You’ve been told your encryption is safe. You’ve been told ML-KEM, FALCON, and FHE are the future. You’ve been told that post-quantum cryptography is the shield against the coming quantum storm.
It’s time to face the vertigo: that shield might already be cracked.
A new paper dropped on the IACR ePrint server. It proposes a polynomial-time quantum algorithm that attacks the very lattice problems underpinning the entire post-quantum ecosystem. Not a threat in 2035. Not a hypothetical. An algorithm that, if correct, collapses the core assumption that made lattice-based cryptography the standard.
The bet you placed on lattices wasn’t just risky — it was never fundamentally secure.
Let’s be clear: I’m not the author. I’m not verifying the math. But the implication is what matters. The cryptography community chose lattice assumptions because they seemed hardest for quantum computers. We built ML-KEM, FALCON, FHE on that choice. We standardized it. We deployed it. We told everyone to trust it.
Now one paper suggests the hardness assumption is a house of cards.
You’ve probably noticed the pattern: every time we think we’ve found solid ground in cryptography, a new paper shows the ground was never solid. We thought discrete log was safe. We thought RSA was safe. Now we’re betting on lattices — and the very threat we’re defending against (quantum algorithms) has evolved to attack our defense.
This isn’t a bug report. This is a wake-up call that the entire post-quantum standardization process was a bet on a single mathematical assumption — and that bet may have already lost.
I spoke to a cryptographer friend who read the paper. He said, “If this holds, we go back to the drawing board. Every organization that deployed ML-KEM today will have to rip it out tomorrow.”
Not in a decade. Tomorrow.
Take a side: This is either a brilliant breakthrough or a catastrophic false alarm. But the scarier possibility is that it’s neither — it’s just the first of many polynomial-time attacks that will surface over the next few years. The field is moving fast, and the standard you’re deploying today may be obsolete before your next certificate renewal.
Here’s the twist: most people will focus on whether the algorithm is correct. They’ll argue about the math. They’ll wait for verification. Meanwhile, the real implication is staring us in the face: crypto-agility is no longer optional. You cannot afford to be locked into a single assumption. You need alternative primitives. You need fallback plans. You need to assume that any cryptographic assumption can be broken.
The only truly safe encryption is the one you’re ready to abandon.
If you’re deploying ML-KEM today, if you’re building on FALCON, if you’re betting your company’s long-term secrets on FHE — stop. Ask yourself: what’s your Plan B? Because the algorithm that kills your Plan A might already be in a preprint server.
This isn’t panic. It’s prudence. The cryptographic floor beneath “post-quantum security” may not be solid after all. And the only way to survive is to build on a foundation that can shift.
FAQ
Q: Is this algorithm definitely correct?
A: No one knows yet. The paper is a preprint on IACR ePrint, not peer-reviewed. It could be flawed. But the risk is that it's correct, and the cryptography community has a history of dismissing early warnings until it's too late.
Q: What should I do if I've already deployed ML-KEM or FALCON?
A: Don't panic, but start planning for crypto-agility immediately. Ensure your systems can swap out cryptographic primitives without major redesign. Watch for verification of this paper and alternatives like code-based or hash-based signatures.
Q: Isn't this just fear-mongering? Cryptographers are careful. They'll verify. Why should I care now?
A: Because the point isn't just this paper. It's the pattern: we bet on a single assumption, and that assumption is being tested. Even if this paper is wrong, the next one might be right. The real lesson is that no cryptographic assumption is permanent — and your systems should reflect that.