first-round candidates, then 26, then 15, then a handful of standards. Two entire families -- multivariate signatures and isogeny key exchange -- did not merely lose members; they were emptied, on the mathematics itself, by ideas that a laptop could run in an afternoon. The schemes we now standardize are not the ones that were proven strong. They are the residue of everything that broke.

That is the shape of the only trust cryptography can actually offer. Across the rest of this series, the mathematics almost never broke and the machine around it leaked. This was the chapter where the mathematics broke -- not because cryptographers were careless, but because a competition deliberately ran young, unproven primitives at the entire world until the weak ones came apart in public, cheaply, before anyone was depending on them. Rainbow and SIKE were the price of admission, paid in papers instead of breaches.

The survivors earned the only credential the field can honestly grant: not a proof, but a record of having been attacked, in the open, by everyone who wanted to, and not yet having fallen. Hold them exactly that tightly -- and keep watching, because the engine that broke Rainbow the week it was a finalist has never stopped running.

How the Whole Stack Would Break: SIDH, Correlated Assumptions, and the Cryptography We Are Betting the Next Thirty Years On

noreply@paragmali.com (Parag Mali) — Sun, 19 Jul 2026 00:00:00 GMT

The security of the post-quantum stack is not the hardness of any single algorithm -- **none of them is proven hard**. It is a deliberately *uncorrelated* portfolio: lattice (ML-KEM, ML-DSA, Falcon), hash (SLH-DSA), and code (HQC, Classic McEliece), chosen so a break of one family leaves the others standing. Shor was the original correlated failure -- factoring and discrete log fell together because they were one bet -- and the 2022 SIDH/SIKE collapse (classical, about ten minutes, no warning) proved a well-vetted family can still vanish overnight. This capstone maps where the surviving bets are genuinely correlated (the lattice cluster, the Module-LWE pair at its center) and argues that, for a science that can prove nothing hard, diversity is the entire defense.

1. Nine Teardowns, One Question

In late July 2022, a key-exchange scheme that had survived eleven years of public cryptanalysis was broken. Not by a quantum computer. Not gradually. It fell on a single laptop core in about ten minutes, using a theorem from pure mathematics published in 1997 [@castryck-decru-2022]. The scheme was SIKE, the instantiation of SIDH first proposed in 2011 [@jao-defeo-2011], and just three and a half weeks earlier NIST had promoted it to the fourth and final round of its post-quantum standardization effort for continued study [@nist-2022-selection].

Read the status carefully, because the precise words carry the whole point. SIKE was never a standard. It was a Round-4 alternate candidate, still under evaluation, key-recovered before any selection was made [@ir-8413]. That makes the collapse worse, not better: this was cryptography failing while under the most intense scrutiny our field knows how to apply.

Two or more cryptographic primitives that fail together because they secretly depend on the same piece of mathematics. The schemes look independent -- different names, different standards, different teams -- but a single advance takes all of them at once. It is the failure mode a diverse portfolio exists to prevent.

This series has spent nine articles taking post-quantum primitives apart one at a time: how ML-KEM would break, how ML-DSA would break, how each candidate meets its mathematical limit. This final part does what none of the nine could do alone: it steps back and asks whether they fail independently. Because a stack is not nine separate bets that each has to be strong. It is one system, and its real question is whether two of those bets might secretly be the same bet.

Key idea: A cryptosystem is a wager that one math problem is hard. A cryptographic stack is a portfolio of such wagers -- and the only thing that ultimately matters is whether the wagers are correlated. The stack is secure not because any assumption is proven hard (none is), but only to the degree that a break of one leaves the others standing.

That is the lens for everything below -- a sentence you will earn by the end.

A cryptographic stack is a portfolio of bets -- and the only thing that ultimately matters is whether the bets are correlated.

Before we map the stack, one boundary. The break we just described was structural: an attack on SIDH's own mathematics, not on a buggy implementation of it.SIDH is not CSIDH. SIDH collapsed classically in 2022; CSIDH is a separate isogeny construction that survives, with its own separately-contested quantum security -- Kuperberg's algorithm applies to CSIDH, never to lattices [@kuperberg-2005]. Never let one family's obituary be read as the other's. That distinction is the boundary every section below holds to.

This capstone analyzes only structural cryptanalysis -- attacks on an algorithm's own mathematics. Side channels, fault and power attacks, implementation bugs, weak randomness, and protocol misuse are real, often easier, and equally capable of sinking a deployment -- but they are a different surface, owned by the sibling track *How It Breaks in Real Life*. One clarification for the quantum question: Shor's algorithm counts as structural math and is in scope; Grover's generic search is not a structural break, and it is named once later, then set aside.

The thirty-year story we are about to trace is a spiral, not a line. Three times the field concentrated its security onto one kind of mathematics, and three times a shock forced it to spread out again.

flowchart LR A["1978 McEliece: the first code-based bet"] --> B["1994 Shor: two bets share one spine"] B --> C["2005 LWE: the lattice core arrives"] C --> D["2016 NIST competition: five families enter"] D --> E["2022 SIDH collapses, classically"] E --> F["2024 FIPS 203, 204, 205 published"] F --> G["2025 HQC selected as the code hedge"]

To answer whether the new bets are correlated, we first have to understand the last time they were -- the one moment when a single idea took the entire classical stack at once.

2. Shor: The Original Correlated Failure

For twenty years the field slept soundly because breaking RSA seemed to say nothing about breaking elliptic-curve cryptography. That comfort was an illusion -- the most important one to understand here, because the entire post-quantum project is an attempt not to fall for it twice.

The numbers told a reassuring story. The best classical attack on RSA was the general number field sieve, with a sub-exponential running time; the best classical attack on elliptic curves was Pollard's rho, a square-root method [@gnfs-pollard]. Two problems, two unrelated algorithms, two independent-looking bets. If someone found a faster way to factor, elliptic curves would be untouched, and vice versa. Diversify across both and you were doubly safe -- or so the reasoning went.

The foundation of all public-key cryptography: security rests on the belief that some specific problem -- factoring a 2048-bit number, recovering a short lattice vector -- is too expensive to solve on average, for anyone, with any known method. The operative word is *belief*. "Nobody has broken it yet" is evidence, not a proof; almost nothing in cryptography is proven hard.

Then, in 1994, Peter Shor showed that both bets were the same bet. His polynomial-time quantum algorithm solved integer factoring and discrete logarithm, because underneath their different surfaces both are instances of a single mathematical object: the abelian hidden-subgroup problem [@shor-1994]. Find the hidden periodic structure and you have solved the factoring instance, the discrete-log instance, and the elliptic-curve instance alike.

A general problem about finding hidden periodic structure in a function defined over an abelian (commutative) group. Integer factoring and discrete logarithm are both special cases of it. Shor's 1994 algorithm solves the abelian HSP in polynomial time on a quantum computer, which is why one result dissolved two problems that looked entirely unrelated. flowchart TD RSA["RSA: integer factoring"] --> HSP{"Abelian hidden-subgroup problem"} ECC["ECC: discrete logarithm"] --> HSP HSP --> SHOR["Shor, 1994: polynomial-time quantum HSP"] SHOR --> Z1["RSA falls"] SHOR --> Z2["ECC falls"]

This is the template for everything this article fears. Two primitives can each be individually strong -- decades of failed attacks, careful parameter choices, universal deployment -- and still fall together, in one stroke, because their strength was never really two separate things.

Note: RSA and elliptic-curve cryptography were never two bets. They were one bet on the abelian hidden-subgroup problem, wearing two costumes. The security question was never "is each algorithm strong?" It was always "do the algorithms secretly share a spine?" Strength is measured per algorithm; failure is measured per assumption.

Two honest caveats keep this precise. First, Shor's algorithm needs a large, fault-tolerant quantum computer that does not yet exist; its threat is future, not present, and it does not threaten any of the lattice, code, or hash schemes we will meet below.Grover's algorithm is the other quantum result people cite. It gives only a generic quadratic, $2^{n/2}$, speedup for unstructured search -- effectively halving a symmetric key's strength, so a 256-bit key still offers about 128 bits against a quantum attacker [@grover-1996]. That is absorbed by larger parameters, not a structural break, and the last we will say of it. Second, the reason Shor matters here is historical, not technical: it is the event that created the field. The looming "Q-Day," when a quantum computer runs Shor at scale, is precisely the correlated failure that made everyone go looking for replacements.

If the lesson of Shor is that independent-looking bets can share a hidden spine, then the obvious first move after 1994 -- just swap RSA and elliptic curves for one quantum-safe algorithm -- walks straight back into the same trap.

3. The Naive Swap Rebuilt the Single Point of Failure

The first instinct after Shor was the worst one: treat it as a component swap. Rip out RSA and elliptic curves, find one quantum-safe replacement, and declare victory. The instinct is understandable -- engineers replace broken parts every day -- but it is exactly the mistake the correlation lens tells you to avoid.

The raw material was already on the shelf. The candidate problems with no exploitable abelian-HSP structure had existed for decades: McEliece's code-based cryptosystem from 1978 [@mceliece-1978], Merkle's hash-based signatures from 1979 [@merkle-1979], the NTRU lattice system from 1998 [@ntru-1998], and Regev's Learning With Errors problem from 2005, which would become the workhorse of the entire modern stack [@regev-lwe-2005]. Any of them could resist Shor. The temptation was to pick the most efficient one and standardize it alone.

A deployed stack whose security, however many algorithms it contains, ultimately rests on a single hard-problem family. Like a field planted with one genetic strain, it can look healthy right up until a single blight -- one mathematical advance -- takes all of it at once.

Here is why a single replacement is not a fix but a relocation of the risk. Shor did not punish RSA for being weak; it punished the stack for concentrating on one kind of mathematics. Swap in a lone lattice scheme and you have rebuilt precisely that: a monoculture with a new problem underneath, one advance away from total failure. You did not escape the Shor pattern. You reissued it.

To be honest about the epistemics: no paper proves the theorem "monocultures always fail." This is a design argument, and its evidence is circumstantial rather than deductive -- the Shor precedent behind us, and, as we will see, the collapses of SIKE and Rainbow still ahead.

The people who saw it earliest said so in plain terms. Daniel Bernstein and Tanja Lange argued for years that committing to a single system courts a "cryptographic monoculture," and built NTRU Prime partly as a standing objection to it [@ntruprime-diversity]. That position, once a minority view, is the intellectual seed of everything NIST eventually did.

Because NIST did not swap. It ran a competition.

When NIST opened its post-quantum project in 2016, 82 submissions arrived and 69 were accepted into the first round, spread across five mathematical families: lattice, code, hash, multivariate, and isogeny [@ir-8240; @nist-pqc-project]. The breadth was the substance, not the packaging. An open competition across unrelated hard problems is, structurally, a search for a *set* of uncorrelated bets -- even before anyone attached that language to it.

Note: The deepest design lesson of the post-Shor era is counterintuitive: a standardization effort should not try to crown the single best algorithm. It should assemble a diversified set whose members would have to fail for independent reasons. A lone "winner" is a monoculture waiting to happen.

NIST bet on breadth -- five families, an open process, trust earned by attrition. But breadth on paper is not diversity in fact. A competition can start with five families and still funnel almost all of its real-world weight onto one of them. To see whether that happened, you have to stop reading the roster and start reading the map -- exactly what the survivors ended up standing on.

4. The Map of What Rests on What

Here is the uncomfortable picture, drawn as a map. Take the standardized and selected post-quantum stack, ignore the marketing names, and color each scheme by the hard problem it actually rests on. Where is the concentration?

The modern public-key primitive for agreeing on a shared secret. Rather than encrypting a chosen message, the sender *encapsulates* a fresh random key against the recipient's public key, producing a ciphertext; the recipient decapsulates it to recover the same key. ML-KEM, HQC, and Classic McEliece are all KEMs.

Six schemes carry the weight. ML-KEM (FIPS 203) is a lattice KEM whose security is tied to Module-LWE at modulus q = 3329 [@fips-203]. ML-DSA (FIPS 204) is a lattice signature resting on Module-LWE and Module-SIS at modulus q = 8380417 [@fips-204]. Falcon (draft FIPS 206) is a lattice signature too, but on the NTRU short-vector problem rather than Module-LWE [@ntru-1998].

SLH-DSA (FIPS 205) is a signature whose security reduces entirely to the strength of a hash function [@fips-205]. Classic McEliece rests on decoding random binary Goppa codes [@mceliece-1978], and HQC -- selected by NIST in March 2025 -- rests on decoding quasi-cyclic codes [@ir-8545].

flowchart TD subgraph Lattice MLKEM["ML-KEM on Module-LWE"] MLDSA["ML-DSA on Module-LWE plus Module-SIS"] FAL["Falcon on the NTRU lattice"] end subgraph Hash SLH["SLH-DSA on hash security only"] end subgraph Code HQC["HQC on quasi-cyclic decoding"] MCE["Classic McEliece on binary-Goppa decoding"] end MLKEM -.->|shared Module LWE assumption| MLDSA The hard problem underneath both ML-KEM and ML-DSA. Informally it is noisy linear algebra over structured (module) lattices: you are shown many linear equations whose right-hand sides have each been nudged by a small random error, and asked to recover the secret. "Module" is the middle setting between fully unstructured LWE (slow but conservative) and fully structured Ring-LWE (fast but more algebraic surface for an attacker to grab).

The map makes one fact impossible to miss: three of the six schemes stand on lattices. That concentration is not an accident. It is the payoff of a twenty-year efficiency arc -- Ajtai's 1996 worst-case-to-average-case reduction [@ajtai-1996], Regev's LWE in 2005 [@regev-lwe-2005], Ring-LWE's dramatic size reductions in 2010 [@ring-lwe-2010], and the Module-LWE middle ground in 2015 [@module-lwe-2015] that Kyber and Dilithium adopted in 2017 to become today's ML-KEM and ML-DSA [@kyber-2017; @dilithium-2017]. Lattices won the efficiency argument, and that is why they became the core.

But notice the precise shape of the correlation, because misstating it is the single most common error about this stack. ML-KEM and ML-DSA are the genuinely correlated pair: both rest on Module-LWE. That does not mean any attack on one instantly breaks the other. They use different parameters -- different moduli (3329 versus 8380417), different module ranks,The rank is roughly how many ring elements stack into the secret vector; a higher rank means a harder instance and a larger key. different noise -- so a parameter-specific attack need not transfer, and ML-DSA carries an additional Module-SIS assumption that ML-KEM does not [@fips-204].

What they share is the assumption family. A generic, structural advance against Module-LWE would reach both at once; a narrow trick tuned to one parameter set might reach neither.Falcon is NTRU, not Module-LWE -- a third and structurally distinct lattice bet, and the least conservative of the three because its NTRU lattices carry extra algebraic structure. It is also the one still unfinished: draft FIPS 206 (FN-DSA) remained unreleased as of this writing [@nist-pqc-project].

You can turn that observation into a two-line audit. Do not count algorithms; count assumptions.

{` // Map each deployed scheme to the hard problem it truly rests on. const assumption = { 'ML-KEM-768': 'lattice', 'ML-DSA-65': 'lattice', 'Falcon-512': 'lattice', 'SLH-DSA-128s': 'hash', 'HQC-128': 'code', 'Classic-McEliece': 'code' };

// A stack is only as diverse as its set of DISTINCT assumptions. function auditStack(schemes) { const families = new Set(schemes.map(function (s) { return assumption[s]; })); console.log('Deployed: ' + schemes.join(', ')); console.log('Distinct assumption families: ' + Array.from(families).join(', ')); if (families.size === 1) { console.log('WARNING: monoculture. One advance against ' + Array.from(families)[0] + ' takes the whole stack.'); } else { console.log('OK: a break must cross ' + families.size + ' unrelated families to take everything.'); } }

auditStack(['ML-KEM-768', 'ML-DSA-65', 'Falcon-512']); // looks diverse, is not auditStack(['ML-KEM-768', 'SLH-DSA-128s', 'HQC-128']); // lattice + hash + code `}

The first stack has three different algorithm names and one assumption. The second has three names and three assumptions. Only the second is a portfolio.

Key idea: The map is the thesis. Every scheme sits in exactly one assumption band -- lattice, hash, or code -- and every break lives in a band too. To take the whole stack down, a single break would have to cross bands, reaching mathematics unrelated to where it started. Diversity is not decoration on top of the security argument. It is the security argument.

The map, laid out precisely, and the five generations of thinking that produced it:

Scheme (standard)	Role	Family	Specific assumption	Best-known attack	Representative size	Correlation group
ML-KEM (FIPS 203)	KEM workhorse	Lattice	Module-LWE, q = 3329	Lattice sieving / BKZ [@core-svp]	~1 KB public key	Lattice core
ML-DSA (FIPS 204)	Signature workhorse	Lattice	Module-LWE + Module-SIS, q = 8380417	Lattice sieving / BKZ [@core-svp]	~3 KB signature	Lattice core (paired)
Falcon (draft FIPS 206)	Compact signature	Lattice	NTRU short vector	Lattice sieving / BKZ [@core-svp]	sub-kilobyte signature	Lattice (distinct)
SLH-DSA (FIPS 205)	Conservative signature	Hash	Hash preimage / collision resistance	Generic hash attacks	several to tens of KB signature	Hash anchor (uncorrelated)
HQC (NIST IR 8545)	KEM hedge	Code	Quasi-cyclic syndrome decoding	Information-set decoding [@bjmm-2012]	few-KB public key	Code hedge
Classic McEliece (ISO-track) [@classic-mceliece-iso]	KEM deep hedge	Code	Binary-Goppa syndrome decoding	Information-set decoding [@bjmm-2012]	0.26-1.36 MB public key [@classic-mceliece-site]	Code hedge

Generation	Era	What we bet on	How we avoided concentrating	Why it was superseded
Number-theoretic monoculture	pre-1994	Factoring and discrete log (RSA, ECC)	We did not -- two problems were believed independent	Shor: both are one abelian-HSP bet [@shor-1994]
Naive one-for-one swap	1994-2016	A single quantum-safe replacement	Not at all -- one new problem underneath	Rebuilds the monoculture Shor punished
Five-family bake-off	2016-2022	An open competition across five families	Breadth of candidates [@ir-8240]	Attrition thinned it toward a lattice-heavy core
Lattice-centric core	2022-2024	Module-LWE efficiency (ML-KEM, ML-DSA)	Partly -- hash-based SLH-DSA retained	Concentration risk: three lattice schemes
Diversified portfolio	2024-2025	Lattice, hash, and code, explicitly	Dated policy: SLH-DSA, then HQC [@ir-8545]	Current -- the correction made explicit

A map like this is only a worry until a family actually vanishes from it. That is not hypothetical. An entire family that reached NIST's Round-4 shortlist -- isogenies -- did exactly that, while sitting under the most intense scrutiny the field can muster.

5. SIDH: How a Family Vanished in an Afternoon

Return to the ten-minute break and look at exactly how it worked, because the mechanism is the warning. A scheme that survived more than a decade did not fall to a new theory, a faster computer, or a lucky guess. It fell to arithmetic that had been sitting in a 1997 journal, waiting.

SIDH's hard problem is to find a secret isogeny -- a structured map -- between two supersingular elliptic curves. That problem, taken bare, still looks hard today. But a protocol has to do more than pose a hard problem; it has to let two honest parties reach the same key. To make that possible, SIDH publishes extra data alongside its public key: the images of certain torsion points under the secret isogeny [@jao-defeo-2011]. That auxiliary information is not part of the underlying hard problem. It is a gift the protocol hands the attacker in order to function.

An isogeny is a structure-preserving map between two elliptic curves. SIDH hides its secret in a specific isogeny and dares attackers to find it. But to let two parties agree on a key, the protocol must also publish the images of certain torsion points under that secret map. Those published images are auxiliary data the bare hard problem never had to reveal -- and they are exactly what the attack fed on.

In late July 2022, Wouter Castryck and Thomas Decru showed how to weaponize that gift. They applied Kani's reducibility criterion -- a result in arithmetic geometry published in 1997 and essentially unused in cryptography for twenty-five years [@kani-1997] -- to the published torsion-point images. The criterion lets you glue the curves into a higher-dimensional abelian surface and test whether it splits, and from that test recover the secret isogeny. On SIKEp434 it ran in about ten minutes on a single classical core [@castryck-decru-2022].

sequenceDiagram participant P as Protocol participant A as Attacker P->>A: Publishes torsion-point images (required to function) A->>A: Apply Kani reducibility criterion from 1997 A->>A: Glue curves into an abelian surface, test reducibility A->>P: Recover the secret isogeny (the private key) Note over A: About ten minutes, one core, classical, not quantum

It was not a fluke of one parameter set. Within weeks, Damien Robert proved the attack runs in classical polynomial time from any starting curve, sealing the result as structural rather than patchable [@robert-2022], and Luciano Maino and Chloe Martindale generalized it while carefully bounding it away from neighboring constructions [@maino-martindale-2022].

Now sit with the three facts that make this the emotional center of the article. It was not Shor and not a quantum computer -- an ordinary laptop did it.The interval is the whole point. SIKE advanced to Round 4 on 5 July 2022 and was broken around 30 July 2022 -- roughly three and a half weeks later [@nist-2022-selection; @castryck-decru-2022]. Years of survival bought time, not safety. It was not gradual erosion -- one paper took the family from "final round" to "dead." And the vulnerability was structural from birth: SIDH published its own attack surface on day one, and the tool that read it had existed, fully public, since 1997.

Note: The attack was classical. It ran on an ordinary core using Kani's criterion, with no quantum computer anywhere in the story. And SIDH is not CSIDH: this result key-recovered SIDH and SIKE, but does not apply to CSIDH, CSI-FiSh, or SQIsign [@maino-martindale-2022]. Blaming a quantum machine, or extending the collapse to every isogeny scheme, are both wrong.

Here is the shift. Most of us treat heavy vetting as evidence of durability: if a scheme survives years of expert attack, surely it is safe. SIKE says otherwise. Vetting measures how long a family has resisted the tools people thought to try. It cannot measure the tool nobody connected yet -- and that tool can already be published, in a field the cryptographers were not reading.

The mathematics that collapses a quantum-safe family can already exist, fully published, decades before anyone connects it to the target.

If a whole family can vanish like this -- classically, in an afternoon, at the peak of its scrutiny -- then the only rational response is to never bet the stack on one. That is precisely, and deliberately, what NIST built next.

6. The Portfolio NIST Actually Built

The standardized stack is not a winner. It is a portfolio, and it was designed rather than stumbled into. Read across the three families and you can see the strategy in the shape.

The lattice pair, ML-KEM and ML-DSA, are the efficient workhorses -- small keys, fast operations, the default choice for general traffic [@fips-203; @fips-204]. Next to them sits the maximally conservative anchor: SLH-DSA, a signature whose security reduces entirely to the strength of a hash function and shares no algebraic structure with lattices at all [@fips-205]. Its lineage runs straight back to the SPHINCS stateless hash-based signature of 2015 [@sphincs-2015]. If every lattice assumption on the map fell tomorrow, SLH-DSA would not notice.

The hard problem behind code-based cryptography. Given a random-looking linear code and a corrupted codeword, recover the small error pattern that was added. That recovery is a decoding problem which has resisted efficient solution since the 1970s. HQC and Classic McEliece both rest on variants of it.

The third family is the encryption hedge. Classic McEliece has stood essentially unbroken as a structure for roughly 47 years, the deepest-studied bet on the board [@classic-mceliece-site].McEliece's conservatism has a price: its public keys run from about 0.26 MB to 1.36 MB depending on parameters [@classic-mceliece-site], roughly two to three orders of magnitude larger than ML-KEM's. That bandwidth is the price of a structure unbroken for nearly half a century. And in March 2025, NIST added HQC, a newer code-based KEM built on quasi-cyclic codes [@hqc-site], precisely to have a standardized encryption path that does not touch lattices.

Note: The clearest proof that diversity is a deliberate strategy and not an accident is the calendar. On 11 March 2025, NIST selected HQC as a second standardized KEM -- explicitly because it rests on codes rather than lattices, so that a future lattice break cannot bring down all post-quantum encryption at once. NIST even documented why it chose HQC over BIKE and why it did not select Classic McEliece [@ir-8545].

That selection is the thesis rendered as a signed, dated decision. A monoculture-minded process would have shipped one KEM -- the fastest -- and moved on. NIST shipped a second one on a different hard problem, and said out loud that non-correlation was the reason.

NIST did not choose HQC because it was the fastest or the smallest. It chose HQC because it is not a lattice.

Here is the whole portfolio as an engineering comparison. The last row -- correlation to the lattice core -- is the one this article cares about most.

Dimension	Lattice core (ML-KEM / ML-DSA)	Lattice (Falcon)	Hash (SLH-DSA)	Code (HQC)	Code (McEliece)
Worst-case structural threat	Generic Module-LWE advance	Advance on NTRU lattices	Break of the underlying hash	ISD advance on quasi-cyclic codes	ISD advance on Goppa codes
Best-known attack cost	Sieving $2^{0.292\beta}$ [@core-svp]	Sieving $2^{0.292\beta}$ [@core-svp]	Generic hash bounds	ISD $2^{\Theta(n)}$ [@bjmm-2012]	ISD $2^{\Theta(n)}$ [@bjmm-2012]
Representative size	~1 KB pk, ~3 KB sig	sub-KB signature	KB-scale signature	few-KB public key	0.26-1.36 MB public key [@classic-mceliece-site]
Performance	Fast	Compact, fast verify	Slower, larger signatures	Moderate	Fast operations, very large keys
Attack-cost verifiability	Contested margin [@classic-mceliece-site]	Contested margin	High (hash-based)	Machine-checkable	Machine-checkable, most stable
Correlation to lattice core	It is the core	High (lattice)	None (hash)	Low (code)	Low (code)

A portfolio on paper only becomes a defense when it is fielded, and this one is. On the wire, the dominant deployment is a hybrid: a classical key exchange and a lattice KEM run together, most commonly the X25519MLKEM768 group, which pairs X25519 with ML-KEM-768, the two primitives it shares with the general-purpose X-Wing combiner [@xwing-2024].

Running a classical key exchange (say X25519) and a post-quantum KEM (say ML-KEM) side by side, then combining their two shared secrets through a key-derivation function. The result is secure as long as *either* half is unbroken, so a surprise break of the post-quantum piece does not, on its own, expose the session.

The adoption is real and recent. By early 2024, roughly 2 percent of TLS 1.3 connections to Cloudflare used post-quantum key exchange, with over 99 percent of that traffic driven by Chrome [@cloudflare-pq-2024]. Apple's iMessage PQ3 and Signal's PQXDH shipped post-quantum protection into production messaging [@apple-pq3; @signal-pqxdh]. And the NSA's CNSA 2.0 suite mandates ML-KEM and ML-DSA, plus the stateful hash-based signatures LMS and XMSS for software- and firmware-signing, for national security systems on a timeline running to 2033 [@cnsa-2.0]. The portfolio is not a whiteboard proposal; it is being poured into the foundations of the internet right now.

A portfolio is only a defense, though, if its bets are genuinely uncorrelated. So the honest question -- the one that separates comfort from security -- is whether these bets are independent. They are not all as independent as the map makes them look.

7. Are the Bets Actually Uncorrelated?

This is where the map earns its keep. Press on each band and watch how far the crack spreads. There are three verdicts to reach and one uncomfortable caveat that undercuts all of them.

The lattice cluster is genuinely correlated -- and it is the largest correlated surface on the map. A sufficiently general advance against structured lattices, or a real quantum algorithm for Module-LWE, would not stay contained. It would reach ML-KEM and ML-DSA through their shared Module-LWE assumption and very likely Falcon through its NTRU lattices as well.

The caveats from Section 4 still hold and still matter -- Falcon is NTRU rather than Module-LWE, the parameters differ, and ML-DSA carries an extra Module-SIS route -- so not every lattice result hits all three. But the honest summary is stark: the single most valuable target on the board is "lattices in general," and three standardized schemes sit behind it.

flowchart TD GEN["Generic Module-LWE break"] --> MLKEM["ML-KEM"] GEN --> MLDSA["ML-DSA"] LR["Large lattice-reduction advance"] --> MLKEM LR --> MLDSA LR --> FAL["Falcon"] ISD["Information-set decoding advance"] --> HQC["HQC"] ISD --> MCE["Classic McEliece"] HASH["Hash function break"] --> SLH["SLH-DSA"] NN["Nearest-neighbor search"] -.-> LR NN -.-> ISD

The code pair is partially correlated. HQC and Classic McEliece are both code-based, but they are different structural bets -- quasi-cyclic codes versus binary Goppa codes. They share an attack ruler: improvements to information-set decoding erode both [@bjmm-2012]. But a structure-specific attack, one that exploits the quasi-cyclic shape or the Goppa structure in particular, need not transfer between them. Same family, two different bets inside it.

The best-known family of attacks against code-based cryptography. ISD guesses a subset of coordinates it hopes are error-free, solves the resulting linear system, and checks whether the implied error is small enough, repeating until it succeeds. Fifty years of refinement have chipped at its exponent without changing its exponential character -- which is exactly why the code margin is considered stable.

The hash anchor is the least correlated bet on the map, but not perfectly isolated. SLH-DSA shares no algebraic structure with lattices or codes at all; its only correlation is to the strength of the SHA-2 and SHA-3 families it is built on. And those carry the largest, most-attacked security margins in all of cryptography. If you wanted the closest thing to an assumption that fails for reasons entirely its own, this is it.The lattice margin, by contrast, is not settled. Concrete-security estimates that NIST itself has published for Kyber-512 have spanned roughly $2^{140}$ to $2^{180}$ gates depending on modeling assumptions [@classic-mceliece-site]; the code margin is comparatively stable and can be checked by attack-cost simulators.

Now the caveat that keeps this section honest. Lattice sieving and code-based ISD, at their algorithmic cores, both reduce to the same primitive: finding very close vectors in a huge set, a nearest-neighbor search. The best sieving algorithms and the best decoding algorithms have both been sharpened by advances in nearest-neighbor techniques [@core-svp]. So it is conceivable that one deep breakthrough in nearest-neighbor search could sharpen attacks in both the lattice band and the code band at once -- a meta-correlation the tidy three-color map hides.

I have to mark that claim precisely, because overstating it would betray the whole argument. No published result demonstrates an attack that transfers between the families, and no reduction is known in either direction. This is an inferred caution, not a documented failure.

Note: "No known reduction between two assumptions" is a statement about today's literature, not about mathematics. It means nobody has published a way to turn a break of one into a break of the other. It does not mean no such way exists. Mistaking "we have not found a link" for "there is no link" is exactly the overconfidence that Shor and SIDH punished.

The strongest case for leaning on code-based encryption comes from the anti-monoculture camp around Daniel Bernstein and Tanja Lange [@ntruprime-diversity]. The argument has two parts: lattice concrete-security estimates are contested and have shifted over time, whereas the cost of information-set decoding is stable and can be pinned down by machine-checked attack simulators. The Kyber-512 figures they marshal are NIST's own [@classic-mceliece-site]. Read them as an interested party making a real point -- not as a neutral referee.

So the encryption diversity is real but not proven, and the lattice concentration is real and only partly hedged. Which raises the deepest question in the article, the one no better algorithm can answer: could we ever prove two assumptions uncorrelated, even in principle?

8. Why You Cannot Prove the Portfolio Uncorrelated

Now the bad news that no better algorithm can fix. There are two impossibilities here, and they ascend: the first is well known and merely humbling; the second is specific to this article's thesis and is, in a strict sense, permanent.

The first: nothing in the stack is proven hard. Module-LWE, syndrome decoding, and hash security all rest on the same foundation -- "nobody has broken it yet." The best-known positive result is Regev's: a quantum reduction from worst-case lattice problems to average-case LWE [@regev-lwe-2005]. That is genuine, beautiful evidence: if you could solve random LWE instances efficiently, you could solve the worst case of certain lattice problems too. But it is not a hardness proof, because those worst-case problems are themselves only believed hard.

A problem is worst-case hard if *some* inputs are hard; it is average-case hard if a *randomly chosen* input is hard. Cryptography needs the second, stronger property, because keys are random. General decoding is NP-complete in the worst case, but that says nothing about the average random instance a code-based scheme actually uses -- which is why "NP-complete" is a weaker comfort here than it first sounds.

It goes deeper than "we have not gotten around to it." The lattice problems live in a place that makes a proof structurally unavailable.

The class of problems whose yes-answers and no-answers both have short, checkable certificates. The worst-case lattice problems (approximate GapSVP and GapSIVP) that LWE reduces from sit here [@aharonov-regev-2005]. That location is itself a clue: problems in NP intersect coNP are believed *not* to be NP-complete, so lattice hardness cannot simply be inherited from NP-completeness -- and a real hardness proof would have to settle questions about P, NP, and coNP that have resisted half a century of effort. Suppose you proved that Module-LWE requires exponential time. You would then have exhibited a problem in NP that is not in P -- which proves P is not equal to NP, the most famous open question in computer science, with a million-dollar prize attached. Every cryptographic hardness assumption is, in this exact sense, a bet on how a Millennium Problem resolves. We build the internet on conjectures because proofs are unavailable, not because anyone is being careless.

The second impossibility is the one this whole article has been circling, and it is worse than the first. Even if, by some miracle, we could prove each assumption individually hard, we still could not prove them uncorrelated. Uncorrelatedness is a statement about all possible future mathematics: that no single idea, in any field, ever reaches two of these problems at once. You can accumulate evidence for it -- watch two assumptions resist different tools, wielded by different communities, for different lengths of time. You can never close it.

SIDH is the proof of the danger: the tool that took it was a 1997 theorem nobody had connected to cryptography. There is no theorem that says "and there are no more surprises like that one."

Key idea: You cannot prove the portfolio uncorrelated. You can observe that two assumptions have resisted different tools for different lengths of time, but you can never rule out a single future idea that reaches both -- that is not a gap in today's knowledge, it is unprovable in principle. Diversity is therefore risk management, not proof. The portfolio is not a solution to the hardness problem; it is the best available discipline in the permanent absence of one.

This is the moment the comfortable reading breaks. Diversity felt like a solution -- hold different assumptions and relax. It is not a solution. It is a disciplined bet made under permanent uncertainty, chosen precisely because certainty is not on the menu and never will be.

Diversity is the closest thing to a security proof this science permits -- and it is not a proof at all.

If we can neither prove the bets hard nor prove them independent, the only rational questions left are practical ones: where would a correlated break actually come from, and how much time is on the clock?

9. Where the Correlated Break Would Come From

If you wanted to take down the whole stack, here is where you would aim. Three of these questions are open mathematics; the fourth is a clock.

A "Shor for lattices." An efficient quantum algorithm for Module-LWE would be the nightmare scenario: a single result reaching ML-KEM, ML-DSA, and by extension the lattice core all at once -- the correlated break the map warns about. And this is not a thought experiment. In April 2024, Yilei Chen posted a paper claiming exactly such an algorithm.In little more than a week Chen withdrew the claim: a flaw in Step 9, found independently by Hongxun Wu and Thomas Vidick, could not be repaired [@chen-2024; @green-chen-2024]. It must be cited only as retracted, never as a live break [@quantum-insider-chen].

The algorithm did not survive contact with other experts -- but for a little over a week, serious people believed the lattice core might be gone. That interval is the point. The feared correlated break is unrealized, not impossible, and the field felt exactly how much rides on one assumption.

Shared structure between lattices and codes. As Section 7 noted, lattice sieving and code decoding both lean on nearest-neighbor search. Whether that shared tooling hides a deeper connection -- a single advance that erodes both bands -- is genuinely open. No reduction is known, no transfer has been demonstrated, and "no known reduction" is not "no possible link."

Whether the signature on-ramp adds real diversity. NIST is still recruiting more signature families, and the roster is a live test of the whole thesis.

NIST is hunting for additional, uncorrelated signature families through an "on-ramp" call [@nist-onramp]. The candidates are telling. SQIsign is an isogeny scheme, the family whose SIDH and SIKE members collapsed in 2022. UOV, MAYO, and SNOVA are multivariate, the family whose flagship Rainbow was key-recovered in a weekend on a laptop [@beullens-rainbow-2022]. FAEST and HAWK bring still other assumptions. The open question is whether adding a *young, lightly vetted* family is durable diversity or just new, unmeasured risk -- because SIDH proved that "vetted for a few years" is not the same as "safe."

The clock. Everything above would be an academic seminar if the timeline were comfortable. It is not, because of a single idea.

The attack that makes migration urgent today even though no quantum computer exists yet. An adversary records encrypted traffic now and stores it, waiting for a future quantum computer to decrypt it retroactively. Any secret that must stay confidential for longer than the time-to-quantum is already exposed, no matter how strong today's key exchange looks.

Michele Mosca turned this into a one-line risk test, $X + Y \geq Z$: if the years your data must stay secret ($X$) plus the years you need to migrate ($Y$) meet or exceed the years until a cryptographically relevant quantum computer ($Z$), your data is already at risk today [@mosca-2015].

Mosca's inequality: if secrecy_life + migration_time >= time_to_quantum, your data is already exposed to harvest-now-decrypt-later.

def already_exposed(secrecy_life_years, migration_years, years_to_quantum): exposure = secrecy_life_years + migration_years print("Secrecy lifetime (X): " + str(secrecy_life_years) + " yr") print("Migration time (Y): " + str(migration_years) + " yr") print("Time to quantum (Z): " + str(years_to_quantum) + " yr") if exposure >= years_to_quantum: print("EXPOSED: X + Y exceeds Z by " + str(exposure - years_to_quantum) + " yr. Migrate now.") else: print("Safe for now by " + str(years_to_quantum - exposure) + " yr. Keep watching Z.")

A record that must stay secret 15 years, a 5-year migration, quantum in 12 years:

already_exposed(15, 5, 12) `}

For many long-lived secrets the inequality already bites, which is why the migration is being written into law rather than left to preference. The alarm is not new -- the NSA signaled it as early as 2015, when it announced plans to move away from its existing Suite B algorithms [@nsa-2015]. It has since hardened into deadlines: CNSA 2.0 sets a 2025-to-2033 timeline for national security systems [@cnsa-2.0], and Executive Order 14412 codifies migration requirements and the harvest-now-decrypt-later threat directly into federal policy [@eo-14412].

None of the open questions is settled, and the clock is already running. So the only responsible move is to build a stack today that survives being wrong about any one of them. That turns out to be a concrete engineering task.

10. Building an Uncorrelated Stack on Monday

Strip away the theory. Here is what to deploy, and the single rule that ties it together: watch the assumption, not the algorithm name.

Deploy hybrids. Run a classical key exchange and a post-quantum KEM together and combine their secrets, so that a break of the post-quantum half is not, by itself, a break of the session. The dominant TLS deployment is the hybrid group X25519MLKEM768; the closely related general-purpose combiner X-Wing [@xwing-2024] is built on the same X25519 and ML-KEM-768 primitives.

flowchart LR X["X25519 shared secret"] --> KDF["Combiner / KDF"] K["ML-KEM-768 shared secret"] --> KDF KDF --> S["Session key (secure if either input holds)"]

This is not a hypothetical benefit.The empirical case for hybrids is already written. Cloudflare's earlier CECPQ2b experiment paired X25519 with the isogeny KEM SIKE, and any traffic recorded then stayed safe when SIKE broke -- the classical half still held [@cloudflare-pq-2024]. A hybrid turned a total break into a non-event. A hybrid is the correlation lens applied to a single connection.

{` // A hybrid combines a classical secret and a post-quantum secret. // The session key is safe as long as EITHER half is still unbroken. function hybridSafe(classicalBroken, pqBroken) { return !(classicalBroken && pqBroken); }

for (const classicalBroken of [false, true]) { for (const pqBroken of [false, true]) { const verdict = hybridSafe(classicalBroken, pqBroken) ? 'SAFE' : 'EXPOSED'; console.log('classical broken=' + classicalBroken + ', PQ broken=' + pqBroken + ' -> ' + verdict); } } // Only the final row, where both are broken, prints EXPOSED. `}

Refuse a lattice monoculture. This is the mistake the whole article exists to prevent.

Note: Replacing RSA with ML-KEM, and ECDSA with ML-DSA and Falcon, feels like a thorough migration. In assumption terms it is a lattice monoculture: one good enough advance against structured lattices reaches all of it. "Post-quantum" is not the same thing as "diversified."

Pair the efficient lattice core with a backstop that shares nothing with it: SLH-DSA for signatures you need to trust for decades, and a code-based KEM -- HQC or Classic McEliece -- kept available for encryption. And because the lattice margin is the contested one, prefer the higher-margin parameter sets (ML-KEM-768 or 1024) over the smallest.

Build for replacement. No choice here is permanent, so the system must be able to change its mind.

The engineering property of being able to swap a cryptographic primitive without re-architecting the system around it. If your protocol treats "the KEM" as a replaceable module rather than a hardwired choice, then an assumption that starts to erode can be dropped for another before it fails -- which is the operational form of holding a portfolio.

Put together, the decision guide is short, and every row is chosen by assumption, not by benchmark:

Need	Deploy	Why
General key exchange	ML-KEM-768, hybridized with X25519	Efficient lattice core plus a classical backstop
Maximum-conservatism encryption	Classic McEliece or HQC	Code assumption, uncorrelated with lattices
General signatures	ML-DSA-65, hybridized	Efficient lattice signature with a classical hedge
Firmware and root-of-trust signing	SLH-DSA	Hash-only, shares nothing with the rest, longest-lived trust
Bandwidth-critical signing	Falcon	Smallest signatures, at the cost of a third lattice bet

Note: When you audit a stack for diversity, ignore the product names and list the assumptions. Three lattice schemes with three different names are one bet. A lattice KEM, a hash signature, and a code KEM are three. The name tells you the vendor; the assumption tells you what actually has to break.

One boundary, named once and handed off: the ways these schemes break in practice -- timing leaks in KEM decapsulation, the delicate floating-point sampling inside Falcon's signer, fault and power attacks -- are implementation attacks, a different and equally real surface owned by the sibling track. This section is about the mathematics you choose to deploy, not the code that runs it.

Every one of these moves is a refusal to concentrate -- the same refusal, at the level of a single deployment, that the whole standardization effort was reaching for. Which brings us back to the thesis, now with all the evidence in.

11. Common Misconceptions, Corrected

The fastest way to misread everything above is to reach for one of these seven conclusions. Each is a precise trap, and each answer defends the portfolio rather than any single scheme.

No. Every standardized scheme -- ML-KEM, ML-DSA, SLH-DSA -- currently stands, and HQC has been selected on top of them [@ir-8545]. The argument of this article is not that the stack is weak. It is that the stack's safety is a *diversified portfolio*, not the proven hardness of any one algorithm, because none of them is proven hard. No. The 2022 break was entirely *classical*: it applied Kani's 1997 reducibility criterion to the torsion-point data that SIDH publishes by design, and recovered the key in about ten minutes on a single ordinary core [@castryck-decru-2022; @kani-1997]. No quantum computer was involved. It was not Shor and it was not quantum. No. SIKE was a Round-4 *alternate candidate* still under evaluation, and it was broken before any selection was made [@ir-8413; @nist-2022-selection]. It was never standardized. The correct lesson is that a late-stage, heavily vetted candidate can fall without warning -- which is worse, not better, than a fringe scheme failing. A *generic, structural* break of Module-LWE would indeed threaten both -- that is the correlated-pair risk at the center of the map. But they use different parameters (moduli 3329 versus 8380417, different ranks and noise), and ML-DSA additionally rests on Module-SIS, so a *parameter-specific* attack on one need not transfer to the other [@fips-203; @fips-204]. The correlation is at the level of the shared assumption family, not identical instances. Its security *is* hash security -- that is the design, not a weakness [@fips-205]. And SHA-2 and SHA-3 carry the largest, most-scrutinized security margins in all of cryptography. Reducing entirely to that well-studied foundation, while sharing no algebraic structure with lattices or codes, is exactly why SLH-DSA is the conservative anchor of the portfolio. Because the trust is not placed in one assumption; it is placed in diversity. Lattice, code, and hash rest on unrelated mathematics developed by different communities, and are unlikely to all fall for the same reason at the same time. A break of one leaves the others standing. That is risk management under permanent uncertainty, which is the most any cryptographic science can offer. No -- it is HQC. Classic McEliece is standardized on the ISO track [@classic-mceliece-iso] and was not selected in this round; NIST's IR 8545 explains why it chose HQC over BIKE and why it did not select McEliece [@ir-8545]. Both are code-based, but the newly selected NIST KEM is HQC.

Notice what every answer has in common: not one of them defends a single algorithm. They defend the portfolio.

12. The Portfolio Is the Product

Put the evidence back together. Shor proved that two bets which looked independent -- factoring and discrete log -- were one bet on the abelian hidden-subgroup problem, and fell together the moment the right machine existed [@shor-1994]. SIDH proved that a family can vanish in an afternoon, classically, with no warning, when a 1997 theorem finally met the auxiliary data the protocol had been publishing all along [@castryck-decru-2022]. And the standardized stack, colored by assumption, clusters onto three families -- lattice, hash, and code -- with a genuinely correlated Module-LWE pair, ML-KEM and ML-DSA, sitting at its efficient center [@fips-203; @fips-204].

None of those assumptions is proven hard. None ever will be, short of settling questions about P, NP, and coNPP is the class of problems solvable quickly; NP the class whose solutions can be verified quickly. Whether the two are equal is the central unsolved question of computer science. that have resisted fifty years of effort. And even if they were proven hard one at a time, no theorem could certify them uncorrelated, because uncorrelatedness is a promise about mathematics not yet invented. That is the humbling floor under the entire post-quantum project.

So the security of the stack was never going to be the strength of its strongest algorithm. It is the deliberate, dated refusal to let its bets be correlated: hash-only SLH-DSA standing apart from everything, the March 2025 selection of code-based HQC precisely because it is not a lattice, and an on-ramp still searching for more uncorrelated bets [@fips-205; @ir-8545]. Diversity here is not a hedge bolted onto the design. It is the design.

That reframes what we have actually been buying all along. Not a proof. A portfolio.

We cannot prove the stack secure. But we can, and did, refuse to bet it all on one piece of mathematics.

This is the sentence you were handed in the first section, now earned. We are not betting on a proof. We are betting that lattice, code, and hash will not all fail for the same reason on the same day -- and we have arranged things so that if we are wrong about one, we are not wrong about all three. For a science that can prove nothing hard, that disciplined refusal to concentrate is not a consolation prize. It is the whole defense, and it is the best one available for the thirty years we are wagering on it.

How SLH-DSA Would Break: The Signature That Can Only Fall If a Hash Falls First

noreply@paragmali.com (Parag Mali) — Sat, 18 Jul 2026 00:00:00 GMT

**SLH-DSA (FIPS 205) is NIST's conservative post-quantum signature, and it is built from nothing but tweakable-hash calls** -- FORS few-time signatures under a hypertree of WOTS+ Merkle trees -- so it has almost no attack surface of its own. Its unforgeability reduces to a short list of hash properties (PRF, SM-TCR, SM-DSPR, ITSR), and the shipped *simple* variant rests on a random-oracle heuristic bought for a factor-three speed-up. The strongest structural result against it, a category-5 SHA-256 margin shortfall, produces no forgery and traces straight to the hash's Merkle-Damgard structure. Shor cannot touch it and Grover is already priced into the digest size, so its most likely structural break is a break of SHA-2 or SHAKE: it fails only if the hash falls first.

1. A Signature With Nothing of Its Own to Break

Every other digital signature standard has a soft spot you can name. RSA has integer factoring. ECDSA has the discrete logarithm. The two other post-quantum signatures NIST has standardized or drafted -- ML-DSA and FN-DSA -- rest on structured lattices [@fips204, @oqs_falcon]. Each of those is a specific piece of mathematics an adversary can attack on its own terms, and each has a research community devoted to doing exactly that.

SLH-DSA has none of them. No ring, no group, no lattice, no number theory of any kind. Its designers built it that way on purpose, so that it would have almost nothing of its own to attack. That choice is what makes a simple-sounding question strangely hard to answer: if a signature scheme has no mathematics of its own, how would it ever break?

That question is the whole article, and the answer is the thesis. SLH-DSA is the Stateless Hash-Based Digital Signature Algorithm, standardized by NIST as FIPS 205 on 13 August 2024 [@fips205]. It is assembled entirely from calls to a hash function, so its security rests on no hard number-theoretic problem -- only on a short, named list of properties of that hash.

Drive the analysis down through the construction and you never hit an algebraic layer where a clever attacker could set up shop. You hit the hash, and you stop. The scheme fails only if the hash falls first.

The standard security target for a signature scheme. An adversary who may request signatures on any messages of its choosing still cannot produce a single valid signature on any *new* message. Every reduction in this article is ultimately protecting EUF-CMA: to "break" SLH-DSA means to forge one signature the key owner never issued.

One fence needs setting before we start. This is a structural analysis -- it asks how the mathematics of SLH-DSA would fail, not the hardware it runs on, the code that implements it, or the random-number generator that feeds it. Those failure modes are real, and one even carries a headline-grabbing name (SLasH-DSA, a Rowhammer attack whose own authors call the scheme "theoretically sound") [@slash25].

But a bit flipped in DRAM is not cryptanalysis, and such attacks belong to this article's empirical sibling, not here. We are asking whether the design itself can be broken with pencil, paper, and computation.

One apparent exception is worth flagging now. Everywhere else in this series, the decisive structural threat is a quantum computer running Shor's algorithm, which dismantles factoring and discrete logs outright. Against SLH-DSA, Shor simply has nothing to grab -- a fact so central that a later section is spent on exactly why. To see how little there is to attack, you first have to see what the thing is made of.

2. What SLH-DSA Actually Is: FORS Under a Hypertree of WOTS+

Open the box. A signature you can verify with nothing but a hash function -- how is that even assembled? FIPS 205 answers top-down, and the shape is easier than the acronyms make it sound [@fips205, @openssl35].

The public key is tiny: essentially a single hash value (the root of a giant tree) together with a public seed, just 2n bytes, where n is the digest size [@fips205].

Signing has three stages. First, a pseudorandom function turns the secret key and the message into a randomizer, and a hash binds that randomizer, the public key, and the message into a message digest plus an index. Second, the message digest is signed by a FORS few-time signature at the bottom of the structure. Third, the FORS public key is authenticated up a hypertree -- a tree of Merkle trees -- whose layers are stitched together by WOTS+ one-time signatures.

Verification just recomputes hashes up to the root and checks that it matches the public key.

A tree of Merkle trees, stacked `d` layers deep (`d` is 7, 8, 17, or 22 in the standardized sets). Each layer is an ordinary Merkle tree whose leaves are WOTS+ public keys; a WOTS+ signature in one layer signs the root of the tree in the layer below. The single root at the very top is the SLH-DSA public key. The bottom layer can hold up to `2^68` leaves in the largest parameter set -- a quantity deliberately distinct from the signature budget below, and large enough to make an accidental leaf collision astronomically rare.The `2^68` leaf count belongs to SLH-DSA-256f (hypertree height `h = 68`); across the twelve sets the height is 63, 64, 66, or 68, so the leaf count is `2^63` to `2^68`. Do not confuse it with the `2^64`-signature budget discussed in Section 10 -- they are different numbers that happen to sit near each other [@fips205]. A hash call keyed, per call, by two extra inputs beyond its message: an `n`-byte public seed and a 32-byte address (`ADRS`) that names exactly which node of which tree at which layer is being hashed. Because every location in the whole structure gets a different address, every call is effectively a different keyed function. FIPS 205 uses three tweakable hashes, written `F`, `H`, and `T_l`, for every internal hash in the scheme; this per-call keying is what defeats multi-target attacks, as Section 6 makes precise.

Put the three layers in one picture and the absence of anything algebraic becomes visible.

flowchart TD subgraph L1["Layer 1 -- FORS few-time signature"] A["Message digest md"] --> B["FORS signs md"] B --> C["FORS public key becomes a leaf"] end subgraph L2["Layer 2 -- hypertree of WOTS plus Merkle trees"] C --> D["WOTS plus signs each subtree root"] D --> E["Merkle authentication paths climb d layers"] end subgraph L3["Layer 3 -- the public key"] E --> F["Top hypertree root plus public seed"] F --> G["Public key, only 2n bytes"] end TH["Every box is computed by a tweakable hash keyed by address plus public seed"] -.-> B TH -.-> D TH -.-> F

That is the entire scheme. There is no algebra anywhere -- no ring, group, or lattice, only hashing.OpenSSL's manual page for SLH-DSA documents the design as a fixed set of internal tweakable-hash roles -- seven hash-related functions in all -- and states plainly that the scheme "relies only on hash functions." [@openssl35] The contrast with the rest of the field is the thing to internalize before we go on.

Scheme	Security basis	Algebraic surface	Stateful?	Public key	Signature	Status
SLH-DSA	Hash only (SHA-2/SHAKE)	None	No	32 to 64 B	7,856 to 49,856 B	Final, FIPS 205 (2024) [@fips205, @oqs_slh]
XMSS / LMS	Hash only	None	Yes (leaf reuse)	tens of B	a few KB	Approved, SP 800-208 [@rfc8391, @sp800208]
ML-DSA	Module-LWE / Module-SIS	Lattice	No	1,312 to 2,592 B	2,420 to 4,627 B	Final, FIPS 204 (2024) [@fips204, @oqs_mldsa]
FN-DSA / Falcon	NTRU lattice	Lattice	No	897 to 1,793 B	666 to 1,462 B	Draft, FIPS 206 [@oqs_falcon]

Read down the "algebraic surface" column. SLH-DSA and its stateful cousins are the only rows that say None. Every other scheme carries a mathematical object that could, in principle, crack on its own terms. SLH-DSA pays for that emptiness in size and signing speed, and buys in exchange an attack surface that is nothing but its hash.

Key idea: The only cryptographic ingredient in SLH-DSA is the hash. FORS, WOTS+, the Merkle trees, the hypertree, even the pseudorandom functions that derive its secrets -- every one is a particular pattern of calls to a hash function. There is no second ingredient for an attacker to reach for.

If the whole scheme is just "hash it together correctly," where did that idea come from -- and has anyone, in half a century of trying, ever managed to break it?

3. Only a Hash: Lamport, Merkle, and the First Signatures

At a coffee house in Berkeley around 1975, Whitfield Diffie described a problem to Leslie Lamport: how could someone sign a digital document so that anyone can check the signature and no one can forge it? Lamport proposed a solution on the spot. By his own account it was the first digital signature algorithm, and it used no number theory at all -- just a one-way function [@lamport79].Lamport wrote the idea up formally in 1979 as Constructing Digital Signatures from a One-Way Function, an internal report he notes "is cited in the cryptography literature and is considered significant." [@lamport79]

That casual choice is the genetic marker of the entire family. From the very first idea, this branch of cryptography needed no factoring and no discrete logs. It needed a hash.

A key pair that can sign exactly one message safely. Lamport's version publishes hashes of secret values as the public key. To sign, the owner reveals the right secrets; a verifier hashes them and checks against the public key. Because inverting the hash is infeasible, only the owner can produce the preimages -- but the moment a second message is signed, enough secrets leak to forge a third.

Here is the whole scheme in code, including the fatal reuse: sign one message and it is secure; sign a second with the same key and an attacker can forge a third the owner never touched.

{` // toyHash is NOT cryptographic. It only illustrates a one-way function. function toyHash(x) { let h = 2166136261 >>> 0; for (const ch of x) { h = Math.imul(h ^ ch.charCodeAt(0), 16777619) >>> 0; } return ("00000000" + h.toString(16)).slice(-8); }

const idx = [0, 1, 2, 3]; // a tiny 4-bit message

function sign(sk, bits) { return bits.map(function (b, i) { return sk[i][b]; }); } function verify(pk, bits, sig) { return bits.every(function (b, i) { return toyHash(sig[i]) === pk[i][b]; }); }

const keys = keygen(); const m1 = [0, 1, 0, 1]; const sig1 = sign(keys.sk, m1); console.log("first message verifies:", verify(keys.pk, m1, sig1));

// The mistake: reuse the SAME key for a second, complementary message. const m2 = [1, 0, 1, 0]; const sig2 = sign(keys.sk, m2);

// The attacker has now seen a valid secret for BOTH values of every bit. const leaked = idx.map(function (i) { const row = []; row[m1[i]] = sig1[i]; row[m2[i]] = sig2[i]; return row; });

// Forge a THIRD message that was never signed by the owner. const forgery = [1, 1, 0, 0]; const forgedSig = forgery.map(function (b, i) { return leaked[i][b]; }); console.log("forged third message verifies:", verify(keys.pk, forgery, forgedSig)); `}

Run it and both lines print true. The security proof does not degrade gracefully after a second signature -- it evaporates. That single fact, "one key signs once," is the hazard the next fifty years of research engineered around. Notice what it is not: it is not a weakness in the hash, and not an algebraic shortcut. It is a usage rule. Break the rule and you leak secrets; keep it and there is nothing to attack but the one-way function itself.

Lamport's signatures are also large and clumsy: fresh keys for every message, thousands of bytes each. The fix came from Ralph Merkle, whose late-1970s Stanford work was published canonically as A Certified Digital Signature at CRYPTO 1989 [@merkle89].

A binary tree in which every leaf is the hash of a one-time public key and every internal node is the hash of its two children. Only the single root hash is published as the long-lived public key. To prove a leaf belongs under that root, a signer supplies the sibling hashes along the path from leaf to root -- the authentication path -- and the verifier recomputes the root. This turns many single-use keys into one small, reusable public key.

Merkle's tree is the structural move that makes hash-based signatures usable at all, and it is still the spine of every scheme in this article, up to and including SLH-DSA. Its defining property, the reason the whole line proved immortal, is that it "only depends on the existence of secure hash functions." No conjecture about factoring, no assumption about lattices. A hash.

timeline title From Lamport to FIPS 205 -- only ever a hash 1979 : Lamport one-time signatures 1989 : Merkle trees and the Merkle signature scheme 2011 : XMSS, a practical stateful Merkle scheme 2013 : WOTS+, a compact one-time signature 2015 : SPHINCS buys statelessness 2019 : SPHINCS+ framework and tweakable hashes 2024 : FIPS 205 standardizes SLH-DSA

The historical spine of the thesis is worth stating flatly: roughly fifty years after Lamport, there is still no structural break of the Merkle hash-tree construction. There never was an algebraic surface to attack, so no one has attacked one. But Lamport's key can sign only once, and Merkle's fix -- brilliant as it is -- quietly introduced a hazard that would dog the field for the next thirty years.

4. WOTS+ and XMSS: Powerful, Provable, and Dangerously Stateful

The hazard has a name: state. Merkle's tree is safe forever as a public key, but the signer now carries a fragile counter. It must remember which one-time leaves it has already spent, because each leaf is a one-time key and reusing one re-opens the Lamport failure from the last section.

A backup restore, a virtual-machine clone, a crash that rolls back the counter -- any of these can silently reuse a leaf and leak secrets. Why is a signer that must remember something a cryptographic landmine? Because state is the one part of a signing system that ordinary operations routinely corrupt.

Two refinements around 2011 to 2013 pushed this stateful design to its high-water mark. Andreas Hulsing's WOTS+ shrank the one-time leaf, and XMSS made the tree practical and provable.

A one-time signature that replaces Lamport's "one secret per bit" with hash chains. The message digest is written in base `w`; each base-`w` digit gets its own chain, whose start is a secret and whose end (after `w-1` hashes) is public. A signature reveals each chain iterated partway, to the digit's value. A separate checksum block prevents an attacker from advancing a chain to forge a larger digit. Larger `w` means fewer, longer chains -- smaller signatures but slower signing.

The checksum is the clever part, and it is worth watching it work. An attacker who sees a signature can always hash forward to forge a larger message digit. The checksum is constructed so that raising any message digit forces a checksum digit to fall -- which would require running a hash chain backward, that is, inverting the hash. That is the block.

{` // Illustrative only: toyHash stands in for a real one-way function. function toyHash(x){ let h = 2166136261 >>> 0; for (const c of String(x)) { h = Math.imul(h ^ c.charCodeAt(0), 16777619) >>> 0; } return "h" + (h >>> 0).toString(16).slice(0, 6); }

// One hash chain per digit: message digits, then checksum digits. const msg = [5, 2]; const full = msg.concat(toBaseW(checksum(msg), 2)); // [5, 2, 1, 7] const sk = full.map(function (, i) { return "wots_secret" + i; }); const pk = sk.map(function (s) { return chain(s, w - 1); }); const sig = full.map(function (d, i) { return chain(sk[i], d); });

// An attacker can only hash FORWARD from a published signature value. function forwardOnly(sigValue, fromSteps, toSteps){ if (fromSteps > toSteps) return null; // backward means inverting the hash return chain(sigValue, toSteps - fromSteps); }

// Try to raise the first message digit 5 -> 9. Trivial on its own chain... const target = [9, 2]; const targetFull = target.concat(toBaseW(checksum(target), 2)); // [9, 2, 1, 3] const forged = targetFull.map(function (d, i) { return forwardOnly(sig[i], full[i], d); }); const stuck = forged.some(function (v) { return v === null; });

console.log("honest signature verifies:", sig.every(function (s, i) { return chain(s, (w - 1) - full[i]) === pk[i]; })); console.log("checksum digits, honest vs forged:", full.slice(2), "vs", targetFull.slice(2)); console.log("forgery buildable by hashing forward only?", !stuck); `}

The forged checksum digits drop from [1, 7] to [1, 3], so the last chain would have to run backward. The attacker is stuck. WOTS+ gets this guarantee with a tight, standard-model proof, and it survives unchanged as the one-time layer inside SLH-DSA today.

XMSS wraps WOTS+ leaves in a modern Merkle tree with keyed hashing and forward-secure key derivation, and proves security on what its authors call minimal assumptions [@xmss11]. The RFC that standardized it states the property that matters for our thesis in the bluntest possible terms.

XMSS "provides cryptographic digital signatures without relying on the conjectured hardness of mathematical problems. Instead, it is proven that it only relies on the properties of cryptographic hash functions ... and is even secure when the collision resistance of the underlying hash function is broken." -- RFC 8391 [@rfc8391]

Read that last clause twice. XMSS keeps working even if an attacker can find hash collisions, because its proof leans only on the weaker property of second-preimage resistance.Source hygiene note: WOTS+'s ePrint identifier is disputed in the literature, so it is cited here by its DOI rather than an ePrint number [@wotsplus13]. That is what "minimal assumptions" buys: a scheme whose safety margin degrades slowly, not suddenly, as the hash weakens. It is also the first hint of why SLH-DSA leans on second-preimage and target-collision resistance rather than plain collision resistance.

And yet XMSS is still stateful. The signer must persist and advance a leaf index for every signature, and any reuse collapses security. This is exactly why NIST standardized the stateful schemes only behind a bright warning fence.

XMSS, its multi-tree variant XMSS^MT, and the Leighton-Micali schemes LMS and HSS were not retired. NIST approved them in SP 800-208 (2020) for settings where the signer's state can be tightly controlled -- above all firmware and code signing [@sp800208, @rfc8554]. LMS makes the same quantum argument as XMSS: hash-based signatures "would still be secure even if it proves feasible for an attacker to build a quantum computer" [@rfc8554]. The price of their smaller, faster signatures is the "never reuse a leaf" rule, enforced operationally rather than mathematically. They are the right tool when you sign rarely from one controlled machine, and the wrong tool for a general, high-fan-out protocol.

If reusing a leaf is the entire danger, the obvious question is whether you could pick leaves in a way that needs no memory at all -- so that accidental reuse is not forbidden by a rule, but negligibly rare by construction.

5. SPHINCS: Buying Statelessness With Size

You cannot make state safe. Every operational path that touches a counter -- backups, snapshots, failovers -- is a path that can corrupt it. So the 2015 breakthrough did not try to protect the state. It deleted it.

The scheme was SPHINCS, from Bernstein, Hopwood, Hulsing, Lange, and five co-authors, presented at EUROCRYPT 2015 [@sphincs15]. The insight is the first half of this article's second aha moment, and it is genuinely surprising: you can sign safely without remembering what you already signed, if you are willing to pay in size.

A signing scheme is stateless when it holds no secret internal state that must change from one signature to the next. The same signing operation, repeated, is always safe. Statelessness is what lets a signature be dropped into any protocol without a fragile counter to persist, roll back, or clone -- the exact hazard that dogged every stateful predecessor.

Here is how you buy it. Make the hypertree so astronomically large that its leaf space is effectively unlimited, then pick the signing leaf pseudorandomly from the message itself rather than from a counter. At the bottom of the chosen leaf, sign with a few-time signature -- one that tolerates a small number of accidental repeats -- instead of a strictly one-time one.

Size the whole thing so that, across an enormous budget of signatures, the probability of reusing a leaf enough times to matter stays negligible. No memory required: the "which leaf" question is answered by hashing the message, not by counting.

A signature key that stays secure across a small, bounded number of uses before its guarantee erodes -- a middle point between a one-time key (safe for exactly one message) and an unlimited key. Because SPHINCS selects its bottom key pseudorandomly, an occasional repeat is inevitable, so the bottom layer must tolerate a few uses. SPHINCS used a few-time scheme called HORST; SLH-DSA replaces it with FORS.

The trade was concrete, and its size story matters for the rest of the article. SPHINCS shipped a single instantiation, SPHINCS-256, whose signatures are about 41 KB and which its own paper designed to provide "2^128 security even against attackers equipped with quantum computers" [@sphincs15].SPHINCS was parameterized for up to 2^50 signatures per key pair; the standardized SLH-DSA later raised the design budget to as many as 2^64 [@huelsingblog].

That 2^128-quantum figure (and the 2^256-classical it implies, from its 256-bit hashes) is the AES-256 ballpark -- NIST's category 5, the highest security tier, not the lowest. Keep that anchor in hand: the famous 41 KB is a category-5-class number. When the next section reports SPHINCS+ shrinking the signature, the honest comparison has to hold the security level fixed rather than quietly sliding to an easier one.

flowchart LR A["Lamport OTS -- signs only once"] --> B["Merkle tree -- reusable root, but now stateful"] B --> C["WOTS plus and XMSS -- smaller and provable, still stateful"] C --> D["SPHINCS -- deletes state, but 41 KB and multi-target exposure"] D --> E["SPHINCS plus and SLH-DSA -- smaller, multi-target-resistant, assumption trimmed"]

But statelessness did not come free, and the two costs it introduced are exactly what the next generation set out to cut. First, size: even at 41 KB, SPHINCS-256 was an order of magnitude larger than a lattice signature [@sphincs15, @huelsingblog]. Second, and more subtly, SPHINCS exposed itself to multi-target attacks. With a single hash function reused across all instances (global bitmasks, not keyed per location) and an unverifiable pseudorandom index, an attacker who computed one hash value could aim it at all the few-time instances at once, effectively multiplying the odds of success by the number of targets [@huelsingblog].

Notice, again, what these costs are not: neither is a forgery. Nobody broke SPHINCS; it worked exactly as proved. It was simply too big and left a generic hash attack more room than its designers wanted. Both bills -- tens of kilobytes and a new way to gang up on the hash -- had to be paid by the next generation without surrendering statelessness.

6. SPHINCS+ and FIPS 205: FORS, Tweakable Hashes, and an Attack Surface You Can List

Three cuts, one result. How do you shrink the signature, neutralize the multi-target attack, and end with an attack surface you can write on an index card? SPHINCS+, submitted to NIST in November 2017 and standardized as SLH-DSA in 2024, closed SPHINCS's gaps one at a time [@huelsingblog, @fips205].

Cut one: tweakable hashing. Every internal hash call is keyed by an address plus the public seed, producing a distinct effective function for every location in the structure. The idea arrived as multi-target mitigation in Hulsing, Rijneveld, and Song at PKC 2016, and was abstracted into the general notion of tweakable hash functions in the SPHINCS+ Framework at CCS 2019 [@pkc16, @ccs19]. This cut deserves mechanizing rather than sloganizing: "it keys the hash so multi-target attacks go away" hides the actual arithmetic.

Here is the mechanism. Preimage and second-preimage resistance are targeted properties, and the SPHINCS+ specification states the danger exactly: "If it suffices to break the given property for one out of many targets, the adversarial effort is reduced by a factor of the number of targets" [@sphincsspec].

Concretely, suppose the scheme publishes T hash values, all outputs of one fixed function F. An attacker computes a single candidate F(x) and tests it against all T targets at once, so the expected work to hit some target falls to $2^n / T$: the security level slips from $n$ bits to $n - \log_2 T$.

Keying removes exactly that discount. With a per-call tweakable hash F(PK.seed, ADRS, x), each target lives under its own address, so a computed value can match only the one target sharing that address. The attacker can no longer spread one evaluation across many targets; it must attack each of the T separately. The factor-T amortization is gone, and T folds into the security analysis as a small logarithmic term instead of being subtracted from the level. That is precisely the single-function, multi-target property (SM-TCR / SM-DSPR) the next section names.The address ADRS is 32 bytes: a 4-byte layer (which of the d hypertree layers), a 12-byte tree (which Merkle tree in that layer), a 4-byte type word that takes one of seven values, and a 12-byte type-dependent tail naming the exact key pair, chain, and node. FIPS 205 says its purpose in one line: "A different ADRS value is used for each call to each function ... to mitigate multi-target attacks" [@fips205, @sphincsspec].

Cut two: verifiable index selection. SPHINCS chose its leaf with an unverifiable pseudorandom index, part of what let attackers pool targets. SPHINCS+ computes the index together with the message digest: a randomizer R, itself part of the signature, is hashed with the public key and the message to produce both the digest and the index. Now every attacker-chosen message is bound to exactly one few-time instance and is useless against any other [@huelsingblog].

Cut three: FORS replaces HORST. The few-time layer was rebuilt to be leaner.

The few-time signature at the bottom of SLH-DSA. A FORS key is not one monolithic tree but `k` separate trees of height `a = log t`; the leaves are hashes of `k` times `t` secret values, and the FORS public key is the tweakable hash of all `k` roots. Because each of the `k` message-selected indices draws from its *own* dedicated set of secrets, FORS is markedly smaller and faster than the HORST scheme it replaced, and even if one message maps twice to the same index the signature reveals different secrets.Swapping HORST for FORS gives each message index a dedicated set of secrets, which is what shrinks both signature size and signing time [@huelsingblog, @sphincsspec].

There was also a proof-side refinement. Bernstein and Hulsing's 2019 work on decisional second-preimage resistance (DSPR) removed a statistical assumption the tight security reduction had previously needed on the hash [@dspr19]. We will meet DSPR again in the next section; for now, note that it is yet another property of the hash, added to a list that already had several.

Put the mechanism in one picture. Signing derives a randomizer, binds the message to the public key, splits the result into a message digest and an index, FORS-signs the digest, and authenticates the FORS public key up the hypertree.

flowchart LR M["Message M"] --> R["PRF derives randomizer R"] R --> H["Hash binds R, public key, and M into a digest"] H --> S["Split into message digest md, tree index, leaf index"] S --> F["FORS signs md"] F --> A["Hypertree of WOTS plus authenticates the FORS public key"] A --> SIG["Signature is R plus FORS sig plus hypertree sig"]

The result was decisive on every axis the designers cared about, and its size story is best read at a fixed security level.The popular "41 KB to 8 KB" line is a cross-level comparison. At level 5 the honest cut is about 41 KB (SPHINCS-256) to about 30 KB (SLH-DSA-256s, 29,792 bytes); the roughly 8 KB figure is a new level-1 capability (SLH-DSA-128s, 7,856 bytes), not a same-level shrink of SPHINCS-256. The two numbers sit at opposite ends of the security range and should not be subtracted [@sphincs15, @fips205]. Holding NIST category 5 fixed, the SPHINCS-256 signature of about 41 KB became roughly 30 KB in SLH-DSA-256s; separately, SPHINCS+ newly reached category 1 at about 8 KB (SLH-DSA-128s), a tier SPHINCS-256 never targeted [@sphincs15, @fips205].

The multi-target attack was folded into parameters rather than the security level. A statistical proof assumption was gone. And twelve parameter sets were defined over just two hash families.SPHINCS+ originally shipped three hash instantiations: SHAKE-256, SHA-256, and Haraka. FIPS 205 dropped Haraka and kept only SHA-2 and SHAKE, which is precisely why "SHA-2 or SHAKE" is the exact phrase for the standard [@fips205, @sphincsorg]. NIST selected this design in July 2022 and published it as FIPS 205 in August 2024 [@ir8413, @nistsel, @fips205].

Here is the second half of the aha moment. After all three cuts, the entire question of whether SLH-DSA can be forged reduces to a short, explicit list of properties -- and every item on the list is a property of the tweakable hash. Not a lattice, not a group, not a number-theoretic conjecture. A handful of things you can ask about SHA-2 or SHAKE. That is what it means to drive an attack surface all the way down to the hash.

So what, exactly, is on that list -- and is "it reduces to the hash" the whole story, or a comforting simplification?

7. What "Reduces to the Hash" Really Means

There is a one-line version of this article's thesis that you will see repeated in slide decks: SLH-DSA "reduces to second-preimage and target-collision resistance." That line is almost right. And for a piece about how a thing would break, almost right is not good enough, because the gap between the slogan and the truth is exactly where the only honest worries live.

Here is the real property set the security reduction bottoms out at. There are four items, not two.

Property	What it guards	Which object
PRF	secrecy of every secret value the scheme derives	the pseudorandom functions [@ccs19]
SM-TCR	no useful second preimage across many keyed targets	the tweakable hash in WOTS+, Merkle, and the hypertree [@ccs19, @pkc16]
SM-DSPR	removes a statistical assumption so the proof can be tight	the tweakable hash [@dspr19]
ITSR	no forgery assembled from revealed FORS subsets	the FORS few-time layer [@pkc16]

The single-function, multi-target hash properties SLH-DSA's proof invokes. **SM-TCR** (target-collision resistance) and **SM-DSPR** (decisional second-preimage resistance) are properties of the *tweakable* hash: "single-function, multi-target" captures the fact that an attacker may choose among many targets but faces a distinct keyed function at every location -- exactly what the per-call `ADRS` keying of the previous section provides, which is why "multi-target" is already priced into the property rather than left as a discount for the attacker. **ITSR** (interleaved target subset resilience) is the property of FORS that bounds an attacker's advantage from the message-dependent choice of which secret subsets are revealed across many signatures.

Look at the third column. Every single property is a property of the hash (or of the pseudorandom functions, which are themselves built from the hash). There is nothing else in the list. This is the thesis stated precisely instead of loosely: to break SLH-DSA you must defeat one of these, and each one is a question about SHA-2 or SHAKE.

flowchart TD EUF["EUF-CMA unforgeability of SLH-DSA"] --> PRF["PRF security"] EUF --> TCR["SM-TCR of the tweakable hash"] EUF --> DSPR["SM-DSPR of the tweakable hash"] EUF --> ITSR["ITSR of FORS"] PRF --> HASH["A property of SHA-2 or SHAKE"] TCR --> HASH DSPR --> HASH ITSR --> HASH

Now the distinction that the slogan hides, and the single most important nuance in this article. SPHINCS+ was defined in two instantiation styles. One -- the sturdier of the two, built for a standard-model reduction to the properties above -- carries a proof that does not treat the hash as magic. The other, the simple style, is faster but rests on a heuristic. FIPS 205 standardized the simple style [@sphincsorg, @fips205].

"The simple variants are pure random oracle instantiations. These ... achieve about a factor three speed-up ... at the cost of a purely heuristic security argument." -- sphincs.org [@sphincsorg] A proof technique that treats the hash function as if it were a perfectly random function every party can query. ROM proofs are common and have a good track record, but they are heuristic: no real hash is a random oracle, so a ROM proof is strong evidence of security rather than a guarantee reducible to a concrete, named property of the specific hash. The variant FIPS 205 standardized has its security argument in the ROM.

This is why the focus word "conservative" needs careful handling. It does not mean "backed by a tight standard-model proof of the shipped scheme," because the shipped scheme's argument is a random-oracle heuristic.

Read "conservative" as *design-level* conservatism, not as a statement about the tightness of the proof of the standardized variant. SLH-DSA is conservative because it makes minimal, well-studied assumptions (a hash, nothing more), uses large parameters, budgets for up to `2^64` signatures, and inherits roughly fifty years of a lineage in which no structural forgery has ever appeared. That is a strong basis for trust. It is a *different* basis than "the exact bytes NIST shipped have a tight standard-model reduction," which they do not -- they have a ROM argument bought for a factor-three speed-up over the standard-model style [@sphincsorg]. Both things are true at once, and an honest "how it breaks" analysis has to hold both.

There is one more honest wrinkle, and it cuts the right way. The tight security reduction for the multi-target and ITSR arguments turned out to have a gap -- a genuine bug in the proof. Kudinov, Kiktenko, and Fedorov reported it in 2020; Andreas Hulsing and Mikhail Kudinov then recovered the tight proof and published it at ASIACRYPT 2022 [@kkf20, @hk22].

Sit with what that episode is and is not. It is a flaw in an argument about the scheme, found and fixed by the scheme's own community. It is not a forgery, not an attack, not a weakness anyone could exploit. Even SLH-DSA's imperfections are imperfections of proofs and hashes -- never of algebra, because there is no algebra to be imperfect.

So the precise version of the thesis is this: every property the reduction needs is a property of the hash, and the one place the standardized scheme trades a tight proof for speed is a place where the residual risk is in the heuristic, not in some hidden mathematical structure. Every wrinkle so far has been about proofs and hashes. But has anyone actually attacked the standardized scheme and gotten anywhere?

8. The Strongest Test: Breaking Category-Five SPHINCS+ With SHA-256

In 2022, three NIST cryptographers -- Ray Perlner, John Kelsey, and David Cooper -- set out to break the highest-security version of the scheme their own agency was about to standardize. Their paper is titled, provocatively, Breaking Category Five SPHINCS+ with SHA-256 [@pkc22]. It is the single most important piece of evidence in this whole article, and not for the reason the title suggests.

What they found is a genuine shortfall. Using a purely classical analysis, they showed that the SHA-256 category-5 parameter sets do not quite reach the NIST category-5 security level -- each security claim comes down by roughly 40 bits [@pkc22, @wiki_sphincs]. That is a real result, presented at a real conference, about the shipped standard. Take it seriously.

Now read the two qualifications that turn it from a scare into the article's decisive move.

First: there is no practical forgery. The analysis needs an astronomically large number of signatures and an infeasible amount of computation; it moves a margin, it does not produce a forged signature. The authors are explicit that their work does not call the general soundness of the design into question [@wiki_sphincs].

Second, and this is the whole point: the shortfall traces directly to SHA-256's internal Merkle-Damgard structure -- specifically the multicollision and "herding" behaviors that chaining construction permits. It is not a weakness in FORS, or WOTS+, or the hypertree, or the index selection, or any part of the SPHINCS+ design. It is a property of the hash.

The internal design of SHA-2 (and of MD5 and SHA-1 before it): a hash built by chaining a compression function across message blocks. That chaining is what enables multicollision and herding shortcuts, which make some multi-target attacks cheaper than they would be against an ideal function. SHAKE is built on a different internal design, the sponge, which does not share this particular shortcut.

The consequence is striking. The SHAKE-based category-5 sets, being sponge constructions rather than Merkle-Damgard, are not subject to the same effect. The very same SLH-DSA design, wrapped around a different hash, does not show the shortfall. If that does not convince you the "weakness" belongs to the hash rather than the scheme, nothing will.

The engine is multicollision and herding on a Merkle-Damgard hash. Because SHA-256 chains a compression function block by block, an attacker can build a large set of messages that all collide to a chosen intermediate value far more cheaply than the ideal `2^n` cost, then "herd" a target into that set. Against the category-5 SHA-256 parameters, exploiting this structure lowers the effective work by about 40 bits versus the claimed level. Swap in SHAKE, whose sponge has no comparable intermediate-state chaining, and the shortcut disappears [@pkc22, @wiki_sphincs].

The other thing worth mechanizing is how SLH-DSA behaves when you push it, because "degrades gracefully" is another slogan that hides real arithmetic. The FORS few-time layer is what wears out as a key pair signs more messages, and it erodes smoothly for a structural reason.

A forgery assembled from already-seen material needs a fresh message whose k FORS positions are all already revealed by the signatures the attacker has seen -- and that requires two independent coincidences at once. The same hypertree leaf I must recur (probability $2^{-h}$ per signature), and all k of the message-selected indices must land on already-revealed spots. The SPHINCS+ specification gives the coverage probability exactly [@sphincsspec]:

$$\Pr\left[S_0 \subset S_1 \cup \dots \cup S_q\right] = \sum_{\gamma} \binom{q}{\gamma}\left(1 - 2^{-h}\right)^{q-\gamma} 2^{-h\gamma}\left[1 - \left(1 - 1/t\right)^{\gamma}\right]^{k}$$

Because k independently chosen positions must be covered simultaneously, and repeated leaves are themselves rare, this is a high-order function of the signature count q.At the design budget the number is astronomically small: for the level-5 set (t = 2^14, k = 22, h = 64) at q = 2^64, the coverage probability is about 2^-256.01. Past the budget it declines smoothly -- roughly 10 bits of margin per doubling for the level-5 set (about 7 bits for level 1), the exponent falling 256.0, 246.5, 235.3 across q = 2^64, 2^65, 2^66 -- and it accelerates only gradually, never as a discontinuity [@sphincsspec, @kp22]. Below the budget the term sits far above the category-level target and does nothing; the flat, hash-property terms set the security level. Only once you pass the budget does it begin to bind, and then it slides rather than snaps.

Kolbl and Philipoom characterize the same behavior from the design side: security "degrades ... surprisingly slowly," the limit "can be exceeded by several orders of magnitude before it becomes a practical issue," and their reduced-budget sets keep over 100-bit security even at 2^30 signatures [@kp22].

Note: The strongest published in-scope result against SLH-DSA is not an attack on SLH-DSA. It is an attack on SHA-256's Merkle-Damgard structure that happens to lower a SPHINCS+ margin, produces no forgery, degrades gracefully, and vanishes when you switch to SHAKE. Every property of that result points at the hash and away from the design. This is the thesis proving itself in the one place where a structural weakness might have appeared.

This is the third aha moment, and it reframes everything a casual reader might have assumed. "There is a paper breaking category-five SPHINCS+" sounds like the scheme has a real structural flaw, like any other cryptosystem. It does not. The best shot anyone has taken landed exactly where this article said any weakness would have to live: on the hash, not on the construction wrapped around it.

Key idea: The single strongest structural result against SLH-DSA is an attack on SHA-256, not on SLH-DSA. It yields no forgery, it degrades gracefully, and it disappears on the SHAKE parameter sets -- because the "weakness" was inherited entirely from the hash.

How a hash break would actually arrive -- what a real advance against SHA-2 or SHAKE would look like -- is the subject of Part 2 of this series, How SHA-2 and SHA-3 Would Break. This article does not need to re-derive it; it only needs to show that this is where every path leads. If the strongest structural test lands on the hash and yields no forgery, then the real question is not whether SLH-DSA breaks but how it would -- and which hypothesis is most likely.

9. Weighing the Hypotheses: How Would It Actually Break?

Put every candidate on trial. There are four ways SLH-DSA could conceivably fall, and honesty demands we rank them worst rival first rather than simply asserting the thesis. Here they are, with the property each one would have to defeat.

Hypothesis	The attack it requires	Property it defeats	Likelihood
A (the thesis)	a preimage, second-preimage, or collision advance on SHA-2 or SHAKE	SM-TCR / SM-DSPR -- the hash	Most likely structural break
B (the caveat)	a flaw in the ROM heuristic or in the tweakable-hash keying and addressing	the security argument, not the compression function	The most interesting honest caveat
C (bounded)	exhausting or mis-sizing the FORS few-time and ITSR budget	ITSR	Bounded, graceful degradation
D (dismissed)	a classical algebraic structural break	none -- no such object exists	Dismissed

Hypothesis A -- a break of the hash. This is the thesis, and it ranks first because it is the only place the reduction actually bottoms out. If someone finds a better-than-generic multi-target preimage or second-preimage attack, or a damaging collision advance, against SHA-2 or SHAKE, then SM-TCR or SM-DSPR weakens and SLH-DSA's margin moves with it.

This is not a hypothetical about SLH-DSA's design; it is a hypothetical about the hash -- precisely the subject Part 2 of this series takes up. Everything in Sections 6 through 8 was building the case that this is where a real break would begin.

Hypothesis B -- a break of the argument, not the compression function. This is the honest caveat, and the most interesting entry in the table, because it is the one the careful reader of Section 7 should be worried about. The shipped simple variant rests on a random-oracle heuristic. Suppose the heuristic itself is flawed -- not because SHA-256's compression function is weak, but because the way SLH-DSA uses it (the tweakable-hash keying, the addressing scheme, the domain separation) fails to behave like the random oracle the proof assumes.

That would be a real break, and it would not be a break of the hash's compression function [@sphincsorg, @sphincsspec]. But note what it still is not: algebraic. There is no ring or lattice here either. It is a failure of a hash-construction argument -- a close cousin of the thesis, not a refutation of it.

Hypothesis C -- a budget failure. FORS is a few-time signature, and ITSR bounds how much an attacker gains as signatures accumulate. Sign far past the 2^64 design budget, or mis-parameterize the few-time layer, and the margin erodes. But as Section 8 established with the coverage formula, this erosion is a smooth, high-order decline -- on the order of ten bits per doubling just past the limit -- not a cliff [@kp22, @sphincsspec]. It is a parameter and usage boundary, the kind of thing an operator avoids by respecting the budget, not a structural forgery lurking in the mathematics.

Hypothesis D -- an algebraic break. This is the one every other article in this series spends its length on, and here it is dismissed in a sentence, because there is no algebra to attack. No ring, no group, no lattice, no number-theoretic structure. The absence is not an oversight; it is the entire design goal. You cannot break a mathematical structure that was deliberately never included.

flowchart TD Q1{"Is there an algebraic structure to attack?"} -->|"No such structure exists"| D["Hypothesis D dismissed"] Q1 -->|"Only hash-based targets remain"| Q2{"Attack the function, the argument, or the budget?"} Q2 -->|"The compression function"| A["Hypothesis A -- break SHA-2 or SHAKE"] Q2 -->|"The argument or keying"| B["Hypothesis B -- ROM heuristic or tweakable-hash construction"] Q2 -->|"The usage budget"| C["Hypothesis C -- FORS and ITSR budget"] A --> HASH["Every surviving path ends at the hash"] B --> HASH C --> HASH

Stare at the decision graph and the pattern is unmistakable: the only path that leads away from the hash is the one marked "dismissed," and it is dismissed precisely because the structure it would attack was never built. Every other path -- every path a real attacker could actually walk -- ends at SHA-2 or SHAKE.

Rank aside, two hard walls bound all of this: what can actually be proved, and what a quantum computer changes. It is time to meet the limits.

10. The Two Ceilings: What Is Provable, and What Quantum Changes

Two walls bound everything in this article. One is what can be proved. The other is what a quantum computer does.

Take the proof ceiling first. As Section 7 laid out, the standardized simple variant has a random-oracle argument, while the sturdier standard-model style carries a tight reduction to the hash properties [@sphincsorg]. The 2^64-signature budget is a designed ceiling, not a cliff -- pass it and security degrades slowly rather than snapping [@kp22]. So the honest statement of the upper bound is: SLH-DSA's shipped security is as good as its random-oracle argument and its parameters, both of which are conservative, and neither of which is a tight standard-model proof of the exact bytes NIST published.

There is also a lower bound that no amount of cleverness escapes: size. Statelessness bought with a hypertree, on top of a hash-only construction, forces signatures into the kilobyte range. FIPS 205 fixes the layout exactly [@fips205]:

$$|SIG| = \left(1 + k(1 + a) + h + d \cdot \mathit{len}\right) \cdot n$$

Read the four terms left to right: a one-block randomizer R costs n bytes; the FORS signature costs $k(1 + a) \cdot n = O(k \log t \cdot n)$ bytes (each of the k FORS trees reveals a secret and its length-a authentication path, so it is not merely $O(k \cdot n)$); the hypertree signature costs $(h + d \cdot \mathit{len}) \cdot n$ bytes, which splits into d stacked WOTS+ signatures of $\mathit{len} \cdot n$ each plus an $h \cdot n$ Merkle authentication path. The single largest term is the one people usually forget.

Set	n	R	FORS `k(1+a)n`	WOTS+ `dlenn`	paths `h*n`	Total	WOTS+ share
128s	16	16	2,912	3,920	1,008	7,856	49.9%
128f	16	16	3,696	12,320	1,056	17,088	72.1%
192s	24	24	6,120	8,568	1,512	16,224	52.8%
192f	24	24	7,128	26,928	1,584	35,664	75.5%
256s	32	32	10,560	17,152	2,048	29,792	57.6%
256f	32	32	11,200	36,448	2,176	49,856	73.1%

Evaluate that formula on the twelve standardized sets and it reproduces the FIPS 205 sizes exactly. The breakdown is the surprise: the d WOTS+ hypertree signatures are the largest component of every single parameter set, from 49.9% at 128s to 75.5% at 192f, and they are biggest in the f ("fast") sets because those stack the most layers d [@fips205]. FORS is second at roughly 20 to 38%. The Merkle authentication paths and the randomizer -- the parts a casual explanation usually blames -- are the two smallest terms, together under 15%.

It is one full Winternitz signature at each of the d hypertree layers, not the authentication paths, that makes SLH-DSA kilobyte-scale. The size is the cost of having no algebra: the same emptiness that removes the attack surface removes the option of a small signature.The hypertree's leaf count and the signature budget are different quantities. The bottom layer holds 2^63 to 2^68 leaves depending on the set, sized to absorb the 2^64-signature budget with negligible reuse. The level-1 and level-3 s sets even have fewer leaves (2^63) than the 2^64 budget -- safe only because the bottom is a few-time FORS key, so a leaf can be reused a handful of times without collapse [@fips205].

Now the quantum ceiling, which is where SLH-DSA differs from every other primitive in this series. The threat that dismantles RSA and ECC is Shor's algorithm, which needs a hidden-subgroup or period structure -- factoring, discrete logs -- to act on [@shor97]. A hash exposes no such structure. Shor has literally nothing to grab. This is not a lucky accident of parameter choice; it is a structural fact, and it is precisely why NIST anchored its most conservative signature in hashing rather than in more algebra.

The only quantum lever against a hash is Grover's algorithm, which speeds up generic unstructured search from $2^n$ to $2^{n/2}$ [@grover96]. That is a quadratic speedup, and it is generic -- it applies to any search, exploits no structure, and is fully absorbed by choosing a large enough digest. It is the reason SLH-DSA uses digest sizes of 16, 24, and 32 bytes for categories 1, 3, and 5 [@fips205].

{` // Costs shown as log2 of the work (the exponent). Bigger is harder. const digests = [ { level: 1, nBits: 128 }, { level: 3, nBits: 192 }, { level: 5, nBits: 256 } ];

digests.forEach(function (d) { const classicalExp = d.nBits; // 2^n classical preimage search const groverExp = d.nBits / 2; // 2^(n/2) with Grover console.log( "category " + d.level + " (n=" + d.nBits + " bits): " + "classical 2^" + classicalExp + ", quantum 2^" + groverExp ); });

// Grover only halves the exponent. A 256-bit digest still leaves 2^128 quantum // work -- infeasible -- which is why NIST maps digest sizes to categories with // Grover already priced in. console.log("Grover turns 2^256 into 2^128: still out of reach, and already budgeted."); `}

Run it and the pattern is plain: Grover halves the exponent, never the base. A category-5 digest that would cost $2^{256}$ classically still costs $2^{128}$ against a quantum search -- which is why the digest sizes were chosen where they were.

Note: "SLH-DSA has no structural quantum attack" and "Grover gives a generic speedup" are different statements, and conflating them is the source of most confusion about hash-based signatures. Shor finds nothing to act on because there is no hidden-subgroup or period structure [@shor97] -- a structural fact. Grover offers a generic quadratic speedup against any search -- a generic fact, already absorbed by the 16, 24, and 32-byte digest sizes [@grover96, @fips205]. The first says the door does not exist; the second says a known, smaller door was measured and walled off in advance.

If nothing inside the construction can move the margin -- not the proof, not the size, not a quantum computer acting structurally -- then progress and risk both have to live somewhere else. Where is the research frontier actually pointing?

11. The Frontier Is the Hash's Frontier

Every honest survey ends with the open problems, and SLH-DSA's are worth listing -- not because they are alarming, but because of the single surprising thing they all have in common.

Can the standardized variant get a standard-model guarantee without losing the speedup? FIPS 205 shipped the simple variant, whose security is a random-oracle heuristic; the standard-model style exists but runs about three times slower [@sphincsorg]. Closing that gap -- a standard-model proof at the simple variant's speed -- is the central residual question. DSPR and the recovered tight proof strengthened the standard-model case, but no one has produced a standard-model proof of the simple construction at simple-variant speed [@dspr19, @hk22].

How tight is the FIPS-205 bound, really, and can it be machine-checked? The tight reduction was itself once buggy and then recovered, which is exactly the kind of history that motivates mechanizing the proof end to end [@hk22]. In 2024 a scheme-level machine-checked tight proof of SPHINCS+ covering the standardized parameter sets was formally verified in EasyCrypt [@ec24]; the residual target is tightening that mechanization to the exact FIPS 205 byte-level specification and the simple variant's random-oracle argument.

Can the signatures shrink without touching the assumption? Fluhrer and Dang's 2024 work, Smaller Sphincs+, gives a simpler formula for the security strength of a parameter set at a given number of signatures and uses it to search for smaller sets [@fd24]. The size floor from Section 10 -- dominated by those d WOTS+ hypertree signatures -- bounds how far this can go, but there is room to move by trading the signature budget for bytes.

Should the SHA-2 category-5 sets be re-parameterized relative to SHAKE? The roughly 40-bit shortfall from Section 8 is a Merkle-Damgard artifact absent from the sponge-based SHAKE sets. Perlner, Kelsey, and Cooper quantified it; Kolbl and Philipoom characterized the graceful degradation; parameter guidance was proposed [@pkc22, @kp22]. Whether the standard should adjust the SHA-2 category-5 parameters is a live maintenance question.

Now stand back and look at that list as a whole. Every entry is, at bottom, a question about a hash. The ROM question asks whether the way SLH-DSA calls its hash behaves like a random oracle. The tightness question asks how precisely the hash properties bound the forgery probability. The size question is constrained by how much hashing an authentication path and a stack of WOTS+ signatures irreducibly require. And the category-5 question is explicitly about SHA-256's internal structure versus SHAKE's. There is not one open problem on the list whose resolution lives outside the hash.

Key idea: SLH-DSA's open problems are the hash's open problems. Because the attack surface is the tweakable hash, every question that could actually move the scheme's security margin -- better multi-target or quantum preimage attacks, a structural weakness in Merkle-Damgard or in the sponge -- is a question about SHA-2 or SHAKE. The frontier of SLH-DSA is the frontier of its hash.

That is the loop closing. The construction drove its attack surface all the way down to the hash, and so the research questions came to rest in the same place. Every margin-moving advance would be an advance against SHA-2 or SHAKE -- which is the whole content of Part 2 of this series. Knowing all of this, the last question is the practical one: how should you actually use the thing?

12. Using It: Parameters, Misconceptions, and the Boundary

You have decided SLH-DSA is the conservative hedge -- the signature whose failure is bounded by a hash rather than a lattice. Now the practical questions: what do you actually pick, and what should you not believe about it?

Three choices define a parameter set. The s ("small") family produces smaller signatures but signs much more slowly; the f ("fast") family signs faster at roughly double the signature size [@openssl35]. The category (1, 3, or 5) sets the digest size n and the assurance horizon, with signature size growing roughly linearly as you climb. And the hash family is SHA-2 or SHAKE: identical in size, with SHAKE sidestepping the Merkle-Damgard category-5 nuance from Section 8, and SHA-2 potentially faster where hardware acceleration exists [@fips205, @openssl35].

Parameter set	NIST level	Public key	Signature
SLH-DSA-128s	1	32 B	7,856 B
SLH-DSA-128f	1	32 B	17,088 B
SLH-DSA-192s	3	48 B	16,224 B
SLH-DSA-192f	3	48 B	35,664 B
SLH-DSA-256s	5	64 B	29,792 B
SLH-DSA-256f	5	64 B	49,856 B

Each of these six comes in a SHA-2 and a SHAKE flavor -- for example SLH-DSA-SHA2-128f and SLH-DSA-SHAKE-128f -- giving the twelve standardized sets in all; the sizes are identical across the two hash families [@oqs_slh, @openssl35].

Note: Respect the 2^64-signature budget per key: it is a designed ceiling with graceful degradation beyond it, not a limit to test. And keep SLH-DSA off hot signing paths -- its slow signing and large signatures make it a poor fit for per-request handshakes or high-throughput APIs, where ML-DSA is the better default [@fips204].

Note: XMSS and LMS produce smaller, faster signatures, and it is tempting to reach for them when SLH-DSA's kilobytes hurt. But choosing statefulness re-imports the exact hazard SLH-DSA was built to remove: a single reused leaf index, from a rollback, a clone, or a restored backup, can enable forgery. Use the stateful schemes only where the signer's state is tightly controlled, under the rules of SP 800-208 [@sp800208].

No. Shor's algorithm needs hidden-subgroup or period structure -- the kind found in factoring and discrete logs -- and a hash exposes none, so Shor has nothing to act on [@shor97]. That structural emptiness is exactly why NIST chose a hash-based scheme as its conservative anchor. The only quantum lever is Grover's generic quadratic speedup, and it is already absorbed by the digest size [@grover96]. No. It rests on hash assumptions -- PRF, SM-TCR, SM-DSPR, and ITSR -- and the shipped simple variant rests on a random-oracle heuristic rather than a tight standard-model proof. It is conservative in its assumptions, not unconditional [@sphincsorg, @ccs19]. No -- and it helps to know where the bytes actually go. The dominant term is the `d` stacked WOTS+ hypertree signatures, one Winternitz signature per hypertree layer, which are 50 to 76% of every signature; FORS is second, and the Merkle authentication paths plus the randomizer are the smallest parts. Size is the price of statelessness and a hash-only construction, not a weakness an attacker exploits [@fips205, @oqs_slh]. That is an out-of-scope hardware fault attack on OpenSSL's in-memory state, not cryptanalysis of the mathematics. The SLasH-DSA authors themselves call the scheme "theoretically sound" [@slash25]. No. Perlner, Kelsey, and Cooper found a roughly 40-bit margin gap with no practical forgery, tracing to SHA-256's Merkle-Damgard structure; the degradation is graceful and the SHAKE sets avoid the effect entirely [@pkc22, @kp22]. Security degrades slowly, not off a cliff -- on the order of ten bits per doubling just past the limit, per the coverage formula in Section 8. It is a parameter and usage boundary, not an instant forgery, and staying within the budget avoids it entirely [@kp22, @sphincsspec]. ML-DSA is NIST's fast, small, general-purpose default, carrying a lattice assumption. SLH-DSA is the conservative, hash-only hedge for long-lived, low-volume, maximally independent keys -- root-of-trust and firmware signing rather than per-request traffic [@fips204, @ir8413]. In 2025, researchers demonstrated SLasH-DSA, a software-only universal forgery against SLH-DSA -- achieved by using Rowhammer to flip bits in OpenSSL's in-memory state, not by cryptanalyzing the mathematics [@slash25]. It is a hardware fault attack, and its own abstract calls the scheme "theoretically sound," adding that even theoretically sound schemes can fail under real-world conditions. That sentence draws this article's fence for us. Side channels, fault and power attacks, implementation bugs, RNG failures, and protocol misuse are real and consequential -- and out of scope here. They belong to the empirical sibling, *How the NIST Finalists Broke*. This piece asked only whether the mathematics can be broken.

And that answer has been the same at every layer. Drive the analysis down through FORS, through the hypertree of WOTS+, through the tweakable hash, and you never reach an algebraic floor where a forger could set up shop. You reach the hash, and you stop. The only assumption SLH-DSA cannot insure is the security of that hash -- every in-scope wrinkle in fifty years of this lineage, from Lamport's reuse rule to the category-5 SHA-256 shortfall, traces back to exactly that place. Which is why the whole story compresses to a single line.

It fails only if the hash falls first.