The term on this page
- PQCpost-quantum cryptography
- algorithms that run on ordinary computers and are believed to resist quantum attack
Also mentioned
ML-KEMML-KEMModule-Lattice-based Key Encapsulation MechanismModule-Lattice-Based Key-Encapsulation Mechanism, the NIST-standardized post-quantum KEM derived from CRYSTALS-Kyber and specified in FIPS 203.Read the full entry (new tab), ML-DSAML-DSAModule-Lattice-based Digital Signature AlgorithmModule-Lattice-Based Digital Signature Algorithm, the NIST-standardized post-quantum signature scheme derived from CRYSTALS-Dilithium and specified in FIPS 204.Read the full entry (new tab), NISTNISTNational Institute of Standards and TechnologyThe U.S. National Institute of Standards and Technology, the agency that develops and publishes cryptographic standards, including the FIPS series and post-quantum algorithms.Read the full entry (new tab) are defined in the glossary.
A quantum algorithm claims to undermine lattice cryptography. Your team has just approved a migration to ML-KEM. Do you stop the rollout? The August 2026 proposal by Daniel R. Simon makes that question concrete. A subsequent paper refutes the proposed algorithm. The useful lesson is how to translate that evidence into an engineering decision.
Read this first
The published refutation rules out the analyzed DCP algorithm, not every possible quantum attack on lattices. This episode does not establish a break of deployed ML-KEM or ML-DSA. Keep migration decisions tied to evidence, and make algorithm replacement a tested capability.
What the papers actually establish
Simon’s ePrint 2026/1591 claims a polynomial-time quantum algorithm for the Dihedral Coset Problem, or DCP. Its relevance comes from reductions connecting DCP to lattice problems. That is a theoretical claim with potentially important consequences. It is not a report of recovering an ML-KEM deployment’s secret key.
The archive records receipt on 3 August and a latest revision on 17 August. Its abstract acknowledges a correction to Lemma 3 and points readers to the opposing preprint. Those version details matter: an assessment of an earlier draft is not automatically an assessment of every subsequent revision.
Aparna Gupte, Seyoon Ragavan and Mark Zhandry’s ePrint 2026/1693, received on 15 August and revised on 1 September, analyzes the proposal dated 11 August. Their result addresses the algorithm itself: it cannot recover even the least-significant bit of the DCP secret with non-negligible guessing advantage.
The mechanism concerns information retained from classical Fourier labels. The authors show that the proposed computation can be approximated using only the labels’ most-significant third, and prove that this limited information is insufficient for the claimed success. Their result covers a broader class of algorithms meeting its conditions. It does not rule out every conceivable DCP algorithm.
| Evidence | What it supports | What it does not establish |
|---|---|---|
| A proposed efficient DCP algorithm | A claim worth specialist scrutiny | A practical attack on deployed parameter sets |
| A no-go theorem for the analyzed construction | That construction does not solve DCP as claimed | Permanent security of lattice cryptography |
| A formal proof artifact | An inspectable route to checking a precisely stated result | Correctness of an unrelated library or production system |
A proof artifact changes the review conversation
The authors also publish a Lean 4 formalization, including an algorithm specification and proofs of their information-theoretic theorem and no-go corollary. The repository documents its dependencies and checks. It also discloses language-model assistance.
That is useful because a reader can examine the definitions and attempt to reproduce the checks. It is a stronger artifact than an unsupported claim that an AI has verified some mathematics. But the formal statement must still correspond to the intended algorithm, and its assumptions must still be appropriate. We reviewed the published descriptions for this article; we have not independently rebuilt or audited the Lean development.
For engineering teams, the parallel is practical. A cryptographic review should leave something another reviewer can inspect: a versioned specification, explicit assumptions, reproducible checks and a stated scope. Our PQC conformance testing guide describes the implementation side of that discipline. A proof about an algorithm and a test of its implementation answer different questions.
Three decisions to make before the next alarming paper
- Assign an evidence owner. Record the exact paper version, the claimed problem and parameter regime, the independent analysis, and the conditions that would change your deployment decision. Do not turn a headline directly into a change request.
- Map the affected dependencies. Identify the algorithms, protocols, libraries, key lifetimes and owners in use. A mathematical result matters operationally through those dependencies; start with a cryptographic inventory.
- Rehearse replacement. Choose a bounded test environment, exercise compatible peers, measure size and latency changes, verify downgrade rejection, and document recovery. Treat crypto-agility as demonstrated behavior, not a checkbox on a procurement form.
A useful incident exercise is to assume that one approved algorithm becomes unsuitable. Ask which service would fail first, which stored artifacts must remain verifiable, and who can authorize a replacement. If the answers depend on undocumented formats or fixed-size database fields, the exercise has found work your migration plan should already contain.
Hybrid deployment and mathematical diversity are different
A classical and post-quantum hybrid can protect against failure of one component under the construction’s security assumptions. It does not give you two independent post-quantum foundations. If a future attacker can break both the classical component and the chosen PQ component, the hybrid label does not rescue the connection. Protocol composition and downgrade behavior still need review.
NIST’s March 2025 HQC selection announcement makes the diversity rationale explicit: HQC uses code-based mathematics, unlike ML-KEM’s structured lattices. The announcement described a backup standardization path and advised organizations to continue migrating to the finalized standards. That historical selection is not, by itself, evidence that every product supports HQC today.
Keep those decisions separate in procurement. Ask what is standardized, what the product implements, what peers can negotiate, and what the team has tested. A cryptographic audit should make these boundaries visible rather than collapse them into a single claim of being quantum-safe.
The point
This refutation gives teams a reason to reject one claimed shortcut, not a reason to declare the migration finished or abandon it. The operational question remains: can you identify the systems that depend on an assumption, assess new evidence, and change them without inventing the process during an emergency?
Daniel Romero Ruiz’s August article in El lado del mal prompted this review. Our assessment above uses the primary records available on 11 September, including the refutation’s September revision. Further context is available in our news archive and the ML-KEM standard explainer.
References
- Daniel R. Simon: A Polynomial-Time Quantum Algorithm for the Dihedral Coset Problem, ePrint 2026/1591; archive history and author notes.
- Gupte, Ragavan and Zhandry: The ePrint:2026/1591 Quantum Algorithm Does Not Solve DCP, revised 1 September 2026.
- Companion Lean 4 formalization, authors’ specification and proof repository.
- NIST selects HQC, 11 March 2025.
- Daniel Romero Ruiz: Cómo se desmontó el algoritmo, 22 August 2026; article that prompted this review.