A Lattice Attack Was Claimed on 3 August 2026 and Answered on 15 August: What ePrint 2026/1591 and 2026/1693 Say About ML-KEM
On 22 September 2011 the OPERA collaboration at the Gran Sasso laboratory posted a measurement to the arXiv saying that neutrinos sent from CERN, 730 kilometres away, had arrived about 60 nanoseconds sooner than light would have. The collaboration did not sit on it. They published under the identifier arXiv:1109.4897 and asked the field to check them. The field checked them. By the fourth version of that same paper the arrival difference had become 6.5 ± 7.4 nanoseconds — consistent with the speed of light, the anomaly traced to instrumentation — and the work went into the Journal of High Energy Physics in 2012 with the corrected number. The error was found and shown under the same identifier that had carried the original claim.
Cryptography ran that same procedure in August 2026, on the mathematics underneath the encryption that governments have put on a fifteen-year replacement schedule.
Practical takeaway. A claimed polynomial-time quantum algorithm against lattice problems was posted on 3 August 2026 and formally answered on 15 August. Neither the claim nor the answer to it reached ML-KEM's published parameters, and nobody has published a composition that would. An organisation asked to react to a cryptanalytic headline should establish three things before spending anything: which exact preprint version the claim rests on, whether any published chain composes it to the parameter set actually deployed, and whether the migration plan depends on one algorithm or on the ability to change algorithms.
What Daniel Simon submitted on 3 August 2026, and what the abstract claims
The paper is A Polynomial-Time Quantum Algorithm for the Dihedral Coset Problem, Cryptology ePrint Archive 2026/1591, by Daniel R. Simon of Amazon Web Services. The archive shows it received on 3 August 2026, revised four times, last on 17 August 2026, and filed under attacks and cryptanalysis. Working from Regev's reduction techniques, it claims to solve the modular subset sum problem without a subset-sum oracle, and states that this yields polynomial-time quantum algorithms for lattice problems: a polynomial-factor approximation to the shortest vector, and learning with errors at noise parameter α = √n polylog(n).
Two details in that paragraph did most of the work in the coverage that followed, and both are worth reading slowly. The first is the author. This is the Simon of Simon's problem, whose 1994 result gave the first exponential separation between quantum and classical query complexity and fed directly into Shor's factoring algorithm the same year. A claimed break of the cryptography built to survive Shor, from the person whose work made Shor's possible, is a genuinely arresting sentence, and it travelled as one.
The second detail is what the abstract does not contain. It never names ML-KEM, FIPS 203, ML-DSA, or any parameter set anyone has deployed. The lattice consequences are stated asymptotically, at a noise regime chosen to make the reduction work. Between that abstract and a broken key exchange sits a chain of further steps, and whether that chain closes is a separate question from whether the algorithm is correct.
How a dihedral coset problem reaches ML-KEM: Regev in 2004 and Wen and Zheng at CRYPTO 2026
The chain is real and it is old. Oded Regev showed in the SIAM Journal on Computing in 2004 that an efficient algorithm for the dihedral coset problem would give a quantum polynomial-time algorithm for the unique shortest vector problem, one of the hard lattice problems that security arguments in this field reduce to. ML-KEM's own security is stated against Module-LWE, so the route from a DCP result to a deployed key runs through further reductions. That link is why a DCP paper is read as a cryptography paper at all.
The chain got shorter this year. Weiqiang Wen and Jinwei Zheng of Télécom Paris, Institut Polytechnique de Paris, posted Module Learning With Errors and Structured Extrapolated Dihedral Cosets to the ePrint archive on 30 January 2026, last revised 16 July, and accepted to CRYPTO 2026. Their opening sentence states the stake plainly: Module-LWE is “the fundamental hardness assumption underlying the key encapsulation and signature schemes ML-KEM and ML-DSA.” They show that Module-LWE is as hard as a structured variant they call IP-M-EDCP, and give a further reduction from IP-M-EDCP to plain EDCP. The equivalence holds for Module-LWE over power-of-two cyclotomic rings with constant module rank, which they call “a setting of particular relevance in cryptographic applications” and which is the family FIPS 203 works in.
One qualification belongs here rather than in a footnote, and the authors put it in their own open-problems section. Their reduction leans on the Rényi divergence, which is “particularly suitable for the search variants but does not naturally extend to decision variants.” They sketch a workaround and leave it open. Security arguments for encryption schemes of this kind are normally built on the decision form, so what exists today is a route with a stated gap in it, not a completed path from a DCP result to a deployed key. Anyone holding Simon's abstract and this paper together in the first week of August still had a plausible reason to look hard, and that is the honest explanation for the alarm.
What Gupte, Ragavan and Zhandry showed in ePrint 2026/1693
The answer came from Aparna Gupte of MIT, Seyoon Ragavan of Google and MIT, and Mark Zhandry of Google and Stanford. The ePrint:2026/1591 Quantum Algorithm Does Not Solve DCP was received on 15 August 2026 and last revised on 1 September. The abstract states the finding without decoration: the authors formally show that Simon's algorithm “does not extract the least-significant bit of the dihedral coset problem (DCP) secret with non-negligible guessing advantage, and therefore does not solve DCP.” The mechanism they identify is that the algorithm can be implemented using only the most significant third of the classical Fourier labels, while solving DCP would need those labels used far more extensively during uncomputation. Twelve days from Simon's posting to a formal answer, with a further revision on 1 September.
The scope of the finding is wider than one algorithm, and the authors are precise about how much wider. They write that the result is “not merely about Simon's analysis of his algorithm; we are showing directly that the algorithm cannot possibly work,” and that their “no-go encompasses a much broader class of algorithms than the specific algorithm by Simon.” What that class is deserves precision. The theorem covers algorithms that carry only a limited digest of the classical Fourier information through to the uncomputation stage; Simon's falls inside it because his can be run, up to a small error, on the most significant third of the labels alone. Alongside the theorem the authors state a broader lesson in looser language: an algorithm for DCP following the shape of Regev's 2004 reduction will, they write, “probably have to make extensive use of the classical Fourier labels in the uncomputation stage.” The word probably is theirs, and the two statements should not be merged. One is a proved no-go for a defined family. The other is guidance for anyone who tries next. To make the first checkable by machine, they released Lean 4 code for their results.
What still separates any DCP result from ML-KEM's parameters
Suppose the algorithm had worked. It still would not have reached the key exchange in a browser or a bank by itself. The published analysis of the Wen and Zheng chain is careful about where the open ground is: of Simon's paper it says the claim is unverified, and that composing it through the EDCP transformations at relevant parameters is further work nobody has published. That is the honest position. A DCP result and a deployed ML-KEM key are separated by transformations that someone has to carry out and someone else has to check.
An algorithm that did the work shows how specific the obstructions become. Shi Bai, Hansraj Jangir, Elena Kirshanova, Tran Ngo and William Youmans published A Quasi-polynomial Time Algorithm for the Extrapolated Dihedral Coset Problem over Power-of-Two Moduli on 4 June 2025, presented at CRYPTO 2025 — a peer-reviewed EDCP result, unrelated to Simon's. Two conditions in its own title and abstract keep it away from ML-KEM: it uses quasi-polynomially many EDCP samples, and it runs over power-of-two moduli, while ML-KEM uses q = 3329, a prime. The authors draw the boundary themselves, in the clearest sentence written about any of this: their algorithm “does not affect the security of LWE with standard parameters, as the reduction from standard LWE to EDCP limits the number of samples to be polynomial.”
That is an unglamorous kind of safety and it is worth naming for what it is. What protects deployed cryptography at this stage is the distance between an asymptotic statement and a concrete instance, and that distance is made of exactly this sort of arithmetic: how many samples the reduction can supply, and which modulus the algorithm needs. It is also the distance that closes first when a result is genuine, so the specific obstructions are what a reader should watch.
What shipped while this was unresolved, and the note Simon left on his own paper
None of the deployment work paused. JDK 27 reached its first release candidate with no outstanding critical defects and is scheduled for general availability on 15 September 2026, with JEP 527, Post-Quantum Hybrid Key Exchange for TLS 1.3, in the final feature set. That places lattice-based key agreement inside the standard library of one of the most widely deployed enterprise runtimes, a month after the no-go was posted. Executive Order 14412, signed on 22 June 2026, requires federal agencies to move high-value assets and high-impact systems to post-quantum key establishment by 31 December 2030 and to post-quantum digital signatures by 31 December 2031, with national security systems excluded — the signature deadline set a year after the key-establishment one. The key-establishment half of that runs on ML-KEM. The signature half has non-lattice options standardised alongside the lattice ones, hash-based schemes among them.
We wrote on 22 August about an attack estimate that moved by a factor of twenty and moved no deadline at all. This month brought the harder case. In the words of the note that answered it, such an algorithm “would imply a QPT algorithm for hard lattice problems” and would “undermine the security claims of proposed post-quantum lattice-based cryptosystems.” The deployment calendar did not move for that either, and this time it had twelve days of genuine uncertainty to sit through.
The most instructive artefact of the episode is one sentence Simon added to his own paper's archive entry. It reads: “A new preprint, https://eprint.iacr.org/2026/1693, has been posted claiming to prove that the algorithm in this paper can't possibly work. We're in the process of evaluating it.” The paper stayed up, with the challenge attached to it, under the author's name and his employer's. That is the same conduct the OPERA collaboration showed with a wrong neutrino number, and it is the reason both corrections were fast.
How Quentir Reads It
The part of this worth keeping is who did the checking. No standards body issued anything during those weeks. The correction was produced by three academics with a formal argument, hosted on an archive that costs nothing to read, and answered by an industry researcher who left his error visible while he worked through the rebuttal. For an institution deciding how much confidence to place in post-quantum standards, that mechanism is better evidence than any assurance a standards body could have issued, because it was tested in public and it held.
The operational conclusion sits in the calendar. Between 3 and 15 August, an organisation with a single-algorithm migration plan had no defensible position: it could neither verify the claim nor act on it. An organisation whose plan was written around the ability to change algorithms had no immediate algorithm-reversal or deployment decision to make, though monitoring, assurance and internal communication still had to happen. That difference is the entire practical content of crypto-agility, and August 2026 priced it. Our Signature Report, the PQC Migration Roadmap, is where that gets turned into a working plan: fixed scope, an executive summary, the phase structure, and refresh triggers tied to changes in instruments and deadlines. The running coverage, including this piece, stays free on Quentir Intelligence.
The episode has one open thread with a name on it. Simon said he is evaluating 2026/1693. ePrint 2026/1591 currently stands at four revisions. What version five says, and when it appears, is the next thing to watch.
Sources: Daniel R. Simon (Amazon Web Services), “A Polynomial-Time Quantum Algorithm for the Dihedral Coset Problem,” Cryptology ePrint Archive 2026/1591, received 3 August 2026, last revised 17 August 2026, four revisions (page read 2 September 2026) — the abstract's claims on modular subset sum, shortest-vector approximation and learning with errors at α = √n polylog(n), the absence of any named deployed parameter set, and the author's note on ePrint 2026/1693. Aparna Gupte (MIT), Seyoon Ragavan (Google, MIT) and Mark Zhandry (Google, Stanford), “The ePrint:2026/1591 Quantum Algorithm Does Not Solve DCP,” Cryptology ePrint Archive 2026/1693, received 15 August 2026, last revised 1 September 2026 (page read 2 September 2026) — the formal statement that the algorithm does not extract the least-significant bit of the DCP secret with non-negligible guessing advantage; the most-significant-third classical-Fourier-label argument; the quoted statements that the result is “not merely about Simon's analysis”, that the “no-go encompasses a much broader class of algorithms” following Regev's template, and that such an algorithm would “undermine the security claims of proposed post-quantum lattice-based cryptosystems”; the released Lean 4 code; and the 11 August 2026 version it addresses. Weiqiang Wen and Jinwei Zheng (Télécom Paris, Institut Polytechnique de Paris), “Module Learning With Errors and Structured Extrapolated Dihedral Cosets,” Cryptology ePrint Archive 2026/155, CRYPTO 2026, received 30 January 2026, last revised 16 July 2026 (page read 2 September 2026) — the quoted description of Module-LWE as the assumption underlying ML-KEM and ML-DSA, the Module-LWE to IP-M-EDCP equivalence and the IP-M-EDCP to EDCP reduction, and the power-of-two cyclotomic, constant-module-rank setting, and the open-problems statement that the Rényi-divergence method is “particularly suitable for the search variants but does not naturally extend to decision variants” and restricts the result to constant module rank. Shi Bai, Hansraj Jangir, Elena Kirshanova, Tran Ngo and William Youmans, “A Quasi-polynomial Time Algorithm for the Extrapolated Dihedral Coset Problem over Power-of-Two Moduli,” Cryptology ePrint Archive 2025/1046, CRYPTO 2025, received 4 June 2025 (page read 2 September 2026) — the quasi-polynomial sample count, the power-of-two modulus condition, and the authors' own statement that the algorithm does not affect the security of LWE with standard parameters. Published commentary on the Wen and Zheng chain, 6 August 2026 (page read 2 September 2026) — the statement that Simon's claim is unverified and that composing it through the EDCP transformations at relevant parameters is work nobody has published. That reading is that commentary's and is attributed to it in the body. Executive Order 14412, “Securing the Nation Against Advanced Cryptographic Attacks”, signed 22 June 2026 (page read 2 September 2026) — the 31 December 2030 key-establishment and 31 December 2031 digital- signature deadlines for high-value assets and high-impact systems, and the exclusion of national security systems. OpenJDK, JDK 27 project page and JEP 527, Post-Quantum Hybrid Key Exchange for TLS 1.3 (pages read 2 September 2026) — the 15 September 2026 general-availability date and the final feature set. NIST, FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard — the ML-KEM parameter setting. OPERA Collaboration, “Measurement of the neutrino velocity with the OPERA detector in the CNGS beam,” arXiv:1109.4897, first posted 22 September 2011, version 4 (page read 2 September 2026) — the 60-nanosecond initial figure, the 6.5 ± 7.4 nanosecond corrected figure, and publication in the Journal of High Energy Physics in 2012. Oded Regev, “Quantum Computation and Lattice Problems,” SIAM Journal on Computing, 2004 — the reduction from the unique shortest vector problem to the dihedral coset problem.
Published intelligence, built to inform your own decisions. Published: September 2, 2026.