XKCD now has an official statement about the whole situation: please upgrade to 5 as your private key.

https://m.xkcd.com/

This press release is gold:

https://emudhra.com/en/press-release/emudhra-statement-distrust-global-tls-intermediate-root-ca

"Last weekend, an independent researcher found that the weak keys could be reverse-engineered possibly with AI-assisted techniques."

Your private key was the number 4. Your fucking private key, which is supposed to be a 115 digit number, was the fucking number 4. As in, the fourth key a very naive first analysis would try. But sure scary scary AI did it.

I independently recovered the private key, without any AI assistance, on Monday evening. Not because I was involved in the incident, just because I was curious and had a little bit of free time on my hand.

If you're wondering why there is no "other" choice, me too, buddy, me too.

You have discovered a new mathematical concept. What do you name it?

A couple of people are asking in the comments for further elaboration, so here we go:
When quantum computers factor numbers or compute discrete logarithms, the thing the quantum part of the algorithm solves is the Abelian Hidden Subgroup Problem. It's not super important what this is, other than the fact that "abelian" means commutative and is a very important qualifier.
Lattice cryptography on the other hand can be reduced to the Dihedral Hidden Subgroup Problem. (The Dihedral Coset Problem is a variation thereof). On the other other hand, lattice cryptography is, when it comes to cryptography, the closest to what we can consider complexity theoretically secure. There are hard case to average case reductions, randomized reductions to NP-hard, and in general lots of reductions to known hard problems.
So a quantum algorithm that promises to solve the dihedral hidden subgroup problem in polynomial time would as a first order effect destroy all lattice schemes in one go. (The reality is a bit more complex and it turns out some details do matter as to just how many lattices can be solved with a given algorithm, but any such algorithm would be a major blow and likely lead to further results). And given the complexity theoretical results on lattices, we would at least have some doubts as to whether public key encryption can exist at all. After all that isn't just an NP problem, it's a specific subset of NP problems and that subset could very well be empty.

That noise you're hearing is all the cryptographers working on PQC (and particularly lattices, but a breakthrough like that would have likely had far reaching consequences beyond just lattices) collectively breathing out after holding their breath for a week.

https://eprint.iacr.org/2026/1693

I do have to admit, I'm somewhat proud of my economicified explanation of key exchange algorithm negotiations.

https://mailarchive.ietf.org/arch/msg/tls/evs5vqvK7kTEFHCPdnqM7Xf3Yyk/

If you told me ten years ago that one day I would get into online fights with economic Nobel prize laureates, and that I would be the one looking sane in the exchange, I would have laughed out loud.

On the HAWK break: setting aside the LLM part of the narrative, this fits very well into my priors. I only had started looking at HAWK fairly recently and have not devoted much time to it, but even then I was not really convinced by the security argument. My main concern is that HAWK's public key is a global property, while any other module lattice based scheme only ever reveals local properties (Local/Global with respect to the number field order). Global properties contain much more usable information, so being able to reduce the problem to a smaller lattice is not too unexpected. I do not expect similar results to apply for MLWE or NTRU based schemes. Even though HAWK is a lattice algorithm, it's one that is much more deeply intertwined with the module structure, which gives it an Achilles heel.

The fact that this was done with heavy LLM assistance on the other hand is quite surprising. It's unclear how much of this is marketing hype, and there is no surpassing human capabilities there yet (except maybe in time spent), so I don't see a revolution in cryptanalysis per se, but certainly interesting new tools for researchers.

Apparently one can just claim to have codesigned any scheme now, so let it be known that Julius and I coauthored the Caesar cipher

https://openssl-conference.org/speaker?p=I

And the posts, they keep on coming.
I hundred percent agree with @filippo here, the question is not whether we're certain that a quantum computer exists by 2029, it's whether we're certain that one doesn't exist. And things have progressed far enough that non-physicists, or even physicists working in different subfields, can no longer reliably tell what's going on.

https://words.filippo.io/crqc-timeline/

Lol. Rofl, even.

(Not the Onion: https://www.ibm.com/thought-leadership/institute-business-value/en-us/report/enterprise-2030)

Brought back from Twitter due to popular demand. Ignore at your own peril.

A key should always be considered to consist of both raw key material and all metadata required to fully describe and execute the associated cryptographic function.

Please do not vibe code reference implementations. FFS.

You can (and probably should) criticize the quantum hype. You can question whether quantum computers will ever be real (although that seems to be more and more likely). But don't use a metric that is utterly incapable of measuring success to sound smart without understanding the point.

Shor's algorithm, running on a quantum computer is a polynomial time factoring algorithm. Polynomial in the number of digits, that is. By the time that we can build a quantum computer that can factor an interesting number, we are maybe half a year to two years away from breaking cryptography. In other words, by the time you see an actual useful computation out of a quantum computer, the house is already halfway burned down.

Since I keep seeing people refer to that paper on replicating quantum computing factoring records with an abacus, here is an equally reductive rebuttal of it:
This is akin going to a car manufacturing line, pointing at a chassis that is somewhere at the beginning of the line, and talking about the fact that it can move a few meters at best.

Oh no my blog post got shared to the orange site. Where do I get a fursona all of a sudden now?!?

New blog post, about a fun obsession of mine, the reason why we use elliptic curves and not any other groups for Diffie-Hellman.

https://keymaterial.net/2025/05/23/there-is-no-diffie-hellman-but-elliptic-curve-diffie-hellman/