Cryptographer Matthew Green Has Released a New Tool to Measure the Human Effort Behind Public-Key Cryptanalysis

Renowned cryptographer and Johns Hopkins University professor Matthew Green has launched a new website designed to estimate the vast human labor and academic focus dedicated to breaking or evaluating different public-key cryptographic algorithms. The project, which utilizes advanced artificial intelligence models working under Green’s direct supervision and methodological oversight, attempts to quantify cryptanalytic effort by analyzing roughly sixteen thousand candidate academic papers spanning decades of security research.

The initiative, hosted on Green’s digital workspace at "bits of work," tackles a fundamental question that has long intrigued the cybersecurity and cryptographic communities: how much collective brainpower and research time have scientists poured into analyzing foundational cryptographic assumptions? By translating academic publication metrics into estimated "research-allocation years," the new tool offers a novel perspective on how the cryptography research community has allocated its intellectual capital over time.

According to the project’s abstract, the automated pipeline classified cryptanalytic work across several major cryptographic pillars, including the Elliptic Curve Discrete Logarithm Problem (ECDLP), structured lattices, plain lattices, syndrome decoding, and various comparative mathematical structures. To convert these mountains of literature into a measurable metric, the system utilized a person-level author map, transforming published papers into estimated person-years of dedicated research effort.

The underlying technology behind the analysis represents a fascinating intersection of modern artificial intelligence and academic research. The development pipeline, data analysis, and accompanying web page composition were executed by advanced AI models, specifically identifying Claude Fable 5.1 and Claude Opus 5.5 as the primary engines, with additional contributions from GPT-6 Astra. However, Green maintained strict control over the intellectual framework, setting the core research questions, making the crucial methodological decisions, and overseeing the entire workflow to ensure academic rigor.

Despite its innovative approach, the project’s creators and independent observers are quick to emphasize the inherent limitations and caveats associated with publication-based metrics. Because the study relies exclusively on published academic literature, any cryptanalytic work that remains unpublished is entirely invisible to the metric. This blind spot encompasses two significant categories of research: academic cryptanalysis that failed to yield a formal paper, and classified intelligence agency cryptanalysis conducted in strict secrecy by state actors.

Furthermore, publication counts and author maps can inherently overstate the actual time spent on specific problems due to varying degrees of individual productivity, collaborative overlap, and the reality that a single published paper may represent varying levels of actual, focused laboratory or theoretical effort. Nevertheless, security experts view the project as a vital first stab at establishing a quantitative metric for cryptanalytic attention, moving the industry past purely qualitative assessments of algorithm maturity.

One of the most revealing historical insights generated by the tool involves the shifting focus of the cryptographic research community over the years. According to the publication-based estimates, structured and plain lattices have only recently overtaken elliptic curves in cumulative research attention. This historical pivot reflects the broader cryptographic community’s ongoing migration toward post-quantum cryptography, where lattice-based systems are seen as essential buliques against the future threat of quantum computers capable of solving traditional elliptic curve problems. The project’s authors express this evolving historical landscape in terms of "inference budgets" calculated under stated productivity assumptions.

The release of the tool has already drawn attention across cybersecurity circles, igniting discussions about how the industry evaluates the safety and resilience of cryptographic standards. In cryptography, an algorithm is generally considered secure not necessarily because it has a mathematical proof of absolute invulnerability, but because brilliant minds have tried to break it for years and failed. By attempting to quantify those failed attempts and the hours spent trying, Green’s new metric provides a fascinating lens through which to view the collective confidence placed in modern digital security foundations.

As the cryptographic community continues to grapple with the looming transition to quantum-resistant standards, tools that map out where research capital has been deployed will likely become increasingly valuable. While the tool comes with clear caveats regarding unpublished intelligence work and the noisy nature of academic bibliometrics, it stands as a groundbreaking attempt to measure the invisible human labor that keeps modern digital communication secure.