AI models estimate cryptanalysis effort spent on public-key algorithms

Cryptographer Matthew Green has launched a new website that estimates the cumulative cryptanalyst-hours spent analyzing various public-key algorithms. The project, published on October 15, 2026, uses artificial intelligence to process academic literature and quantify research effort. This represents a novel attempt to measure the security scrutiny applied to different cryptographic assumptions.

The analysis classifies work on the elliptic curve discrete logarithm problem, structured and plain lattices, and syndrome decoding. By converting published papers into estimated research-allocation years, the study tracks historical effort. Lattice-based methods have only recently overtaken elliptic curves in this cumulative measure of cryptanalytic attention.

Methodology and AI Execution

The study was conducted primarily by AI models, including Claude Fable 5.1 and Claude Opus 5.5, which built the data pipeline and ran the analysis. GPT-6 Astra also contributed to the work. Matthew Green set the research questions, made key methodological decisions, and oversaw the entire process. The AI models wrote the summary page for the project.

Researchers used roughly sixteen thousand candidate papers as the primary data source. They classified cryptanalytic work using a person-level author map to convert publications into estimated time spent. This approach treats the academic literature itself as the instrument for measuring effort across different cryptographic families.

Limitations and Caveats

The publication-based estimates may substantially overstate the actual time spent on cryptanalysis. The analysis relies exclusively on published work, meaning any unpublished academic research is excluded from the metrics. This omission includes significant cryptanalysis efforts that did not result in formal papers.

Intelligence agency cryptanalysis conducted in secret is also absent from the data. Because these hidden efforts are not recorded in public literature, they cannot be accounted for in the estimates. Green noted that despite these limitations, the project serves as a good first attempt at creating such a metric.

What should you do?

Security professionals should monitor emerging metrics on cryptographic research effort when evaluating algorithm longevity. Organizations should review their current public-key infrastructure to understand which assumptions are under heavy scrutiny. Teams should prepare for potential shifts in recommended algorithms as lattice-based methods gain more analytical attention.

What to do and how to stay safe: Matthew Green

• Review current cryptographic algorithms in use to identify reliance on elliptic curves or lattice-based structures.
• Monitor academic literature and security advisories for new cryptanalysis results affecting your chosen algorithms.
• Evaluate post-quantum cryptography migration plans in light of increased research interest in lattice problems.
• Consult vendor documentation to ensure implementations follow current best practices for key management.

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which AI models were used to conduct this cryptanalysis estimation study?

The study utilized Claude Fable 5.1, Claude Opus 5.5, and contributions from GPT-6 Astra to build the pipeline and analyze data.

Has lattice-based cryptography received more cryptanalysis effort than elliptic curves?

Yes, according to the study, lattices have overtaken elliptic curves in cumulative cryptanalysis effort, though this shift occurred only recently.

Does this study include secret government cryptanalysis efforts?

No, the study relies only on published academic papers, so secret intelligence agency work and unpublished academic research are excluded.