No. 03 · The observatory
What the release means for your security roadmap
Nothing in the release weakens the cryptography you run today. Keep your post-quantum migration on FIPS 203/204/205.
- Status
- Open
- Families that weaken deployed crypto
- 0
- Security-adjacent families read closely
- 6
- Relabelled after deep reads
- 5 of 6
- Standards to migrate to
- FIPS 203, 204 and 205
Does anything in the release weaken our cryptography?
No result here forces a change to your crypto plan. Keep the post-quantum migration and inventory on track.
No. Nothing in the 372 families weakens cryptography you run today.
We read every family title and description for attack-relevant maths. We looked for factoring, discrete logarithms, lattices, elliptic curves, hashes and ciphers. No result speeds up attacks on RSA, elliptic-curve, lattice, hash or symmetric schemes.
Cryptography stays safe while certain maths problems stay hard. A new result can do one of three things to that safety.
- Break: a faster attack that forces action.
- Confirm: a proof that a design is as strong as assumed.
- Refine: cleaner theory of something already known.
Every security-adjacent family here confirms or refines. None breaks.
These areas came closest. None moves deployed crypto.
- Elliptic curves (002, 006): curve security rests on discrete logs, not on curve ranks.
- Prime statistics (011, 012, 024, 029): they describe known heuristics. They give no attack algorithm.
- Subset Sum (138): its 2^0.49n worst case trails known attacks at 2^0.291n. Cryptographers retired knapsack schemes long ago.
- Fast arithmetic (107, 109, 130): the gains are galactic. Cryptanalysis cost does not move.
- Hardness results (102, 105): proofs that problems are hard add confidence, if anything.
- Quantum complexity (274, 283, 284): limits on quantum computation, or oracle models. No new attack.
No family touches lattice problems, finite-field discrete logs, hash functions or block ciphers. OpenAI announced a Closest Vector Problem hardness result in August 2026. That result sits outside the 372 families.
What do the six security-adjacent families actually prove?
Treat these as background reading for your security team. None of them needs a budget line.
Six families sit near security. Our deep reads moved five of them to a weaker label.
A close read moved 11 of 25 families to no pathway
Label changes after deep reads of 25 pathway families. 18 families changed.
- Before
- After
How to readEach row shows a family's label before and after the close read.
NoteMost moves made labels stricter, never looser.
SourceOur deep reads, research/deep in the atlas repo
| Family | What it proves | Business effect |
|---|---|---|
| 238 Thorp shuffle | A simple shuffle mixes a deck of 2^d cards in about d rounds. | Theory for one small-domain cipher style. No standard uses it. |
| 003 Quasi-Riemann hypothesis | No zeta or Dirichlet L-function zeros lie right of real part 7/8. | None for security. |
| 279 Exact quantum factoring | A quantum circuit family factors every integer with probability exactly one. | None. The paper disclaims practical resource gains. |
| 272 Entanglement without secret key | An entangled state exists from which no secret key can be distilled. | None for deployed quantum key distribution. |
| 277 Threshold repetition | Repeating a quantum game makes beating the expected win rate exponentially unlikely. | Theory for lab-stage device-independent quantum cryptography. |
| 245 Pure type systems | If some evaluation finishes, every evaluation finishes. | None. The Lean and Rocq kernels are richer systems. |
The quasi-Riemann result is a landmark for number theory if it holds. A machine has checked its core statement. People assume it helps primality testing. Agrawal, Kayal and Saxena settled that question unconditionally in 2002.
Shor's 1994 algorithm already factors in polynomial time with bounded error. In practice, you rerun it and check the answer. Exact success is a modelling point. It does not lower the cost.
Resource estimates set the real threat timeline. In 2025, Gidney put RSA-2048 within a week for under a million noisy qubits. That assumes a 0.1% gate error rate. It already drives post-quantum migration.
Commercial quantum key distribution products do not distil key from exotic entangled states. Device-independent schemes, which 277 supports, run only in labs so far. The NSA does not recommend quantum key distribution for national security systems.
Is the Thorp shuffle result a reason to change tokenisation?
No. Track the final SP 800-38G revision, retire FF3-1, and ignore Thorp-based designs for now.
Family 238 is the only card with a real security story.
Format-preserving encryption turns a 16-digit card number into another 16-digit number. That keeps legacy systems working. Deployed schemes use NIST's FF1, a Feistel design. In 2009, Morris, Rogaway and Stegers proposed building such ciphers from the Thorp shuffle.
This result settles the shuffle's mixing speed in theory. Four things hold it back in practice.
- The constant. The proof uses 1600d rounds. For card numbers, that means roughly 86,000 rounds against FF1's 10. That figure is our illustration, not the paper's.
- No concrete error bound. The main theorem holds only as d grows without limit. A security proof needs a number at d = 54.
- Other designs already solve it. Mix-and-Cut and Sometimes-Recurse already resist an attacker who queries every input.
- No standard uses Thorp. SP 800-38G Revision 1 is still a second public draft, dated February 2025. It drops FF3 and keeps only FF1.
So the live tokenisation item is NIST's revision, which drops FF3. That item has nothing to do with this release.
What should each team do now?
Keep the roadmap that standards bodies already set. Invest in crypto agility as a hedge.
Your roadmap stays the one standards bodies already set.
NIST finalised FIPS 203, 204 and 205 in August 2024. They cover post-quantum key exchange and signatures. NIST's draft IR 8547 proposes deprecating quantum-vulnerable RSA and ECC after 2030. It would disallow them after 2035.
- 2024FIPS 203, 204 and 205 finalised
- 2030Draft deprecation of RSA and ECC
- 2035Draft disallowance of RSA and ECC
- CISOs: no change to crypto plans. Keep the post-quantum migration and crypto-inventory plan.
- Payments and tokenisation teams: track the final SP 800-38G revision and retire FF3-1.
- Quantum-security startups: cite 277 for device-independent protocols. It is no product milestone.
- Formal-verification vendors: treat 245 as reassuring background. No kernel changes.
One release-level point still matters. AI systems now produce research-grade maths quickly. Cryptanalysis is maths too, so crypto agility is worth more than before. That is our inference; the release does not show it.
Assurance is where AI changes security work: formal checks already exist for cryptography. The weak point moves from the proof to the spec. A Lean build of OpenAI’s Navier-Stokes work compiles yet may prove a different statement.