The quantum claim that put lattice security in question

What if the mathematics we are moving to could fall to a quantum computer too? For us, that is a frightening possibility. So much of the post-quantum transition rests on replacing vulnerable cryptography with something expected to survive. An August paper raised that uncomfortable question. Twelve days after its initial submission, another paper presented a refutation. The proposed attack had failed.

The relief comes from how it failed. The researchers did more than identify a gap in the argument: they showed that the analyzed algorithm could not perform the task it claimed to solve. There was no demonstrated break of ML-KEM, the lattice-based mechanism standardized for establishing shared keys.

Why this claim was unsettling

In his proposal, Daniel R. Simon claimed an efficient quantum algorithm for the Dihedral Coset Problem, usually shortened to DCP. You do not need to follow its equations to understand the concern. There are mathematical connections between solving this problem and solving certain difficult lattice problems. A successful shortcut could have consequences beyond DCP itself.

A lattice is a regular arrangement of points, extended into many dimensions. Cryptography uses problems involving these structures that are easy to set up but believed hard to reverse. NIST’s ML-KEM standard relies on a problem called Module Learning with Errors. Roughly, the attacker must recover hidden information from mathematical relationships disturbed by small amounts of noise.

The concern is that an unexpected mathematical shortcut could make a supposedly hard problem manageable. Building a larger quantum computer is one route to danger. Discovering a better algorithm is another. A security assumption can come under pressure on paper before anyone demonstrates a working attack against a deployed service.

That explains the stakes. It does not mean Simon had nearly broken the encryption in your browser. His was a theoretical proposal, and connecting a result to a particular deployed scheme requires checking the reductions and parameters. A claim this consequential deserves scrutiny precisely because the distance between an impressive theorem and a working attack matters.

Twelve days between the claim and the refutation

The archive history records the first submission on 3 August 2026. The refutation arrived on 15 August. That is nearly two weeks between the two public milestones, rather than evidence that every researcher shared the same view throughout that period.

The record also shows an argument being checked and revised. Simon’s abstract acknowledges a correction to the proof of Lemma 3 involving two different probability distributions. Its latest revision, dated 17 August, acknowledges the opposing preprint and says it is being evaluated. The refutation explicitly examines the 11 August construction; its own latest revision is dated 1 September. Those dates keep us from silently treating every version as identical.

It could not recover even the target bit

Aparna Gupte, Seyoon Ragavan and Mark Zhandry give a particularly sharp result: the analyzed algorithm cannot recover even the least-significant bit of the hidden DCP secret with a non-negligible advantage over guessing. In plain language, its advantage at recovering that bit becomes too small as the problem grows to deliver the claimed efficient solution.

Their explanation concerns information the computation fails to use. Certain labels attached to its samples contain information needed for recovery. The authors show that the algorithm can be closely approximated while retaining only the most-significant third of those labels, and that this is insufficient. Their result also rules out a wider family of constructions under its stated conditions.

That is why the refutation is reassuring. Repairing a line in a proof would not make the analyzed construction succeed: the result is about what the algorithm can actually do. It closes this proposed route, without claiming to close every route a future researcher might discover.

The proof was made available for others to check

The authors published a Lean 4 formalization alongside their mathematical argument. Lean is a proof assistant: it checks whether formally written conclusions follow from definitions and assumptions. It gives other researchers a concrete artifact to inspect and reproduce.

That extra layer of checking is welcome when the claim under discussion carries such consequences. It still depends on formalizing the intended statement correctly. We have reviewed the published descriptions, but have not independently rebuilt or audited the Lean proof. The repository also discloses language-model assistance; the mathematical statement and its checks are what readers should evaluate.

Where that leaves the cryptography we use

The lattice-based standards we use were not broken by this proposal. NIST describes ML-KEM as believed secure even against an adversary with a quantum computer. This episode supplies no demonstrated attack overturning that assessment. It also supplies no permanent proof of safety, which would be a much larger claim than refuting one algorithm.

The hybrid question is still uncomfortable. Combining classical and post-quantum cryptography is intended to preserve protection if one component fails, provided the combination is sound. But if a future quantum attacker could defeat both components, the word hybrid would not save the connection. Our concern about that possibility is real; this paper did not establish that it had happened.

The point

We can breathe easier about this particular proposal. A worrying claim met a direct, inspectable refutation, and the lattice-based foundation remains unbroken by this attack. That is the story worth telling. Continuing the transition still makes sense, with room to change algorithms as evidence develops. For now, the outcome is a relief, and a reminder of why we need people trying hard to break the mathematics we depend on.

This article was prompted by Daniel Romero Ruiz’s account in El lado del mal. We checked the primary records again on 11 September 2026 for this revision.

References

• Daniel R. Simon: A Polynomial-Time Quantum Algorithm for the Dihedral Coset Problem, initial submission 3 August 2026; latest revision 17 August.
• Gupte, Ragavan and Zhandry: The ePrint:2026/1591 Quantum Algorithm Does Not Solve DCP, submitted 15 August; revised 1 September 2026.
• Companion Lean 4 proof repository, formal statements, proofs and reproduction instructions.
• NIST FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard, published 13 August 2024.
• Daniel Romero Ruiz: Cómo se desmontó el algoritmo, the article that prompted this review.