Measuring Human Cryptanalysis Effort: How Scrutinised Is Your Crypto?

What was published

Bruce Schneier flagged a new site from Matthew Green at bitsofwork.org. It tries to estimate how many cryptanalyst-hours have gone into analysing different public-key algorithms. Security teams usually treat a cryptosystem's confidence as qualitative: it has been studied for years, and nobody has broken it. This work tries to turn that intuition into a number.

According to the abstract, the authors started from roughly sixteen thousand candidate papers. They classified the cryptanalytic work on ECDLP (the elliptic-curve discrete logarithm problem), structured and plain lattices, syndrome decoding, and their comparators. They then converted papers into estimated research-allocation years through a person-level author map.

What the headline finding says

The abstract states that lattices have overtaken elliptic curves in this cumulative measure only recently. The authors express that history as inference budgets under stated productivity assumptions. Elliptic-curve cryptography is what most deployed systems rely on today. Lattice problems underpin many of the post-quantum candidates. The recency of that crossover is a reminder that the newer assumptions have had far less time under adversarial scrutiny than the older ones.

Why it matters to practitioners

• Migration planning. Moving to new public-key schemes trades a known quantum risk for assumptions with a shorter public scrutiny record. A metric lets you discuss that trade-off with evidence instead of folklore.
• Hybrid designs. Combining a classical and a post-quantum primitive is a hedge against exactly this uncertainty. Effort estimates give a rough way to reason about which half of the hybrid has had more review.
• Crypto-agility. If scrutiny differs across assumptions, systems should be built so algorithms can be swapped without a redesign.

Caveats that matter

The authors say the publication-based estimates may substantially overstate actual time spent, since a paper does not map cleanly to hours of work. Schneier adds that the method relies on published work, so anything unpublished does not count. That includes academic cryptanalysis that never produced a paper, and intelligence-agency cryptanalysis done in secret. He calls it a good first stab at a metric of this sort.

Treat the output as one input to a risk assessment, not a security proof. More research effort without a break is weak evidence of strength. It is not a guarantee, and it says nothing about implementation flaws, side channels or protocol misuse, which cause most real-world failures.

A note on provenance

The page states that the study was conducted by AI models. It says Claude Fable 5.1 and Claude Opus 5.5 built the pipeline, ran the analysis and wrote the page, with contributions from GPT-6 Astra. It also says Matthew Green set the questions, made the key methodological decisions and oversaw the work. Readers should apply the same scrutiny they would to any methodology they cannot reproduce. That means checking how papers were classified and how the author map converts publications into years.