Quantifying Cryptanalytic Research Effort via Publication Metrics
A new framework estimates human effort spent on public-key algorithm cryptanalysis using literature.
1Quantifying Cryptographic Research Labor
Matthew Green launched a platform to estimate the total human hours dedicated to analyzing specific public-key algorithms. By leveraging sixteen thousand academic papers, the project maps author contributions to research-allocation years. This methodology provides a transparent, data-driven approach to understanding how much scrutiny various cryptographic assumptions have historically received from researchers.
2Methodology and AI Integration
The analysis pipeline was constructed and executed by AI models, specifically Claude Fable 5.1 and Claude Opus 5.5, with additional input from GPT-6 Astra. Matthew Green defined the core research questions and methodological frameworks while overseeing the entire process. This collaboration demonstrates how AI can process vast academic datasets efficiently.
3Categorizing Cryptanalytic Focus Areas
The study classifies research efforts across several distinct domains, including the Elliptic Curve Discrete Logarithm Problem (ECDLP) and structured or plain lattices. It also evaluates syndrome decoding and various comparative algorithms. By converting publication counts into person-level author maps, the researchers established a baseline for comparing different cryptographic security assumptions.
4Shift in Research Trends
Lattice-based cryptography has recently surpassed elliptic curves in cumulative research effort according to this metric. The study expresses this historical shift as inference budgets, calculated under specific productivity assumptions. This transition highlights the evolving focus of the cryptographic community as they prepare for post-quantum security challenges and new standards.
5Limitations of Publication Metrics
The researchers acknowledge that these estimates may substantially overstate actual time spent on cryptanalysis. Because the metric relies solely on published literature, it inherently excludes unpublished work. This creates a significant blind spot regarding academic efforts that did not result in formal papers or successful publication in peer-reviewed journals.
6The Intelligence Agency Blind Spot
A critical caveat of this study is the total exclusion of secret cryptanalysis performed by intelligence agencies. Since such work is never published, it remains outside the scope of this metric. Consequently, the actual security scrutiny applied to these algorithms is likely much higher than what the current data suggests.
7Utility of the New Metric
Despite the inherent limitations regarding unpublished data, this project represents a pioneering attempt to quantify cryptanalytic effort. It serves as a first-order approximation for researchers trying to gauge the maturity and security of specific public-key assumptions. The framework offers a structured way to visualize the intensity of global cryptographic research.
8Future Implications for Security
Measuring research effort provides a proxy for the confidence level in cryptographic primitives. As the field moves toward post-quantum readiness, understanding where human capital is concentrated becomes vital for risk assessment. This tool helps the community identify which algorithms have received sufficient peer review and which require more intensive academic investigation.