密码分析投入如何量化：一项基于文献的估算

Introduction

Every deployed public-key scheme rests on a conjecture that some problem is hard. We rarely ask how hard anyone has actually tried. This page reports a literature-based estimate of public cryptanalytic effort for each assumption class behind standardized encryption: the elliptic-curve discrete logarithm (ECDLP), structured and plain lattices (MLWE, LWE), and syndrome decoding, with factoring, isogenies and multivariate systems as comparators.All figures count public work only. Classified effort is discussed in §6.

The goal is a defensible order-of-magnitude comparison of the form class X has received about N times the scrutiny of class Y, not a security level. Computational records and model-based work estimates get their own track.

A research-allocation year (called research-FTE in the underlying data) is an estimate based on the share of a researcher's publications devoted to a topic. It is not a recorded year of work.

The literature

We harvested IACR ePrint, DBLP, OpenAlex and zbMATH, screened by keyword, and classified candidates against a written rubric. A second pass reviewed included and borderline items plus a sample of exclusions. Figure 1 shows the result by year of publication; papers that address more than one assumption are split fractionally. Every counted item is listed, by year and with BibTeX, in the bibliography.

Lattice research exceeds ECDLP in the main cumulative views. The lattice/ECDLP ratio ranges roughly from 1.3 to 2.6 across the study's counting and source assumptions.

These are different measures and sensitivity choices, not a confidence interval. The main paper-count view crosses in 2017; the author-output estimate crosses in 2019.

Visible effort by assumption class. Fractional item counts (include = yes, effort categories); peer-reviewed counts items that also appeared in a refereed journal or conference (venue quality not assessed); estimated allocation years from the author map. Totals include items missing from the dated chart.

Who does the work

Paper counts treat a two-page note and a decade-long program alike. The author map groups 7,613 authorships into about 3,240 identities, some unresolved, and estimates each person's share of publications devoted to a class over a moving five-year window. Two people with half their output in a class contribute one allocation year.

These estimates may substantially overstate researcher time. Publishing only on a topic does not mean working on it full time. Teaching, administration, other employment, short projects and unrecorded work can all make publication share exceed time share. A minimum assumed publication rate limits the effect of sparse records, but does not measure hours. The alternative career-adjusted view reduces shares by assumed research-time fractions; it is also a proxy, not a correction validated against researchers' time records. Some authors lack career data and use assumed effort per paper instead.

Cumulative effort

In this model, factoring and FF-DLP together still lead on accumulated allocation years, while lattices passed ECDLP in 2019. These curves describe the model's allocation of published output over time.

Individual researchers

A separate page breaks the published output down by person: who contributed most to each assumption class in any period, how concentrated each field is, and how its researchers are connected through co-authorship.

Researcher explorer Top contributors, concentration and co-author networks by field and period

Distance to the frontier

Effort is one axis; demonstrated computation is another. For each target we use a cost model to estimate the work ratio between an attack and a relevant public computational record. We express this ratio in bits:

$$g \;=\; \log_2 W(\text{target}) \;-\; \log_2 W(\text{largest public solve})$$

(1)

A gap of 10 bits means about a thousand times the modeled work; 35 bits means about 35 billion times. Both endpoints use the same model. Only a shared, size-independent cost factor cancels; memory, communication and other costs can change with problem size.

See the normalization method for the models, sources and verification limits.

Attack history and stability

How have attack algorithms changed? The plot below traces selected, source-checked mathematical bounds. Each formula gives a leading-term index: a simplified measure that drops lower-order factors. A fall in this index records an improvement in the selected model. It does not measure security bits lost, and a flat line does not mean that practical attacks stopped improving.

The first view holds a reference size fixed. The second finds the size giving an index of 128 under each selected bound, shown relative to the latest such size. These are illustrative model sizes, not recommended cryptographic parameters. Dates follow the quoted analyses, including later corrections, rather than reconstructing what researchers believed at each moment.

Selected model indices. Different starting years reflect source coverage and comparison scope. “Latest plotted bound” is not a claim that no other progress occurred after that date.

Breaks and reassessments with different cost models

Finite-field advances and the SIDH break are retained as sourced events. Their concrete estimates and runtimes concern particular instances and units, so they are not joined to the index curves. Polynomial and quasi-polynomial algorithms are distinct; neither label alone supplies a numerical parameter recommendation.

Selected events. Estimates retain their source's scope; they are not common-unit measurements.

Rules, exclusions and corrections: detailed methodology. Full dated ledger and sources: algorithmic history report. Sources were checked by an agent; independent human verification remains outstanding.

What this does not count

Our literature estimates cover publicly documented work: papers, preprints, theses and published records. Unpublished failures, private research and classified work are missing. We do not have a reliable allocation of that missing effort by assumption class.

If public effort were known, additional classified effort could be represented by an unknown multiplier:

$$H_X^{\text{public+classified}} \;=\; (1 + k_X)\, H_X^{\text{public}}, \qquad k_X \ge 0 \text{ unknown}$$

(2)

Why \(k_X\) is not estimated. One might hope to read classified headcount off public government budget documents, taking the NSA as the best-documented case. Official documents do not allow it. The National Intelligence Program is published only as a topline; every NSA line beneath it is classified, the one unclassified NSA budget line covers the defensive mission, and the agency is excluded from the federal workforce statistics that would otherwise count its mathematicians. The leaked FY2013 budget justification is the only document that pairs a dollar line with people: “Cryptologic Math & IDA Research” at $119–146M a year, and one cryptanalysis project with 240 civilian staff on $39M. Dividing the research line by a plausible loaded cost gives roughly 300–500 full-time staff, uncertain by a factor of two, for a budget line rather than for cryptanalysts, as of 2012, with no split by assumption class. An official series does exist for the IDA cryptologic centers that work under NSA contract, and it suggests that such dollar conversions overstate research staff by about a factor of two. The methodology page lists the sources and what each can and cannot bound.

Effort in inference dollars

Recent AI systems have produced new results in mathematics and in cryptanalysis at disclosed costs. We do not estimate an exchange rate between human and machine research. Instead we express historical effort \(H_X\) as an equivalent inference budget under an assumed productivity multiplier \(s\):

$$D_X(s) \;=\; \frac{c \cdot H_X}{s}, \qquad c = \$250{,}000 \text{ per research-year}$$

(3)

The multiplier means assumed research productivity per dollar: at 10×, one estimated human research-year corresponds to $25,000 of inference. No multiplier is measured or preferred. These budgets inherit any overestimate in the human-effort proxy: if actual time is half our estimate, the corresponding budgets are also half as large.

Read in reverse, a $100,000 inference budget represents 0.4, 4 or 40 assumed human-year equivalents at 1×, 10× or 100×. These are assigned equivalents, not observed labor displaced by AI. The paper separately explores HAWK normalization using paper-based effort on both sides; it does not apply that rate to the author-output estimates shown here.

Recent mathematical results

For selected mathematical problems and HAWK, we compare disclosed AI budgets with a paper-based estimate of effort in the surrounding literature. This second estimator assigns assumed years to each paper, rather than reconstructing author publication shares. The samples include partial results and related problem variants.

The literature totals are not yet audited pre-discovery human labor. The retained corpus includes explicitly AI-assisted papers, marked in the chart, and its historical cutoffs still need review. Existing literature also supplies tools to the AI. Comparing these dollar amounts does not measure productivity gains or the fraction of historical scrutiny reproduced.

Sources: FrontierMath Erdős, Tables 2–3 and Anthropic's HAWK report. The Erdős paper reports more than $220,000 across its wider campaign; the individual successful-run costs shown here are a different accounting boundary. HAWK's roughly $100,000 is API cost for discovery, not the cost of executing a key-recovery attack.

Method and caveats

For the exact rules, formulas, source files and unresolved defects, read the detailed methodology and audit trail.

Corpus. IACR ePrint and DBLP harvests, OpenAlex phrase searches and citation expansion, and zbMATH. The export contains 4,349 included or borderline records; 2,877 are included items in the main effort categories. Counting each work once (92 duplicate versions at weight zero, 9 journal extensions at one third), they are 2,785 distinct works. Recall against twelve selected seed papers' reference lists is approximately 96–100% per class; this does not establish field-wide recall.

Classification. The second model pass reviewed included and borderline items and a sample of exclusions, with access to the first labels. Agreement of \(\kappa = 0.84\)–\(0.89\) describes consistency on the reviewed subset. Exclusion reversal rates of 0.5–1.1% concern sampled first-pass exclusions. Neither check establishes independent validation, classifier recall or a global error rate. Systematic human validation remains outstanding.

Scope. The rubric excludes attacks whose contribution is extracting power, timing or fault leakage, and implementation or protocol flaws unrelated to the mathematical problem. It intentionally includes mathematical attacks given partial information, quantum algorithms, special or weak instances, and faster implementations of mathematical solvers. These broader categories do not all transfer to ordinary deployed parameters. Abstract-based classification can also admit out-of-scope work or misattribute mixed papers; such errors can overstate a class's relevant scrutiny. See the classification rubric.

Time. Output share may substantially exceed time share. Missing career publications, uncertain identities and effort-per-paper assumptions add further error. Career-stage adjustment lowers the principal-class totals by roughly a quarter, but relies on assumed research fractions and often estimated career stages. No defensible numerical error bar is available. Dollar scenarios scale directly with these uncertain totals.

Models. Pipeline, analysis and text by Claude Fable 5.1 and Claude Opus 5.5, with contributions from GPT-6 Astra; smaller Claude models ran the first classification pass. Methodological decisions were made and recorded by the overseeing human.

Data and citation

Read the detailed methodology for the audit trail and the working white paper (PDF) for the synthesis, nominal person-hours, and additional OpenAI and Anthropic comparisons. Its frontier-record analysis remains a separate track, summarized here with the qualifications above.

Every figure on this page is drawn from the generated data. The papers behind the counts are listed in the bibliography (BibTeX). The study repository contains the sources, classification rubric and pipeline/build_site_data.py used to regenerate it.

Corrections and suggestions. We would like to hear about anything that looks wrong: a paper that is missing, miscounted or in the wrong class, an author credited to the wrong person, a number that does not match its source, or an assumption in the method that you think is mistaken. Proposals for better methods are just as welcome. Please open an issue on the study repository; the templates ask for the details we need to check a report. Accepted changes are recorded in the repository history, and the site is regenerated from it.

@misc{bitsofwork2026,
  title        = {How Hard Have We Looked? Measuring Public Cryptanalytic Effort},
  author       = {Green, Matthew},
  note         = {AI-conducted analysis, overseen by Matthew Green. Working draft},
  howpublished = {\url{https://bitsofwork.org}},
  year         = {2026},
}