{"slug": "ai-lattice-proofs-with-chris-peikert", "title": "AI Lattice Proofs with Chris Peikert", "summary": "In a podcast episode, cryptographer Chris Peikert discussed recent advances in lattice-based cryptography, including a new proof by OpenAI's model for approximating the closest vector problem (CVP) within a factor of n^(1/2-ε), a potential quantum attack on the dihedral coset problem that was later retracted, and a distinguisher attack against Classic McEliece. Peikert noted the CVP result was surprising and held up, while the DCP attack was busted.", "body_md": "The robots are at it again, and this time they’re solving, and breaking(?), math and cryptography! Things have been happening in the lattice corner including new leapfrogging complexity results in the closest vector problem (CVP), AND a possible poly-time quantum attack against the dihedral coset problem (DCP) that made everyone freak out for about a week (UPDATE: looks like it’s busted: https://eprint.iacr.org/2026/1693). ALSO, there was an important distinguisher attack against Classic McEliece, which on its face doesn’t sound like a big deal, unless you’re familiar with the track record of efficient distinguishers in the history of code-based cryptography… 😱\n\nTo help us make sense of all this we are joined again by OG friend of the pod Chris Peikert! We had trouble with his audio but tried our best to fix it, apologies.\n\n**Links:**\n\n- https://openai.com/index/ten-advances-in-mathematics/\n- https://cdn.openai.com/pdf/ten-proofs-oai.pdf\n- https://x.com/ChrisPeikert/status/2083534770403750025\n- https://bsky.app/profile/chrispeikert.bsky.social/post/3msp3boueis2z\n- https://en.wikipedia.org/wiki/Boolean_satisfiability_problem\n- https://knowyourmeme.com/memes/wordcel-shape-rotator-mathcel\n- Chen 2024: https://eprint.iacr.org/2024/555\n- https://eprint.iacr.org/2026/1630\n- https://eprint.iacr.org/2026/1693\n- CVP within n^(1/2-ɛ) - : https://eprint.iacr.org/2026/1655\n\n*\nThis rough transcript has not been edited and may have errors.\n*\n\n**Deirdre:** Hello, welcome to *Security Cryptography Whatever*. I’m Deirdre.\n\n**David:** I’m David.\n\n**Thomas:** I’m Thomas and I’m going to be lucky if I have one good minute in\nthis podcast.\n\n**Deirdre:** That’s Thomas. We have a returning special guest today,\nProfessor Chris Peikert. How are you, Chris?\n\n**Chris:** I am great. Great to be with you again tonight.\n\n**Deirdre:** Yeah, I think you were with us in our first year, and now we’re\nvery happy to have you come back. And now we have you on camera for the first\ntime. There’s been a lot of news in lattices. And so we had to reach out to,\nI think it’s fair to say, our fattest favorite lattice cryptographer to ask\nhim questions, especially about new proofs about closest vector problem, new\nproofs about shortest vector problem, something called dihedral coset problem\nand how it affects lattices. And also Classic McEliece, because why not? So\nto intro, OpenAI unleashed their, I think it’s still closed model. And I\nforget the name of it, Astra.\n\n**David:** Astral.\n\n**Deirdre:** They all have a cute, whimsical, powerful name or whatever. And\nthey targeted it at a bunch of just pure math problems, it appeared to\nbe. And they put out this paper that was like, OpenAI’s 10 math proofs. and\none of the 10 was like a new result for hardness of the closest vector\nproblem. And when I saw this, I was like, “Oh, that’s interesting, and maybe\nI will actually go look at the proof.” But I think you read it first, and\nyou’re like, “Actually, this is kind of nice.” Can you tell us your take?\n\n**Chris:** Yeah, so I think the first character of my skeet tweet thread on\nthis was the exploding head emoji, like, wow. And it’s held up. Like, the\nresult itself is this new proof. So it’s about the closest vector problem on\nlattices and actually approximating the closest vector problem on lattices,\nright? So the closest vector problem is I give you a lattice and I give you a\ntarget point somewhere out in space. And the goal is follow a lattice point\nthat’s as close as possible to that target point. And that’s the exact, like\nyou have to follow exactly the closest lattice vector to the target. And then\nthere’s this approximate version which says, oh, you don’t have to give me\nexactly the closest. You can give me a point which is within some factor of\nthe closest. Okay. So that’s like the approximation factor. And for a long\ntime, we’ve known that the closest vector problem is NP-hard in that exact\nversion.\n\n**Chris:** Like that goes back to the 80s. That’s classic stuff. And then in\nthe 90s, people showed that increasing the approximation factor, which can\nmake the problem easier, right? Like you have more possible answers. It’s an\neasier problem. But even then, if you increase the approximation factor to\nlike any constant, 100, a billion, a Google, whatever, it’s still NP-hard,\nright, to even get approximately close to the factor. And then even if you go\nto factors like n to the 1 over log log n, right, so not quite a\npolynomial. n is the dimension here, by the way, dimension. So not quite\npolynomial, but merely i-ish, polynomial, close-ish is still NP-hard. Okay,\nso that was like the last word that we had on the NP hardness. And it was\nfrom around 1998. I think maybe there’s a follow up journal version\nin 2003. So more than 20 years. And then this hadn’t budged, like nobody had\nimproved upon that. And that result used like this heavy PCP machinery,\nprobabilistically checkable proofs and all this stuff. Technical, doesn’t\nmatter. And then OpenAI shows up on August 1st and is like, hey, we show that\nactually polynomial approximation, CVP, is NP-hard. And their polynomial is n\nto the 1 over 400.\n\n**Deirdre:** I was wondering what that term really was.\n\n**Chris:** And so, yeah.\n\n**Deirdre:** That’s good.\n\n**Chris:** And so that’s a fixed polynomial, right? N to the 1\nover 400. That’s the first term in the title of the paper. CVP is NPR. But\nwhat’s exciting is that it’s some fixed polynomials end to a constant. And\nthen I quickly noticed not making any intelligent observation whatsoever, but\nit’s like, why end of the one over 400? Like, is there something intrinsic\nthere? Is there something important? And so you run to your model, you run to\nyour favorite cloud or your chat or whoever. You say, can you improve this?\nAnd it says, oh, yeah, actually, I can get you like end of the one over 28\nwithout doing anything but like improving the bookkeeping here. Like I didn’t\nchange anything about the proof. I just used better numbers. Right. So I\nfound it really interesting that like Astra didn’t try to even.\n\n**Deirdre:** Well, we’re not even really sure how they queried it or what\nthey asked it, but it does.\n\n**Chris:** This polynomial. Yeah.\n\n**Deirdre:** Seem that you can come up with a impressive attacks with very\nsimple queries with not a lot of detail about what you’re asking the model to\ndo. So driving down that factor from one or driving.\n\n**Chris:** Exactly.\n\n**Deirdre:** Up that factor from one of one over 400 to one over 128 or\nwhatever. So how so that is bringing the closer and closer to the actual\nclosest vector problem as opposed to like this approximation. bound, right?\n\n**Chris:** No well it’s making it’s taking you farther away from the exact\nversion.\n\n**Deirdre:** The other way around. Okay, yeah, yeah.\n\n**Chris:** Farther away yep yeah because like we know yeah.\n\n**Deirdre:** Cool. And that’s attractive because you can do more efficient\ncryptography if you have more space, kind of?\n\n**Chris:** Well, for the CVP, actually, crypto is not in this regime at\nall. So this is like purely a complexity, computational complexity\nresult. So, yeah, I just want to put that out there. But there is this one\nhalf or n to the one half barrier, like square root of n barrier that’s\nknown, where we know that the square root n approximate CVP is in the class\ncalled co-NP, the complement of NP problems.\n\n**Deirdre:** Yeah.\n\n**Chris:** And because of that, it’s highly unlikely. Okay, so this would\ncause some major collapse in the polynomial time hierarchy, dogs and cats\nliving together, like chaos everywhere, right? So we do not have any reason\nto make, we very much do not expect square root n to be NP hard. But now we\nhave like, oh, n to the 1 over 400 is, n to the one over 28 is, n to the one\nover eight is with like other people kind of pushing and prodding on the\nmodels to like improve this thing. And as of just a few days after that,\nsomebody who goes by the name of Mira on Twitter, I don’t even know who it\nis, poked the models long enough to get them to prove, oh yeah, I can get any\nn to the half minus any tiny constant. So like arbitrarily close to square\nroot n basically is still NP hard. So now we have this like total phase\nchange, you know, up to square root n, but not quite is NP at square root n\nand beyond. You have, you know, very good reason to think it’s not\nNP-hard. And so we went from like this huge unknown gap to like completely\nclosed gap in a matter of a few days with just miles poking on things. I\nmean, that’s insane.\n\n**David:** So I want to go back to that a little bit to make sure like I’m\nkind of understanding that like what changed. So, like, in general, even if\nit’s not, like, directly related to the things that we ultimately ended up\nmaking cryptography on, like, we like the idea of the problem remaining\ncomplexity theory hard for worse and worse approximations, as opposed to over\ntime to keep it hard, having to make the approximation slowly approach the\nreal problem. because if the approximation remains hard at arbitrarily large\nsized things, then we can feel better about how hard everything is overall.\n\n**Chris:** Yeah, you got it. I mean, it’s kind of a vibes thing. It’s not\nlike a formal result, but like, let’s take away CVP precisely. Let’s drop\nthat problem and just take a kind of other lattice problems like shortest\nvector problems and things. We can do cryptography from those problems with\napproximation factors that are like n or n to the 1.5 you know things like\nthat or n squared right so like very small polynomials approximation factors\ngive us crypto from certain lattice problems and now we’re saying oh well n\nto that nearly one half for cp at least is np hard so it it seems like not a\nbig jump from this np hard regime and we you know that should kind of gives\nus a little more confidence you know if you feel like I mean by contrast the—\n\n**Deirdre:** Yeah.\n\n**Chris:** Best algorithms we have to attack these problems in like\nefficiently in polynomial time they only get like exponentially bad\napproximation factors like nearly two to the n so you got to go all the way\nout to like these huge factors in order to solve these problems efficiently\nand so this kind of gives us a belief that okay these small polynomial factor\nproblems are probably hard like that that that’s a good good warm and fuzzy\nfeeling yeah.\n\n**David:** Yeah, because like, previously, like, 1 over log log n, like, at\nextremely large n is basically just like, n to the 0, right, n.\n\n**Chris:** Yeah kind of yeah.\n\n**David:** But to get out there with one over the end of 400, you need to be\nable to end of the E to the E to the 400.\n\n**Chris:** Yeah right right if something like that yeah yeah.\n\n**David:** Or something like that for it to cross over. So it’s like, all\nthese numbers are fake.\n\n**Chris:** Yeah. Yeah. And I think, I think the other thing that’s cool about\nthis, I don’t think anybody expected it or would have bet on it. Like if you\nhad asked me last Friday is small, you know, tiny polynomial approximate or\nhard NP hard, like probably not. I don’t, I don’t think that’s, that’s going\nto be even true, much less do I expect it. And then, so it just completely\nchanged our understanding of these problems.\n\n**Deirdre:** One other thing that you mentioned when you were skeeting,\nposting about this on Blue Sky, was that the proof is actually quite elegant\nand uses novel techniques, which is like wonderful to see because even humans\nsometimes have a hard time giving a grokkable, nice proof of some either, you\nknow, something that they’re trying to establish or that, you know, a lemma\nis correct or something like that. Can you explain that a little bit?\n\n**Chris:** A couple of things about this. So the, you know, the prior best\nresult that goes back to the late 90s, using this like really heavy\nmachinery, this PCP machinery, and all this like self-composition, really\ncomplicated. It’s pretty hard to follow. It’s a great result, but it’s like\npretty quiet run. Why can’t be there. And then this result, it just like\nshoots straight at the target. I mean, it gives this direct reduction. I know\nyou all remember from undergrad, like to prove a problem and be hard, you\ngive a reduction from 3SAT to your problem.\n\n**Deirdre:** Yeah yeah sure we all remember from undergrad.\n\n**Chris:** So you guys do these in your sleep still. So that’s what this\ndid. It just went straight from 3SAT to a CVP problem, this approximate CVP\nproblem. And it did so with really just elegant, beautiful, algebraic\nencoding of the 3SAT formula. You have to take a 3SAT formula and translate\nit to a CVP, a lattice and a target point, right? And satisfying certain\nproperties. And it just did it straight. It took like, oh yeah, we’re going\nto encode these whole formulas as a Reed Solomon code, a Reed Solomon code\nword. And we’re going to take each clause and encode it in a slightly\ndifferent way as a Reed Solomon code word and put constraints. And these\nconstraints give you a CVP instance. Actually, it gives you this, the side\neffect is it gives you this nearest code word problem instance, actually. So\nit goes by two steps. First, it goes to the nearest code word problem. And\nthen there’s a very simple prior known reduction from nearest code word\nproblem to CVP. So the interesting novelty is in that step to nearest code\nword, which is quite cool. And it’s just unlike anything I’ve ever seen. I\nasked some people around, and they hadn’t seen it either. I asked the people\nwho would like work in the coding complexity and like all these polynomial\ncode coding problems. And they’re like, yeah, I mean, I’ve seen some stuff\nwith shadows and whatever, but nothing nearly quite like this. So really\noriginal, really elegant,\n\n**Deirdre:** Yeah.\n\n**Chris:** Very beautiful.\n\n**David:** And to just like confirm I know we all know this from undergrad\nbut to confirm um what we definitely learned in ECS 376, like when you’re\ndoing the reduction there, the goal is to say, look, 3SAT, we all agree, you\nknow, is NP hard. So if you can take another problem, or you can take a 3SAT\ninstance, convert it into another problem, solve that problem, and then\nconvert it back, we must know that that other problem is at least as hard as\n3SAT. So in this case, we took an arbitrary 3SAT instance, and we turned it\ninto, I don’t want to solve that problem, instead I’ll solve CVP directly and\nthen therefore had we done that it must be at least as hard now which way\ndoes the—\n\n**Chris:** Exactly a plus yeah yeah yeah yeah.\n\n**David:** Inequality get rid see this was the thing that always confused me\nI would always get backwards I never remembered which direction of the\nreduction was which is that three sat less than or three sat greater than\nCVP.\n\n**Chris:** It’s 3SAT less than or equal to cvp because uh we’re saying like\nthe difficulty of the three set problem is no more than the difficulty of of\nthe cvp problem but you know the inequality aside, you have it exactly\nright. And the interesting thing, like we’re trying to prove that not CVP is\nNP-hard, but like approx. CVP, right? So what you have to do is actually\ndesign a reduction that maps this formula to a CVP instance, but you need to\nkind of like polarize it in some way. So if the formula is satisfiable, you\nneed to generate a CVP instance that is a yes instance, like the target point\nis pretty close to the lattice. But if the formula was not satisfiable,\ntarget point has to be like much farther away from the lattice by this n to\nthe 1 over 400 factor or whatever the factor is. So you need to kind of\ngenerate these like two very different situations from merely the fact that\nthis formula is either satisfiable or not. And you don’t know whether it is\nyour reduction just transfers its satisfiability to these two conditions. So\nthat’s why it’s super intricate and tricky to some approximation proofs.\n\n**Deirdre:** Yeah. This kind of jumped out at me when we were analyzing this\nbecause we’ve seen other proofs, other algorithms from models. We especially\ncare about how they’re applicable to cryptography. And this is sort of a hop,\nskip and a jump away from how hard are some of the lattice problems that we\nbuild our cryptography on. But sometimes, like we’ve seen some papers come\nout that are basically driven by some of these large language models, such as\nones that of Anthropic, that are sort of like, okay, you obviously kept it up\nto date with the latest literature in the field. And you saw all the pieces,\nyou were able to keep it all in your context, and you were able to put the\npieces together and then kind of draw the rest of the owl. And like the\nresult is a result and it’s meaningful and it’s useful, but it’s also not\nvery clever. I don’t think the words elegant or, you know, interesting or,\nyou know, any of the things that you used to describe this proof would be\nused for that. But now this is apparently fully powered by yet another model\nwith a different way it was grown or a different way that it was targeted or\nsomething like that. and it’s it’s very interesting to see and we we might be\nreaching the point because I’ve been sort of trying to keep my ear out for do\nwe get an Alpha Go moment when it comes to mathematics or cryptography or\nanything like that where the models start doing something that to the human\nexperts seems different or notable or I would never think of that or alien\nbecause sometimes these you know Go grandmasters would describe the moves\nthat AlphaGo would take and they’d be like, it’s like someone came down to\nEarth and was playing some crazy alien version of Go with moves that I would\nnever even think of. And this smells something in that ballpark. So yeah, I\ndon’t know.\n\n**Chris:** Yeah I I I kind of agree with everything you just said I mean I\ndon’t want to minimize anything from the previous results they’re super\nimpressive but like you say like the for the most part people say like okay\nyeah you took like very uh expertly put together a lot of different pieces\nand put them in in in different ways but like the dominoes were kind of all\nthere lined up we didn’t quite see how to knock over you know the first one\nor whatever and then you know the model found it and then everything falls\nfalls and and it comes out great and like that’s super useful uh super\ninteresting but I think this is the first one you know where I can you know\nfrom my own knowledge and experience confidently say like oh this is really\noriginal like this is it’s not alien math because it’s all known stuff it’s\nlike these read solomon things or whatever right but they were the whole path\nthat it took was like extremely different from anything you know I’m aware of\nand anyone I’ve talked to is aware of so that is that’s why I think you know\nthe Mythos Hawk break and everything I was like oh that’s really cool this\none I was like wow like whoa this is really.\n\n**Deirdre:** Yeah. All right. Anyone have anything else before we we pivot?\nNo. Cool. Awesome. You mentioned that there were some you mentioned before we\nstarted recording that there were some other results that had come out\nrecently. not the closest vector problem, but the shortest vector problem\nthat jumped out to you that we had completely missed. Do you want to share\nwith that with the class?\n\n**Chris:** Sure. Yeah. I mean, it was over a span of maybe three days. We had\nthree different papers posted to ePrint, which is like the cryptography\npreprint server, all getting more or less the same result, which the result\nis the following. The shortest vector problem, so that is you’re just given a\nlattice, there’s no target point, and you want to follow the exact shortest\nnon-zero vector in the lattice.\n\n**Deirdre:** Mm-hmm.\n\n**Chris:** So zero is always in there, that’s shortest, obviously, but you\nwant the shortest non-zero vector in the lattice. So the state-of-the-art for\nthe exact SVP is from 2015, And it’s basically a two to the. So exponential\ntime with a nice clean n in the exponent, right? And with a little extra,\nlet’s worry about that. So basically two to the n, and then these new papers,\nyou can get something like two to the point seven, two something something\ntimes. So they improve the constant in the exponent from like just one times\nn to 0.7 something times n. And they all came out like within a couple days\nof each other. And they all use the same basic technique. And some of the\npapers admit that like AI came up with this and other ones, we kind of got a\nlittle help from AI. And some of them don’t comment at all on other AI\ngames. But in any case, it’s pretty clear that AI was the force\nmultiplier. And so, you know, that’s the result that hadn’t been improved in\n11 years. It uses the same core component behind the prior test results, but\ndoes some extra in a more efficient way. It doesn’t seem to have any effect\non the security of Datis crypto, as far as anyone can tell, because it’s\nattacking this exact worst SVP. So if the algorithm has to provably work, and\nit’s already has a nice shape to it and everything. And so kind of\nheuristically, we know how to do much better than the 2^{0.7 whatever n}. So\nit doesn’t really change as far as we can tell any of the security estimates,\nbut it is like, again, like as a pure complexity result, it’s a big step\nforward.\n\n**Deirdre:** I wonder, I’m the fact that we had like three that came out very\nclose to each other. And they were very similar. I’m very curious how they\nwere querying or what they were querying. And like, I’m just I’m, I’m very\ncurious, because I have a feeling they all kind of went in the same path. And\nthey finessed it into, you know, something that they, you know, they put out\nthemselves. Well, yeah, this is,\n\n**Chris:** And this is one where like all the techniques used are kind of\nwell established and it was put together in a way,\n\n**Deirdre:** All right.\n\n**Chris:** But it wasn’t like, Oh my gosh, this is some brand new alien math\nor anything like that.\n\n**Deirdre:** Yeah, okay.\n\n**David:** I was going to say, I seem to recall there being a proof for one\nof the lattice-related problems that the average case complexity and the\nworst case complexity were the same. And so does that not apply here? Like\nyou were saying, oh, it’s not relevant because it’s worst case only. But I\nthought that we had proved for just about everything with lattices that worst\ncase and average case have the same complexity. So what am I\nmisunderstanding?\n\n**Chris:** Yeah, so we have these worst case to average case reductions,\nwhich is like what crypto frequently relies on, because you got to use random\ninstances for your crypto, but you want to make sure that you’re using secure\nrandom instances that are actually hard to break. And the worst case hardness\nof those kind of tells you, well, you can’t break the crypto unless you’re\nalso capable of breaking these problems in the worst case. So the reason it\ndoesn’t kind of move the needle on that, which is a great question, is that\nthese worst case to average case reductions usually have a blow up in the\ndimension to some amount. Right. So it’s like, oh, it starts in dimension N\nand it goes to maybe dimension 10 N or something like that. Right. And so,\noh, if I can break, well, I can break the worst case in 2^0.7n, whatever n,\nor I can break the average case in 2^0.7n, whatever, 0.2, something times\n10n, like these aren’t really comparable. So that’s the, maybe the short\nanswer to that question.\n\n**Deirdre:** Okay we’re gonna oh of course yeah yeah yeah and there’s yeah\nand there’s always like especially.\n\n**Chris:** There’s also approximation factors in there too. This is for exact\nSVP. So there’s another reason.\n\n**Deirdre:** If you’re trying to like, you know, the learning with errors\nproblem reduces the shortest vector, and there’s, there’s already gaps in\nthere as well. So like, we’ve got gaps in here. And then we’ve got gaps\nbetween the problem that we build our constructions with and all of them add\nup into what you can how expensive it is to try and actually estimate any of\nthis stuff and break it.\n\n**Chris:** Break it. Yeah, exactly. Yeah. So the gaps always make things a\nlittle easier and yeah. So.\n\n**Deirdre:** Okay, and more lattices for our favorite lattice\ncryptographer. There is a is a is a is a quantum attack paper, a preliminary\ndraft on the ePrint, and they’re trying to attack the dihedral coset problem\nin what they say is polynomial time. And this has been a bit of a kerfuffle\nbecause one, it’s a quantum algorithm and you can’t just code up your quantum\nalgorithm against toy parameters and just run it and see if it works.\nBecause we don’t have those computers yet, unfortunately. And everyone is\ntrying to see if this paper were correct and how closely it would apply from\nthe dihedral coset problem to things like LWE, if it were true. And we don’t\nknow. It doesn’t sound like anyone knows. Do you have an opinion?\n\n**David:** Also, can you explain what the dihedral coset problem is? Because\nthat’s something we all also definitely know.\n\n**Chris:** I have opinions. Yeah, yeah, we should start with that. Indeed,\nindeed. Yeah. So before we go to dihedral, we should go to cyclic, because\nthat’s where the story begins, really, like 30 some years ago.\n\n**Deirdre:** That too, because I didn’t know that one before I started\nreading this.\n\n**Chris:** So, you know, we kind of all know Shor’s quantum algorithm, which\nlike breaks factoring and discrete log.\n\n**Deirdre:** Yes.\n\n**Chris:** Right. And the way it does that is by solving this what’s called a\nhidden shift problem on the cyclic group, basically. So there’s cyclic groups\nin the discrete log problem and there’s cyclic groups hiding in the factoring\nproblem. And quantum algorithms, computers, Shor, is really good at solving\nthese hidden hidden hidden shift problems on the cyclic groups. Okay, huge\ncyclic groups. So the closest thing to being a cyclic group without cyclic is\nthe dihedral group. Okay, so the dihedral group is basically cyclic, but also\nwith like flips. So if you think of like an N-gon, a regular N-gon, a\ntriangle, a square, a pentagon, et cetera, with N sides, and then you can\nobviously rotate it to itself, right? And then it’ll overlap with itself with\nall the variations. But you can also flip it, right, if it’s got an even\nnumber of sides. Flip is giving you now the dihedral group. So this is, the\ndihedral group is basically the symmetry of an N-gon, right? And for all we\nknow, quantum breaks and solves this hidden shift problem on the cyclic\ngroup, huge cyclic groups, but it’s totally unable to do it on the adding\nthis one flip element kind of destroys, seems to destroy quantum’s power to\nsolve it. So that’s kind of a strange and bizarre situation. But there we\nhave it. And then, so people for a long time have been trying to solve this\ndihedral hidden coset or dihedral coset problem quantumly. So that’s what the\nclaimed result is basically to have done this. So you can take a lattice\nproblem, transform it into this hidden shift on a huge dihedral group. And\nthen if you can solve that, that gives you a solution to your original\nlattice problem. So that’s what we’re dealing with here. And there’s a bunch\nof overheads involved in these reductions, but they’re all polynomial. So the\nclaim here is polynomial time algorithm for a dihedral coset problem, and\ntherefore for all these lattice problems that underlie cryptography. So\npretty serious. The good news or bad news or news is that people don’t seem\nto buy the proof. They don’t. They’re identified errors in the proof that are\npretty substantial and they don’t seem to be easily fixable. And it’s in more\nthan one place, it appears to be. So the status of this claim is still kind\nof up in the air. And people are trying to figure out, you know, what’s\nactually going on here? Are these serious issues? Are they fixable? Or is\nthere something fundamentally, you know, insufficient with this approach? So\nthat’s where we are as of August, whatever day we’re recording.\n\n**Deirdre:** It’s just 13.\n\n**Chris:** This and by the time you print we may have some resolution. I know\npeople have found some interesting things about this so stay tuned.\n\n**Deirdre:** If this did hold, how far away from LWE does it, is it, and\nwhich instances of LWE would be shaking in their boots versus others?\n\n**Chris:** Yeah.\n\n**Deirdre:** Because this reminds, some of us are getting flashbacks to\nChen’s paper in 2024, which was a different quantum attack. And it was\nbasically going to endanger a whole bunch of lattice constructions, but\nespecially more complex instances like the things you need for FHE or the\nthings you need for, there’s more space in the parameters. I think it’s\nbetween the dimension and the modulus size, things like that. And those are\nthings that you usually use for more complicated instances, either using ring\nLWE for weird blind signatures or, you know, odder things than say ML-KEM and\nML-DSA, which the gap between those parameters is smaller. So do you think\nthere’s anything like that at play here if it were to hold.\n\n**Chris:** Yeah I mean all these all the papers the previous paper all these\nquestions come down to like what actual gap factor or approximation factor\ndoes this thing attack right and I think if I remember correctly with the\nwith the chen paper it was like claiming to attack a factor that was a little\nbit bigger than maybe what basic encryption needs but sufficient to break you\nknow what like fhe needs or what like more fancy crypto.\n\n**Deirdre:** Yeah, yeah.\n\n**Chris:** Needs but the specific factor I think didn’t really matter like if\nthat paradigm had worked out if that algorithm had actually been correct and\ncorrect analysis we’re quibbling over the approximation factor you know is it\nn to the one over 400 or is it n to the one over 28 or is it n to the you\nknow whatever like it’s the same kind of story broke it for n^3 and probably\npush on it a little bit you’re going to get it for n squared and for n to the\none half n to the one and whatever. So yeah, like, and you’re talking about\nthe sun, like, do you really care what the—\n\n**Deirdre:** It’s sort of like asking how hot is the fire when everything’s\non fire.\n\n**Chris:** Temperature is? It’s freaking hot, like everything’s gonna\nburn. So it doesn’t matter too much. So my best understanding is the current\npaper, at least claims to reach factors that would, you know, break all the\ncrypto, or, you know, more or less all of it. And, you know, so I don’t\nreally get too wrapped up in the exact factor that’s involved, because, like,\neither it works as a new paradigm, or it doesn’t. And if it works,\nfundamentally, then, like, we need to abandon all this stuff, even though,\noh, well, you’re an end quarter off from the factor that I use that now,\nforget about it just like go away so um that’s how I I see this.\n\n**Deirdre:** Okay, yeah. I think it’s very hard to say. It’s hard to just\ncompletely say, yeah, no, there’s a bug over here. And there’s a bug over\nthere. So just like chuck it in the bin, as tempting as it is, just like, no,\nno, no, it’s no, everything’s fine. Just chuck it in the bin. So I think we\nhave to say stay tuned to the consensus on a—\n\n**Chris:** Yeah, saying that the proof is flawed is like an insufficient\nconclusion to things.\n\n**Deirdre:** Yeah.\n\n**Chris:** But there will be more decisive conclusions in the near\nfuture. I’m very confident that will kind of fully resolve the unknowns right\nnow.\n\n**Deirdre:** Okay. I hope you’re right, because that’ll help me sleep better\nat night with all of our post-quandum options. Okay. To stop talking about\nlattices for a second, there was another paper on classic McEliece. I are you\nno we’re never going to stop talking about lattices or—\n\n**Chris:** How much time you got?\n\n**Deirdre:** I mean I’ve been told that secretly elliptic curves are a\nlattice or something like that or can be represented as a lattice problem um\nanother another paper uh that does not seem to have any AI involved but like\nwhatever maybe it does maybe it doesn’t who cares at this point A much more\nefficient distinguisher and a not very efficient decryption attack on the\ncode-based cryptosystem Classic McEliece. but when you’re telling me about a\npublic key encryption system and it says, oh, we can distinguish your public\nkey from a random key. And I’m just like, okay, like, all right, like, so?\nBut apparently, this is like a big deal in code based cryptography, where\ncode is not we’ve implemented computer code, but we were using codes like the\nReed Solomon codes. Yeah, the error.\n\n**Chris:** Error correction codes.\n\n**Deirdre:** Goppa, in this case, I think it’s binary Goppa codes that are\nunderneath Classic McEliece. Goppa codes that are underneath Classic\nMcEliece. Can you tell us why we care about a much improved distinguisher\nattack and why we worry when we get a good distinguisher attack for\ncode-based - Nice photography.\n\n**Chris:** Yeah, there’s a bunch of things to unpack here. So the headline\npaper title result is like a quasi polynomial time analysis of of McEliece\nfor the Classic McEliece kind of parameters or the asymptotic parameter\nClassic McEliece uses. So quasi polynomial time means, well, not quite\npolynomial, but pretty close. So it’s not like n to a constant. It’s not n\ncubed or n to the hundred, but it’s like n to the log n. Right. That’s that’s\nwhat they’re going after. And there’s a specific reason why the log n is\nthere, but we won’t get into it. So this is like asymptotically good because\nthe previous thing we had was a paper from Eurocrypt 25. I think it was 25,\nyes. That was a slightly sub exponential, like n to, sorry, two to the like\nn, and then some logs that happen to log factors that end up being less than\none. Okay, something like that. So just barely slightly better than two to\nthe n and not like actually practical, like this only kicked in for very\nlarge n’s. So that was sort of the first bang or the first shot heard around\nthe world. And then this result is like, oh no, it’s not two to the nearly n,\nit’s like n to the log n. So vastly, vastly better in terms of\ncomplexity. And they actually gave concrete estimates for the specific\nMcEliece parameters, showing that the runtimes are something like 2¹¹⁵, or is\nit 2¹¹⁴, 2¹, something like in the 2 to the low 100s, right? That was for\ndistinguishing. Okay, so distinguishing is like, oh, you give me a key that\nis McEliece key, or it’s just totally random junk. And they can tell which is\nwhich, right? They can tell which one it is. That’s what the algorithm\ndoes. And they have a proof, like a rigorous proof that it works within this\nrunning time. Okay, so like, why do we care? Who cares about distinguishing\nthe key? It’s because of the techniques that actually allow you to do\nit. It’s like the ideas, the algebra, the new approach that they brought to\nthis problem That’s very unlike anything else. And they were able to extend\nthe technique, also do decoding, basically, or like recover the message from\na ciphertext, right? Given the ciphertext, recover the message. And the way\nit works is like very similar to the distinguisher. They basically glue the\nciphertext onto the public key, like as if it was just a slight key, and they\ndo some fiddling with it, and they run the distinguisher. And if their\ndistinguisher says looks good, that means you have a zero in this position of\nyour ciphertext.\n\n**Deirdre:** Oh, no.\n\n**Chris:** And if it says looks random to me, that means you have a one as\nthe error in that position.\n\n**Deirdre:** Oh, no.\n\n**Chris:** So you can very easily recover all the bits of the error vector in\nthe ciphertext by just kind of running the distinguisher a bunch of times\nwith slightly bigger parameters.\n\n**Deirdre:** Oh.\n\n**Chris:** So that’s the natural thing. And I should say, the fact that you\ncan use a distinguisher to follow the error and actually do the decoding is\nnot a big shock, let’s say. I mean, it’s very clever. It’s a cool idea. But\nin codes and lattices and everything, we have all these kinds of different\nsearch decision reductions that are called. It just says, like, oh, if you\nhave a distinguisher, you can kind of leverage it to solve and follow the\nerror and solve LWE and whatever. So search to decision reductions are like\nvery common in this general milieu and this version of such a reduction. So\nthey have a way to decrypt a ciphertext in like a comparable amount of\ntime. I’m not saying exactly. There’s overhead to it for sure. But in quasi\npolynomial time and there are some heuristics that they need. They can’t\nprove it completely that it works, but in all their evidence, you know,\nsuggests that, yeah, this actually does work. And then the natural thing that\nthey say in the paper is like, oh, by the way, we have this\ndistinguisher. Obviously, a really important thing would be can you recover\nthe secret key from a public key? Right. And they say, like, conceptually,\nour ideas ought to be applicable to that question, too. like let’s get the\nsecret key from the public key, but we’ll leave that for later. Okay, so stay\ntuned. It’s basically what they’re telling us.\n\n**David:** Um and they weren’t like they were trying to do pir they’re like\nprivate information retrieval right like this was not a group of people that\nthis didn’t just come out of the like uh crypt analysis community this came\nout of like privacy and they were trying to build something on there.\n\n**Chris:** Yeah.\n\n**David:** Like oh well our scheme doesn’t work because of this result oh\nwait doesn’t that apply to this other thing like is that um uh like that\nseems bad for what like mcgleese generally like do you think there’s\nsomething about mcgleese that it was like perhaps understudied relative to\nother things Or like, why do you think that this kind of popped out of a\nsomewhat unrelated field rather than from the cryptanalysis itself? Is there\nany takeaway from that, or is it just the way the world goes?\n\n**Chris:** I mean, I can spec. Yeah, I can speculate. I mean, I think a lot\nof things we’re learning from these AI papers is that like big results can\ncome from using very different kinds of math than an error. Right, the CVP\nresult, it was just pulled from fields and error correcting codes. Certain\nideas from error correcting codes, of course, were used in complex lab\nproblems, like I don’t know, but the specific sophisticated tools that\nthe. Not the ones that, you know, you’re difficult to use.\n\n**Chris:** So the AI’s were able to bring like very different math to these\nproblems than most of the experts, you know, working on work. for the CVP\nresult. They brought all this function field math and error correcting codes\nand things like that. And, you know, this, we did simple error in the problem\nbefore, but nothing like the tools that were brought by Astra to this\nproblem. And so maybe what happened here was something similar where, you\nknow, the cryptanalysis had been a pretty narrow for a long time, right? like\nit had basically come down to information set decoding problem and people\nwere just saying like how quickly can I decode uh and follow errors and\ndecrypt it um and so pushing on that same direction for many years you know\ndidn’t yield anything really substantially new but then when people were able\nto bring very different kinds of mathematical algebraic geometry from 2005 uh\nyou know all of a sudden new things become possible when you start doing\nthese clever algebraic high degrees varieties and all kinds of stuff like\nthat so very new tools open up some some right and new exciting results this\ngroup was trying to build what’s called doubly efficient peer so very\nspecific kind of pir that um we basically have only one construction of it’s\nfrom LWE or Ring LWE actually.\n\n**Deirdre:** Yeah.\n\n**Chris:** Years ago, I think. And naturally people have been trying to build\ndoubly efficient beer from many other assumptions. So far, I don’t think\nanything has really come up. They ran into this barrier to follow their\nnarrative in the paper. They ran into this barrier and realized, oh, we can’t\nget it from this technique because mumble, mumble, mumble. and then, oh,\nwait, that break Classic McEliece in quasi-poly time. So it’s super cool how\ndifferent ideas can just cross-pollinate like this and have on a— One thing\nthat I saw repeatedly remarked after this paper started getting attention was\nthat I heard from more than one person, yeah, but we were always a little\nsuspicious about Classic McEliece. And like, I am younger than Classic\nMcEliece by at least a decade. So I don’t have any of that context. I’ve just\nheard that it is a thing that exists. is like one of a handful of instances\nof code-based, you know, public key cryptography. And I’ve heard that it’s\nlike old and trusted and it’s still standing. So like, it sounds fine to\nme. Like, you know, I, now that you look at like a, you can do distinguisher\nattacks like this on it and, you know, it smells a little something. Why do\nwe believe these codes are strong or like, you know, strong one way and, you\nknow, have a trap door the other day, other way, you know, all that sort of\nstuff. And like, I just don’t look at the deep literature there to convince\nmyself, because I’ve never really needed to. But like, why? Like, do you have\na sense of like, why there’s sort of a vibe in the field of just sort of\nlike, yeah, but we were always like a little bit suspect. I was a little\nsuspect of Mikalese.\n\n**Chris:** Yeah. Oh, I think Matt Green publicly said it, right? It was\nalways sketchy. But probably a lot of people think that as well. And\nunfortunately, I’m not younger than McEliece cryptosystem. I mean, I can tell\nyou the things that I have heard and the things that I believe myself. One is\nthat a lot of variants of McEliece have been proposed over the over the years\nto try and make it more efficient. Let’s make the key smaller. Let’s use some\ndifferent codes. Let’s not use binary GAPA codes. Let’s use some other family\nof codes. Virtually all of these got broken. And for some reason, the\noriginal, you know, McEliece didn’t. I don’t have a sense that the community\never really understood at some deep level why All these like proposed and\nthey just self-destruct, right? everything else around it is, is just a\ndisaster. So that’s kind of uncomfortable. Everything else around it is, is\njust a disaster. So that’s kind of uncomfortable. And then I think, I mean,\nanother aspect of it is like, people just don’t understand what it is that\nmakes it, you know, kind of okay, where all these variants aren’t.\n\n**Deirdre:** Mm-hmm.\n\n**Chris:** And the level of diversity of breadth of ideas that had brought to\nattack it were not that wide. They kind of all came down to this variations\nof information set decoding. Let’s just treat the public code and then try to\ndecode the random code.\n\n**Deirdre:** Mm-hmm.\n\n**Chris:** We’ll attack on the public keys themselves. But obviously, it was\njust like a permutation and a linear transform of this code. so it just has\nthis it just has this kind of feeling why if this is okay exactly makes it\nokay when all these other things okay I at least never found a you know a\ngood solution for these things so that’s you know probably why you know when\nI was in school I would talk to you know I remember talking to some\nprofessors about it and they’re like yeah we don’t know what the hell is this\nthing like we just don’t know what to think of it right and like\nscientifically you want to understand you know you want to have a reasonable\nexplanation for why this thing is plausibly secure and I never heard one at\nleast you know um yeah.\n\n**Deirdre:** Hmm. This unfortunately is reminding me of the oil and vinegar\nand variants that are being tried out, especially for post-quantum\nsignatures. And there have been, I think it’s wedge attacks against a lot of\nthese more complicated, smaller, faster versions that oil and vinegar is a\nspecific flavor of multivariate public key cryptography. And it just seems\nlike all of these other ones, except OG oil and vinegar, and I think mayo,\nwhich has like a slight tweak on oil and vinegar, just keep, they keep\nfalling down. And a lot of this sounds very similar to the story you told of\ncodes that are code-based crypto.\n\n**Chris:** Yeah, there are a lot of similarities, like you say, like people\npropose things to try to improve the efficiency, you know, just get broken\ntotally. So understand is, you know, good in combination or what causes them\nto work or not work.\n\n**Deirdre:** Thank you very much for taking on a tour on various sections of\npost-quantum cryptography.\n\n**David:** One last important question, though.\n\n**Chris:** David? Yes.\n\n**David:** How are you feeling about Michigan football this season?\n\n**Chris:** This season. Well, can we talk about like what’s happened since\nthe last time I was on?\n\n**David:** Oh, yeah.\n\n**Chris:** We got a national championship in football. We got a national\nchampionship in basketball.\n\n**David:** I mean, champions. Oh, yeah.\n\n**Chris:** Who’s got it better than us, man?\n\n**David:** Mm-hmm. Nobody, although. we don’t need to talk about what\nhappened.\n\n**Chris:** So.\n\n**David:** Kind of in between some of those things but like right now you\nknow we asked grandma for Kenny Dillingham and she said what Kyle Whittingham\nand there we are that’s gonna be great.\n\n**David:** Yeah, and I’m excited to see you at the Rose Bowl in a few\nmonths. Congrats, Michigan football. Go blue. Cool. All right. Where’s my\nthing? Oh, gosh. I do this every time. I have a spiel that I have to give.\n\n**Chris:** Sponsor read.\n\n**Deirdre:** Yes. Well,\n\n**David:** No, we did our one sponsor read of the year.\n\n**Deirdre:** We do one a year.\n\n**David:** And we thank them very much.\n\n**Chris:** Hmm.\n\n**David:** But we did the one.\n\n**Deirdre:** Um where is it okay *Security Cryptography Whatever* is a side\nproject from Deirdre Connolly, Thomas Ptacek, and David Adrian. You can find\nthe podcast online @scwpod, and the hosts online @durumcrustulum, @tqbf and\n@davidadrian. You can buy merch online at security at merch that\nsecuritycryptographywhatever dot com and if you like the pod give us a\nfive-star review. Go blue!", "url": "https://wpnews.pro/news/ai-lattice-proofs-with-chris-peikert", "canonical_source": "https://securitycryptographywhatever.com/2026/08/26/ai-lattice-proofs-with-chris-peikert/", "published_at": "2026-08-29 14:52:01+00:00", "updated_at": "2026-08-29 15:18:28.297172+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-research", "ai-products"], "entities": ["Chris Peikert", "OpenAI", "Classic McEliece"], "alternates": {"html": "https://wpnews.pro/news/ai-lattice-proofs-with-chris-peikert", "markdown": "https://wpnews.pro/news/ai-lattice-proofs-with-chris-peikert.md", "text": "https://wpnews.pro/news/ai-lattice-proofs-with-chris-peikert.txt", "jsonld": "https://wpnews.pro/news/ai-lattice-proofs-with-chris-peikert.jsonld"}}