- Matthew Green's study estimates how much public research has gone into attacking the math behind standardized encryption. Lattices lead elliptic curves by 1.3 to 2.6 times in its cumulative measures.
- The page calls itself a working draft. It counts public work only, may overstate researcher time, was built by AI models, and still awaits independent human verification.
- Ask vendors which math problems your encryption rests on, and whether you could switch algorithms without a rebuild.
Every encryption scheme rests on a bet. The bet is that a certain math problem is hard to solve. Few executives ask how many people have tried to win that bet against it. Matthew Green's new study tries to count them. The page describes itself as a working draft, so its figures deserve to be read as such.
Confidence in a cipher is a record of attention
The idea is simple. A problem that many capable people have attacked in public, without success, earns trust. A problem few have studied has earned less. That attention has rarely been measured.
Green's study measures it for the math behind standardized public-key encryption. Three problem families are the focus. ECDLP, the elliptic-curve discrete logarithm, asks for a secret number hidden behind a public point on a curve. MLWE (structured) and LWE (plain) are lattice problems. They ask for a hidden secret behind equations blurred with small errors. Syndrome decoding asks for the original message inside a scrambled code with errors added.
Factoring, isogenies and multivariate systems serve as comparisons.
How the count works
The team began with about sixteen thousand candidate papers. They came from four sources: IACR ePrint, DBLP, OpenAlex and zbMATH. A written rubric sorted them. After duplicates were removed, 2,785 distinct works remained in the main categories.
A raw paper count has a flaw. A short note weighs the same as a long research program. So the study also maps authors to papers. It groups 7,613 authorships into about 3,240 author identities, some unresolved.
For each person, it estimates what share of their papers fall in each problem class. Two authors with half their output in one class together log one "research-allocation year" for it.
What it found
Lattice research now exceeds ECDLP research in the main cumulative views. The ratio runs from roughly 1.3 to 2.6, depending on counting and source choices. The paper-count view crosses in 2017. The author-based view crosses in 2019.
Factoring and finite-field discrete logarithms together still lead on accumulated years in this model. The range of ratios comes from different measures. It is not a confidence interval.
On this measure, the gap between lattices and ECDLP looks modest: a small multiple, not orders of magnitude. The authors add that no defensible numerical error bar is available. Read the ratio as context, not as a verdict.
Effort is not distance, and public is not total
The study is careful about what its numbers do not say. Publishing on a topic is not the same as working on it full time. So the estimates may substantially overstate researcher time. A career-adjusted view lowers the main totals by roughly a quarter. It is also only a proxy.
A separate track measures distance, which is a different question from effort. It compares an attack's modeled work with a public computational record, in bits. Ten bits stands for a factor of roughly 1,000. RSA-2048's gap of about 35 bits is an extrapolation, not a measured runtime. The authors say these gaps are not security levels.
Then there is the missing work. Unpublished failures, private research and classified effort are not counted. The authors tried to size secret government effort from public budget papers. They concluded the documents do not allow it.
One leaked FY2013 document implies roughly 300 to 500 staff on a research budget line, give or take a factor of two. But it is a spending category, not a headcount of codebreakers. It dates from 2012 and does not split by type of math problem.
The authors add a caveat. Missing work does not make their estimates a floor. The estimates may themselves be too high.
Where AI enters twice
The study restates past human effort as AI spending, under assumed productivity gains. At a tenfold gain, one human research-year matches $25,000 of inference. Run the other way, $100,000 of AI spend stands for 0.4, 4 or 40 human-years at 1, 10 or 100 times. The authors call these assigned equivalents, not measured jobs replaced.
The study also compares disclosed AI costs with the literature around selected problems. One case is Anthropic's HAWK report, which the study lists among recent AI cryptanalysis results with disclosed costs. Its roughly $100,000 is the API cost of the discovery. It is not the cost of carrying out a key-recovery attack.
The authors caution against reading too much into AI successes. A problem can stay open for decades because few people tried it. A cheap AI answer may expose an overlooked question. It does not show that AI can replace sustained scrutiny.
The second entry is the study itself. Three AI models did the technical work: Claude Fable 5.1, Claude Opus 5.5 and, in a supporting role, GPT-6 Astra. Smaller Claude models ran the first sort of papers. Green set the questions, made the key method choices and oversaw the work.
The page says an agent checked the sources. It says independent human verification is still outstanding.
Bruce Schneier, who flagged the work, called it "a good first stab" and noted that unpublished and secret work does not count. A study of how much scrutiny a claim has received is itself waiting for scrutiny.
What to ask your team
First, ask which math problems your vendors' encryption rests on. Ask whether you keep a list of them. Second, ask whether you could swap an algorithm without rebuilding the product.
Third, treat any effort ratio as a rough guide to scale, not a security rating. Finally, when an AI-produced analysis reaches your desk, ask who verified it and how. Here the authors answered openly: not yet, by humans.
Confidence in a cipher is a record of attention. That attention can be counted only in part.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Matthew Green (bitsofwork.org).
