UAM • Kryptografia kwantowa i postkwantowa • Reference deck

Quantum, Lattices, Codes & NIST Standards

Reference slides for Weeks 2–5 and Week 8

Bartosz Naskręcki — Spring 2026

Material reused verbatim from Elements of Cryptanalysis, Parts XIII–XV, Chapters 37–45
bnaskrecki.faculty.wmi.amu.edu.pl/crypto/

How to read this deck in our course

This is the upstream cryptanalysis-course reference. We use it as the spine for the weeks that reuse upstream chapters; weeks with new chapters (W1, W6, W7) have their own decks.

Slide range	Course week	How to use
Part XIII (Slides 2–15)	(already covered in half 1)	Skim or skip. Recap if students forget Shor / Grover detail.
Part XIV: Lattices	W2 – W4	W2 = SVP/CVP/LLL; W3 = ML-KEM (NTT, parameter sets, FO); W4 = primal/dual attacks & signatures.
Part XV: Codes & Standards	W5 & W8	W5 = ch 43 (McEliece, Goppa, ISD); W8 = ch 44 (FIPS 203/204/205) and ch 45 (synthesis).

For the new chapters in this course, open the dedicated decks: w1_pqc_landscape.html, w6_hash_based.html, w7_ntru_mv_isogeny.html.

Part XIII

The Quantum Threat

Chapters 37–39

Quantum Computing Basics Ch 37

Classical bits are 0 or 1. Qubits can exist in a superposition of both states simultaneously.

Definition — Qubit. A qubit is a unit vector in ℂ²:

|ψ⟩ = α|0⟩ + β|1⟩ where |α|² + |β|² = 1

Measurement yields 0 with probability |α|² and 1 with probability |β|², collapsing the state.

On the Bloch sphere: |ψ⟩ = cos(θ/2)|0⟩ + e^iφsin(θ/2)|1⟩

Three pillars of quantum advantage:

Superposition — a qubit encodes both 0 and 1 simultaneously
Entanglement — correlations with no classical analogue; measuring one qubit instantly determines the other
Interference — amplitudes can add or cancel, amplifying correct answers

Key caveat: We cannot read out all values from a superposition. Measurement collapses the state to a single outcome. Quantum algorithm design is the art of using interference to boost the probability of the desired answer.

Chapter 37 — Quantum Computing Foundations

Quantum Gates and Circuits Ch 37

Quantum gates are unitary matrices (U†U = I), ensuring reversibility and norm preservation.

Gate	Matrix	Action
Pauli-X	`[0 1; 1 0]`	Bit flip: \|0⟩↔\|1⟩
Pauli-Z	`[1 0; 0 -1]`	Phase flip: \|1⟩→-\|1⟩
Hadamard H	`(1/√2)[1 1; 1 -1]`	Creates equal superposition
CNOT	4×4	Flips target if control is \|1⟩

Quantum parallelism: applying H^⊗n to |0⟩^⊗n yields an equal superposition over all 2ⁿ basis states:

H^⊗n|0⟩^⊗n = (1/√2ⁿ) Σ_x=0^2ⁿ-1 |x⟩

Applying a unitary U_f evaluates f on all inputs simultaneously. But the art lies in extracting the answer via interference and measurement.

Bell state (maximally entangled):
|Φ+⟩ = (|00⟩ + |11⟩)/√2
Created by H on qubit 0, then CNOT(0,1).

Chapter 37 — Quantum Computing Foundations

Shor's Algorithm: Factoring in Polynomial Time Ch 38

Peter Shor (1994) showed that a quantum computer can factor integers in O(n³ log n) operations, where n is the number of bits.

Core Reduction. Factoring N reduces to finding the period r of f(x) = a^x mod N (the multiplicative order of a modulo N).

If r is even and a^r/2 ¬≡ -1 (mod N), then gcd(a^r/2 ± 1, N) gives nontrivial factors.

Success probability: For semiprimes N = pq, at least 1/2 per random choice of a. Typically 1–2 attempts suffice.

Quantum Fourier Transform (QFT):

QFT|j⟩ = (1/√N) Σ_k=0^N-1 ω^jk|k⟩

where ω = e^2πi/N. Implemented with O(n²) gates on n qubits — exponentially faster than classical FFT on the full vector.

The QFT detects periodicity in superposition: peaks at multiples of Q/r reveal the period r. Continued fractions extract the exact value.

Chapter 38 — Shor's Algorithm

Shor's Impact: What Breaks? Ch 38

System	Hard Problem	Quantum Attack	Status
RSA	Integer factoring	Shor: polynomial time	Broken
Diffie-Hellman	Discrete log in Z_p*	Shor: polynomial time	Broken
ECDH / ECDSA	Elliptic curve discrete log	Shor variant: polynomial time	Broken
AES-128	Key search (2¹²⁸)	Grover: 2⁶⁴	Weakened
AES-256	Key search (2²⁵⁶)	Grover: 2¹²⁸	Believed secure
SHA-256	Preimage (2²⁵⁶)	Grover: 2¹²⁸	Believed secure

Total break, not merely weakened. Shor's algorithm does not just reduce RSA's security margin — it eliminates it entirely. A 4096-bit RSA key, classically requiring longer than the age of the universe to factor, could be broken in hours on a sufficiently large quantum computer. Estimated requirement: ~4,000 logical qubits (or ~4–12 million physical qubits with error correction) for RSA-2048.

Chapter 38 — Shor's Algorithm

Grover's Algorithm: O(√N) Search Ch 39

Lov Grover (1996): find a marked element among N items in O(√N) queries, vs. O(N) classically.

Oracle U_f (phase oracle): flips the sign of the target state.
U_f|x⟩ = (-1)^f(x)|x⟩ = I - 2|x*⟩⟨x*|

Diffusion D (inversion about the mean):
D = 2|s⟩⟨s| - I, where |s⟩ = uniform superposition.

Grover iteration: G = D · U_f

Optimal iterations: t_opt = ⌊π/4 · √N⌋
Success probability ≥ 1 - 1/N.

Geometric picture: The state lies in a 2D plane spanned by |w⟩ (target) and |w⊥⟩ (non-targets). Each Grover iteration rotates by 2θ toward |w⟩, where sin θ = 1/√N.

Overshooting. Unlike classical search, too many iterations decrease success probability — the state rotates past the target. The oscillation follows sin²((2t+1)θ).

Chapter 39 — Grover's Search Algorithm

Grover’s Algorithm: Quantum Circuit Visual

Chapter 39 — Grover’s Algorithm

Grover's Effect on Symmetric Cryptography Ch 39

Grover halves the effective bit-security of symmetric ciphers and hash functions:

Cipher	Key bits	Classical	Post-Grover	Action
3DES	168	168-bit	84-bit	Retire
AES-128	128	128-bit	64-bit	Upgrade
AES-192	192	192-bit	96-bit	Marginal
AES-256	256	256-bit	128-bit	Safe
ChaCha20	256	256-bit	128-bit	Safe

Hash functions: SHA-256 preimage resistance drops from 256-bit to 128-bit (still safe). Collision resistance: birthday attack already gives 128-bit; Grover provides no further advantage for collisions.

The good news: Grover's speedup is only quadratic, not exponential. The fix is simple — double the key length. AES-256 retains 128-bit security even against quantum adversaries.

Practical caveat: Running Grover on AES-128 requires a quantum circuit implementing AES as a reversible oracle on ~2,800 logical qubits, plus ~2⁶⁴ sequential iterations. The actual wall-clock time may exceed classical brute force due to the slow quantum clock speed. The real concern is algorithmic improvements that combine Grover with structural attacks.

Chapter 39 — Grover's Search Algorithm

Timeline: When Will Quantum Computers Break Crypto? Ch 38–39

Year	Milestone	Significance
1994	Shor's algorithm announced	Polynomial-time factoring (theoretical)
2001	IBM factors 15 (7-qubit NMR)	First experimental demonstration
2019	Google "quantum supremacy" (53 qb)	Quantum advantage on contrived problem
2023	IBM Condor (1,121 qubits)	Noisy qubits; no error correction at scale
2024	NIST PQC standards published	ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205)

Resource gap. Breaking RSA-2048 requires ~4,000 logical qubits (Gidney & Ekerå 2021) or ~4–20 million physical qubits with surface-code error correction. Current processors: ~1,000 noisy physical qubits. The gap is large but closing.

"Harvest now, decrypt later." Adversaries can record encrypted traffic today and store it until a quantum computer becomes available to decrypt it. For data with a long secrecy lifetime (government, medical, financial), migration to post-quantum cryptography is already urgent.

Chapters 38–39 — Quantum Algorithms & Impact

Discussion Reflection

Should we migrate to post-quantum cryptography today?

Consider the following factors:

Data lifetime: How long must your secrets remain secret?
Migration time: How long will it take your organisation to deploy new algorithms?
Mosca's theorem: If data lifetime + migration time > time to quantum computer, you are already too late.
Risk tolerance: Can you afford the downside of being wrong about the timeline?
Performance cost: PQC algorithms have larger keys and may be slower — is this acceptable?

Parts XIII–XV — Discussion

Part XIV

Lattice-Based Cryptography

Chapter 40

Lattice Fundamentals Ch 40

Definition — Lattice. Given a basis matrix B ∈ R^n×n, the lattice generated by B is:

L(B) = { Bx : x ∈ Zⁿ }

The set of all integer linear combinations of the basis vectors.

Key property: A lattice has infinitely many bases. Some are "good" (short, nearly orthogonal); most are "bad" (long, nearly parallel). Finding a good basis from a bad one is computationally hard.

Determinant: det(L) = |det(B)|, independent of basis choice. Governs the density of lattice points.

Minkowski's Theorem. Every n-dimensional lattice L with determinant Δ contains a nonzero vector of length at most:

λ₁(L) ≤ √n · Δ^1/n

Finding such a short vector is the Shortest Vector Problem (SVP).

Ajtai's breakthrough (1996): Average-case lattice problems are as hard as worst-case lattice problems. This gives lattice-based crypto a unique theoretical advantage — breaking the scheme on random instances implies solving every instance of a hard lattice problem.

Chapter 40 — Lattice Problems and LWE

Hard Lattice Problems Ch 40

SVP (Shortest Vector Problem).
Given a lattice basis B, find the shortest nonzero lattice vector v ∈ L(B).
NP-hard to approximate within any constant factor.

CVP (Closest Vector Problem).
Given a lattice basis B and a target point t, find the lattice point closest to t.
At least as hard as SVP.

LWE (Learning With Errors) — Regev 2005.
Given (A, b = As + e mod q), find the secret s, where:

A ∈ Z_q^m×n is a random matrix
s ∈ Z_qⁿ is the secret
e ∈ Z^m is a small error vector (from a discrete Gaussian)

Hardness: Regev proved a (quantum) reduction from worst-case lattice problems (GapSVP) to LWE.

Why LWE? The error e is what makes LWE hard. Without it, solving As = b mod q is trivial linear algebra. With it, the problem becomes as hard as worst-case lattice problems.

Chapter 40 — Lattice Problems and LWE

Lattice: Shortest Vector Problem Visual

Shortest Vector Problem (SVP).
Given a lattice basis B, find the shortest nonzero lattice vector \( \mathbf{v} \) minimizing \( \|\mathbf{v}\| \).

LLL Algorithm (Lenstra-Lenstra-Lovász, 1982):
Finds a vector within \( 2^{(n-1)/2} \) of the shortest in polynomial time. Not exact, but good enough for some applications.

Hardness: Exact SVP is NP-hard under randomized reductions. Approximate SVP within polynomial factors is believed hard — this is the foundation of lattice-based cryptography (ML-KEM, ML-DSA).

Key idea: Bad basis → hard to find short vectors. Good basis → easy. Basis reduction algorithms trade off quality vs. time.

Chapter 37 — Lattice-Based Cryptography

The LLL Algorithm: Lattice Reduction Ch 40

The Lenstra–Lenstra–Lovász (LLL) algorithm (1982) is a polynomial-time lattice reduction algorithm.

LLL guarantee. Given an n-dimensional lattice basis, LLL outputs a reduced basis whose shortest vector satisfies:

||b₁|| ≤ 2^(n-1)/2 · λ₁(L)

Running time: O(n⁵ d log³ B) where B bounds the entries.

LLL finds an approximately shortest vector. The approximation factor 2^(n-1)/2 is exponential in n — too weak for cryptographic parameters.

BKZ (Block Korkine-Zolotarev): Generalises LLL by applying SVP solvers to blocks of size β. As β increases:

Approximation quality improves (shorter vectors)
Running time increases exponentially in β
Best known: 2^O(β) time via lattice sieving

Cryptographic parameters are chosen so that BKZ with the required block size β to break the scheme would take ≥ 2¹²⁸ operations. For ML-KEM-768, this means β ≥ 600+, which is far beyond feasibility.

Chapter 40 — Lattice Problems and LWE

The LLL algorithm is the foundational lattice reduction algorithm. It runs in polynomial time and produces a basis where the shortest vector is within a factor of 2^((n-1)/2) of the true shortest vector. While this is sufficient for many applications (e.g., breaking knapsack cryptosystems), it is too weak for attacking modern lattice-based cryptographic parameters. BKZ (Block Korkine-Zolotarev) is the stronger algorithm used in practice: it applies an exact SVP solver to blocks of size beta within the lattice. Increasing beta gives better approximation but at exponentially increasing cost. The key attacks against lattice-based schemes are BKZ combined with lattice sieving algorithms. ML-KEM parameters are chosen so that the BKZ block size required for a successful attack would cost at least 2^128 operations.

ML-KEM (Kyber): NIST FIPS 203 Ch 40

ML-KEM (Module Learning With Errors Key Encapsulation Mechanism) is the primary NIST post-quantum key exchange standard.

Module-LWE. Generalises LWE to work over polynomial rings R_q = Z_q[X]/(Xⁿ+1), with module rank k:

Public key: (A, t = As + e) over R_q^k×k
Secret: s ∈ R_q^k with small coefficients
Error: e ∈ R_q^k with small coefficients

NTT (Number Theoretic Transform): Enables O(n log n) polynomial multiplication in R_q, making ML-KEM highly efficient.

Key encapsulation steps:

KeyGen: Sample (s, e), compute t = As + e, output pk=(A,t), sk=s
Encaps: Sample (r, e', e''), compute u = A^Tr + e', v = t^Tr + e'' + ⌈q/2⌋ · m. Output ciphertext (u,v) and shared key K.
Decaps: Compute v - s^Tu ≈ ⌈q/2⌋ · m. Recover m via rounding. Derive K.

Correctness. v - s^Tu = ⌈q/2⌋·m + (small noise). Rounding recovers m when the noise is sufficiently small. Decryption failure probability < 2^-140 for ML-KEM-768.

Chapter 40 — Lattice Problems and LWE

ML-KEM, previously known as CRYSTALS-Kyber, is the NIST-standardized post-quantum Key Encapsulation Mechanism (FIPS 203). It is based on Module-LWE, which works over polynomial rings rather than plain integers. This ring structure enables the use of NTT (Number Theoretic Transform) for fast polynomial multiplication, achieving O(n log n) complexity instead of O(n^2). The key encapsulation process involves: key generation (sampling small secrets and errors), encapsulation (encrypting a random message using the public key with fresh randomness), and decapsulation (recovering the message using the secret key). The correctness relies on the noise terms being small enough that rounding recovers the original message. ML-KEM-768 is the recommended parameter set, providing approximately 128-bit post-quantum security.

Key Size Comparison: Post-Quantum vs Classical Ch 40

Scheme	Security	Public Key	Ciphertext / Sig
RSA-3072	128-bit (classical)	384 B	384 B
ECC P-256	128-bit (classical)	32 B	64 B
ML-KEM-768	128-bit (PQ)	1,184 B	1,088 B
ML-KEM-1024	192-bit (PQ)	1,568 B	1,568 B
ML-DSA-65	128-bit (PQ)	1,952 B	3,309 B
Classic McEliece	128-bit (PQ)	261 KB	128 B

Trade-off. Post-quantum public keys and ciphertexts are significantly larger than ECC equivalents. ML-KEM-768 keys are ~37× larger than ECC P-256 keys. Classic McEliece keys are ~8,000× larger!

Performance is competitive. ML-KEM is actually faster than RSA and comparable to ECC in encapsulation/decapsulation time. The NTT-based arithmetic is highly efficient on modern processors. The main cost is bandwidth, not computation.

Hybrid mode (recommended): Combine ML-KEM with ECDH during the transition period. If either is broken, the other still protects the session key.

Chapter 40 — Lattice Problems and LWE

Attacking Lattice Schemes: BKZ Reduction Ch 40

Best known attacks reduce LWE to approximate SVP via BKZ lattice reduction.

BKZ-β attack pipeline:

Construct a lattice from the LWE instance
Run BKZ with block size β
Reduced basis reveals the short secret/error vector

SVP subroutines:

Enumeration: 2^O(n²) time, polynomial space
Sieving: 2^O(n) time and 2^O(n) space
Best sieve: 2^0.292n classical, 2^0.265n quantum

No quantum speedup for lattice problems. Unlike factoring, no efficient quantum algorithm is known for SVP or LWE. Grover gives at most a quadratic speedup for sieving, already accounted for in parameter choices.

Chapter 40 — Lattice Problems and LWE

ML-KEM Security Estimates Ch 40

ML-KEM parameter security (NIST FIPS 203):

Parameter Set	n, k, q	Security (NIST level)
ML-KEM-512	256, 2, 3329	Level 1 (~128-bit)
ML-KEM-768	256, 3, 3329	Level 3 (~192-bit)
ML-KEM-1024	256, 4, 3329	Level 5 (~256-bit)

Parameters are chosen conservatively: ML-KEM-768 requires BKZ block sizes costing far more than 2¹²⁸ operations. Security margins account for potential algorithmic improvements in lattice sieving.

Chapter 40 — Lattice Problems and LWE

Part XV

Code-Based Crypto & Frontiers

Chapters 43–45

McEliece (1978): The Oldest Unbroken Public-Key Scheme Ch 43

Robert McEliece proposed his cryptosystem in 1978, just one year after RSA. It remains unbroken after 47 years.

Key idea. Disguise a decodable error-correcting code (Goppa code) as a random-looking linear code.

Private key: Goppa code with efficient decoding (Patterson's algorithm)
Public key: G' = SGP, where S is scrambling, P is permutation
Encrypt: c = mG' + e (add t random errors)
Decrypt: Use the private Goppa decoder to correct e and recover m

Security basis. Decoding a random linear code is NP-hard (Berlekamp, McEliece, van Tilborg 1978). The public key G' is indistinguishable from a random generator matrix.

Achilles' heel: key size. Classic McEliece at 128-bit PQ security requires a 261 KB public key. This has limited its practical adoption despite its excellent security track record.

NIST status: Classic McEliece advanced to Round 4 of the NIST PQC competition. Selected for future standardisation alongside the lattice-based primary standards.

Chapter 43 — Code-Based Cryptography

McEliece's 1978 cryptosystem is based on binary Goppa codes. The idea is elegant: take a code family with efficient algebraic decoding (Goppa codes via Patterson's algorithm), then disguise it by applying a random scrambling matrix S and permutation P to the generator matrix. The resulting public key looks like a random linear code, for which decoding is NP-hard. To encrypt, the sender encodes a message and adds random errors; to decrypt, the receiver uses the private Goppa structure to correct the errors. McEliece has resisted all known attacks for over 45 years, including quantum attacks — Shor's algorithm does not apply because the problem lacks hidden subgroup structure. The main drawback is the enormous public key size (hundreds of kilobytes), which has limited adoption. Classic McEliece is being standardized by NIST as a diversification candidate alongside the lattice-based primary standards.

Error-Correcting Codes and Syndrome Decoding Ch 43

Goppa codes are a family of algebraic error-correcting codes defined over finite fields.

Binary Goppa code Γ(L, g):
Given a set L = {α₁, ..., α_n} ⊂ F_2^m and a polynomial g(x) of degree t over F_2^m, the code consists of all vectors c ∈ F₂ⁿ such that:

Σ_i c_i / (x - α_i) ≡ 0 mod g(x)

Parameters: length n, dimension ≥ n - mt, minimum distance ≥ 2t+1.

Syndrome decoding (NP-hard).
Given a parity-check matrix H and syndrome s = Hc^T, find a word e of minimum weight such that He^T = s.

This is the computational problem underlying McEliece security.

Best known attacks:

Information Set Decoding (ISD): 2^O(n) — Lee-Brickell, Stern, BJMM algorithms
Quantum ISD: Grover-assisted variants give ~√ speedup, but problem remains hard
No known polynomial-time quantum algorithm for syndrome decoding

Chapter 43 — Code-Based Cryptography

Goppa codes are defined using algebraic geometry over finite fields. For a given support set L and irreducible polynomial g(x) of degree t, the code can correct up to t errors. Patterson's algorithm provides efficient decoding for Goppa codes, but this requires knowledge of the code structure. Without the algebraic structure, the decoding problem reduces to syndrome decoding, which Berlekamp, McEliece, and van Tilborg proved is NP-hard in 1978. The best known classical attacks use Information Set Decoding (ISD) techniques — algorithms by Lee-Brickell, Stern, and BJMM that run in exponential time. Quantum variants of ISD (using Grover's algorithm) provide at most a square-root speedup, keeping the problem firmly in the exponential regime. This makes code-based cryptography one of the most conservative post-quantum candidates.

NIST Post-Quantum Standards (2024) Ch 44

Standard	Type	Hard Problem	Family	Published
ML-KEM (FIPS 203)	Key Encapsulation	Module-LWE	Lattice	Aug 2024
ML-DSA (FIPS 204)	Digital Signature	Module-LWE + SIS	Lattice	Aug 2024
SLH-DSA (FIPS 205)	Digital Signature	Hash function security	Hash-based	Aug 2024
FN-DSA (draft)	Digital Signature	NTRU lattice	Lattice	Forthcoming
Classic McEliece	KEM	Syndrome decoding	Code-based	Round 4

Diversity by design. NIST deliberately selected algorithms from multiple families (lattice, hash-based, code-based) to hedge against a breakthrough attack on any single hard problem.

Lesson from SIKE. The isogeny-based candidate SIKE was broken in 2022 by Castryck and Decru using unexpected mathematical insights. This demonstrates that even well-studied schemes can fall — diversification is essential.

Chapter 44 — NIST Post-Quantum Standards

NIST published its first three post-quantum standards in August 2024. ML-KEM (formerly CRYSTALS-Kyber) is the primary key encapsulation mechanism, based on Module-LWE. ML-DSA (formerly CRYSTALS-Dilithium) is the primary digital signature scheme, also lattice-based. SLH-DSA (formerly SPHINCS+) is a hash-based signature scheme that provides diversification — its security relies only on the security of the underlying hash function, not on any lattice or number-theoretic assumption. FN-DSA (formerly FALCON) is expected to be standardized later; it is an NTRU-lattice-based signature scheme with compact signatures. Classic McEliece remains in Round 4 for future standardization. The break of SIKE in 2022 was a stark reminder that diversification is crucial: a single unexpected mathematical insight destroyed an entire family of schemes.

NIST Post-Quantum Standards 2024

Chapter 44 — NIST PQC Standards

PQC Parameter Comparison Ch 44

Algorithm	NIST Level	Public Key	Secret Key	CT / Sig	KeyGen	Encaps / Sign	Decaps / Verify
Key Encapsulation Mechanisms
ML-KEM-512	1	800 B	1,632 B	768 B	Fast	Fast	Fast
ML-KEM-768	3	1,184 B	2,400 B	1,088 B	Fast	Fast	Fast
ML-KEM-1024	5	1,568 B	3,168 B	1,568 B	Fast	Fast	Fast
Classic McEliece	1–5	261 KB–1.3 MB	–	128–240 B	Slow	Fast	Fast
Digital Signatures
ML-DSA-44	2	1,312 B	2,560 B	2,420 B	Fast	Fast	Fast
ML-DSA-65	3	1,952 B	4,032 B	3,309 B	Fast	Fast	Fast
ML-DSA-87	5	2,592 B	4,896 B	4,627 B	Fast	Fast	Fast
SLH-DSA-128s	1	32 B	64 B	7,856 B	Slow	Slow	Fast
SLH-DSA-128f	1	32 B	64 B	17,088 B	Moderate	Moderate	Fast

Key observation: ML-KEM and ML-DSA offer an excellent balance of security, key size, and performance. SLH-DSA has the smallest keys but the largest signatures. Classic McEliece has enormous keys but the smallest ciphertexts.

Chapter 44 — NIST Post-Quantum Standards

Migration to PQC: Phases 1–2 Ch 44

Phase 1 — Inventory (Now)

Catalogue all cryptographic dependencies
Identify quantum-vulnerable algorithms (RSA, ECC, DH)
Assess data secrecy lifetimes

Phase 2 — Hybrid Deployment (2024–2028)

Deploy PQC + classical in parallel (hybrid mode)
TLS 1.3 with ML-KEM + ECDH
If either is broken, the other still protects

Mosca's inequality: If data_lifetime + migration_time > quantum_arrival, you are already too late to begin.

Chapter 44 — NIST Post-Quantum Standards

Migration to PQC: Phases 3–4 Ch 44

Phase 3 — Full PQC (2028–2035)

Remove classical components once PQC is battle-tested
Update certificates, protocols, hardware tokens
Re-encrypt stored data with PQC

Phase 4 — Crypto-Agility (Ongoing)

Design systems to swap algorithms without redesign
Prepare for potential breaks in PQC schemes
Monitor advances in quantum computing and cryptanalysis

The SIKE lesson (2022): Castryck and Decru broke SIKE using unexpected connections to isogeny theory. Even mature, well-studied schemes can fall overnight. Crypto-agility is not optional.

Chapter 44 — NIST Post-Quantum Standards

Course Synthesis: The Eternal Dialectic Ch 45

From Al-Kindi (850 AD) to post-quantum (2024), a single pattern recurs:

Cipher	Attack	Stronger Cipher
Monoalphabetic substitution	Frequency analysis (Al-Kindi, 850)	Polyalphabetic ciphers (Alberti, 1467)
Vigenère cipher	Kasiski / IC analysis (1863)	Rotor machines (Enigma, 1918)
Enigma	Bomba / Banburismus (Rejewski, Turing)	One-time pad (Shannon, 1949)
DES	Differential & linear cryptanalysis	AES (Rijndael, 2001)
RSA / DH / ECC	Shor's algorithm (1994)	Lattice / code-based PQC (2024)

Key insight. Every successful attack has made cryptography stronger, not weaker. Differential cryptanalysis did not destroy block ciphers — it led to AES with provable resistance. Shor's algorithm has not destroyed public-key cryptography — it has catalysed post-quantum schemes built on even harder mathematical problems.

Chapter 45 — Synthesis

Four Grand Themes of Cryptanalysis Ch 45

Theme	Era	Central Idea	Key Technique
Frequency Analysis	850–1900	Natural language is not uniform	Letter/digram counts, IC
Algebraic Structure	1930–2000	Ciphers are mathematical objects	Group theory, S-box analysis
Computational Hardness	1976–present	Security rests on intractable problems	Factoring, DLP, lattice problems
Quantum Threats	1994–present	Quantum computers break hardness assumptions	Shor, Grover, post-quantum design

Convergence. Modern cryptanalysis demands proficiency in all four themes simultaneously. A post-quantum implementer must understand statistical testing, algebraic structure, computational hardness reductions, and quantum algorithms.

The human element persists. Despite all mathematical advances, implementation errors (Heartbleed, BEAST, CRIME) and social engineering remain the dominant real-world attack vectors. Theory and practice must advance together.

Chapter 45 — Synthesis

The four grand themes of cryptanalysis span over a millennium. Frequency analysis dominated the classical era, from Al-Kindi through the 19th century. Algebraic structure thinking emerged with Rejewski's group-theoretic analysis of Enigma and matured with differential and linear cryptanalysis of block ciphers. Computational hardness became central with public-key cryptography in 1976, when security was explicitly linked to the presumed intractability of mathematical problems. The quantum era, beginning with Shor's algorithm in 1994, has forced a re-evaluation of which problems are truly hard. Modern cryptanalysis requires mastery of all four themes. The human element — implementation errors, social engineering, key mismanagement — remains the weakest link in most deployed systems.

The Security Landscape: Classical vs Quantum Ch 45

Problem	Classical	Quantum	Status
Integer Factoring	Sub-exponential	Polynomial (Shor)	Broken
Discrete Log (Z_p*)	Sub-exponential	Polynomial (Shor)	Broken
Elliptic Curve DL	Exponential	Polynomial (Shor)	Broken
Lattice SVP	Exponential	Exponential	Resistant
Syndrome Decoding	Exponential	Exponential	Resistant
Hash Preimage	Exponential	√ speedup (Grover)	Resistant

The cliff vs the slope. Public-key schemes face a cliff-edge collapse when quantum computers arrive — their security goes from high to zero. Symmetric ciphers face a gradual slope — their security is halved, but doubling the key length restores it.

Cryptographic family health:

Lattice-based: Strong security + good performance. Primary NIST standard.
Code-based: Long track record. Large keys.
Hash-based: Minimal assumptions. Signature-only, large sigs.
Symmetric: Use AES-256. Problem solved.

Chapter 45 — Synthesis

This slide summarizes the security landscape across the quantum divide. The key distinction is between problems that Shor's algorithm solves efficiently (factoring, discrete logarithms) and problems that remain hard even for quantum computers (lattice SVP, syndrome decoding, hash preimage). For the first group, security collapses entirely. For the second, the best quantum algorithms provide at most a polynomial speedup, which can be compensated by increasing parameters. The three main post-quantum families each have different strengths: lattice-based schemes offer the best balance of security and performance; code-based schemes have the longest track record but large keys; hash-based schemes rely on minimal assumptions but produce large signatures. For symmetric cryptography, the solution is simply to use AES-256.

Open Problems: Foundations & Quantum Ch 45

Foundational questions:

P vs NP: If P = NP, no computationally-secure cryptography is possible (except OTP). All modern crypto assumes P ≠ NP.
One-way functions: Do they exist? Equivalent to P ≠ NP for many purposes.
Tighter LWE reductions: Stronger worst-to-average-case connections?

Quantum algorithm frontier:

Does a quantum speedup exist for lattice SVP beyond Grover?
Can quantum algorithms break LWE directly (not via SVP)?
Quantum random oracle model: formal security in the quantum setting

Chapter 45 — Synthesis

Practical Frontiers Ch 45

Side-channel resistance: Formal verification of constant-time implementations
Crypto-agility: Protocol designs that swap algorithms without redesign
AI-assisted cryptanalysis: Machine learning for cipher analysis, protocol verification
Fully homomorphic encryption: Practical FHE from LWE (bootstrapping efficiency)

The SIKE lesson (2022).
Castryck and Decru's break used unexpected connections to isogeny theory. Even mature, well-studied schemes can fall. The field must remain perpetually humble and vigilant.

Chapter 45 — Synthesis

Lessons for the Practitioner (1–3) Ch 45

1. Never rely on obscurity.
Every proprietary cipher that has been analysed has been broken. Kerckhoffs' principle (1883): the system must be secure even if everything except the key is public.

2. Understand your threat model.
Classical, quantum, and side-channel attackers require different defences. A scheme secure against classical adversaries may be completely broken by a quantum computer.

3. Crypto-agility is essential.
Systems must be designed so that algorithms can be swapped without rebuilding the architecture. The SIKE break showed that even "well-studied" schemes can fall overnight.

Chapter 45 — Synthesis

Lessons for the Practitioner (4–6) Ch 45

4. Implementation matters as much as theory.
Heartbleed, BEAST, CRIME, and ROCA were all attacks on implementations, not on the underlying mathematics. Constant-time code, formal verification, and careful engineering are essential.

5. Diversity is a defence.
Relying on a single hardness assumption is fragile. NIST's portfolio approach — lattice, hash-based, code-based — provides resilience against a breakthrough in any one family.

6. Start migrating now.
Apply Mosca's inequality. For long-lived data, the transition to PQC should already be underway. Hybrid deployment (PQC + classical) is the recommended first step.

Chapter 45 — Synthesis

Course Map: All 15 Parts Ch 45

Part	Title	Key Technique	Era
I	Foundations	Frequency analysis	850–1900
II	Classical Polyalphabetic	Kasiski / IC methods	1400–1920
III	Polygraphic Ciphers	Hill cipher, matrix attacks	1929–1940
IV	Enigma	Group-theoretic cycle analysis	1918–1945
V	Information Theory	Entropy, perfect secrecy, unicity distance	1949–1970
VI	Linear Cryptanalysis	Linear approximations of S-boxes	1993–2001
VII	Differential Cryptanalysis	Input difference propagation	1990–2001
VIII	AES	Wide trail strategy, MixColumns	1998–2001
IX	RSA	Factoring (NFS, ECM, Wiener)	1977–2020
X	Diffie-Hellman	Index calculus, Pohlig-Hellman	1976–2020
XI	Elliptic Curves	MOV, Smart's attack, pairings	1985–2020
XII	Algebraic Cryptanalysis	Gröbner bases, SAT solvers	2000–2020
XIII	Quantum Threat	Shor & Grover algorithms	1994–2024
XIV	Lattice Cryptography	LWE, LLL/BKZ reduction	1996–2024
XV	Code-Based & Frontiers	Syndrome decoding, PQC migration	2017–2024

Chapter 45 — Synthesis

Course Summary

The Art and Science of
Codebreaking Continues

Cryptanalysis is not merely the art of breaking ciphers. It is a discipline that compels us to think rigorously about what it means for a system to be secure — to distinguish genuine confidence from false assurance, and to remain perpetually humble before the ingenuity of future adversaries.

The journey from Al-Kindi to post-quantum cryptography is, at its deepest level, a journey in the philosophy of knowledge — what can be known, what can be hidden, and what remains forever uncertain.

Bartosz Naskręcki • UAM Kryptografia kwantowa i postkwantowa • Reference (Ch 37–45)

Quantum, Lattices, Codes & NIST Standards

Reference slides for Weeks 2–5 and Week 8

How to read this deck in our course

The Quantum Threat

Quantum Computing Basics Ch 37

Quantum Gates and Circuits Ch 37

Shor's Algorithm: Factoring in Polynomial Time Ch 38

Shor's Impact: What Breaks? Ch 38

Grover's Algorithm: O(√N) Search Ch 39

Grover’s Algorithm: Quantum Circuit Visual

Grover's Effect on Symmetric Cryptography Ch 39

Timeline: When Will Quantum Computers Break Crypto? Ch 38–39

Discussion Reflection

Should we migrate to post-quantum cryptography today?

Lattice-Based Cryptography

Lattice Fundamentals Ch 40

Hard Lattice Problems Ch 40

Lattice: Shortest Vector Problem Visual

The LLL Algorithm: Lattice Reduction Ch 40

ML-KEM (Kyber): NIST FIPS 203 Ch 40

Key Size Comparison: Post-Quantum vs Classical Ch 40

Attacking Lattice Schemes: BKZ Reduction Ch 40

ML-KEM Security Estimates Ch 40

Code-Based Crypto & Frontiers

McEliece (1978): The Oldest Unbroken Public-Key Scheme Ch 43

Error-Correcting Codes and Syndrome Decoding Ch 43

NIST Post-Quantum Standards (2024) Ch 44

NIST Post-Quantum Standards 2024

PQC Parameter Comparison Ch 44

Migration to PQC: Phases 1–2 Ch 44

Migration to PQC: Phases 3–4 Ch 44

Course Synthesis: The Eternal Dialectic Ch 45

Four Grand Themes of Cryptanalysis Ch 45

The Security Landscape: Classical vs Quantum Ch 45

Open Problems: Foundations & Quantum Ch 45

Practical Frontiers Ch 45

Lessons for the Practitioner (1–3) Ch 45

Lessons for the Practitioner (4–6) Ch 45

Course Map: All 15 Parts Ch 45

The Art and Science ofCodebreaking Continues

The Art and Science of
Codebreaking Continues