AI Is Finding Crypto Flaws Far Faster Than Humans Can Update Standards

Cryptographer Matthew Green threw out a set of uncomfortable probability figures on Twitter: he believes there is a 1% chance we live in Minicrypt—that hypothetical world where public-key encryption is mathematically impossible; and another 15% chance that we will substantively lose confidence in existing public-key encryption algorithms.

This isn't the first time someone in cryptography circles has discussed the "worst case," but what Green is really getting at isn't the probabilities themselves—it's the speed gap between two things.

What 1% and 15% Actually Mean

Minicrypt is a thought experiment proposed by cryptographer Russell Impagliazzo. He divided the possible computational worlds into several categories, and Minicrypt is a world where one-way functions exist but public-key encryption is impossible. Nearly all of our secure communication today—TLS, digital signatures, message encryption—rests on the assumption that public-key encryption is feasible. If the real world were Minicrypt, these systems wouldn't be "temporarily insecure"; they would be theoretically impossible to build.

1% sounds small, but Green frames it as the probability that "we may need to rethink the entire cryptographic toolbox." The 15% figure is more direct: existing public-key algorithms (RSA, elliptic curves, etc.) could collectively fail due to some attack breakthrough, causing public and industry confidence in them to collapse.

In his 1995 paper "A Personal View of Average-Case Complexity," Russell Impagliazzo proposed the famous "Five Worlds" thought experiment to characterize the relationship between computational complexity assumptions and cryptographic possibilities. The five worlds are: Algorithmica (P=NP, cryptography impossible), Heuristica (NP-hard problems are hard only on average but easy in the worst case), Pessiland (NP-hard problems exist but one-way functions don't), Minicrypt (one-way functions exist but public-key encryption is impossible), and Cryptomania (public-key encryption is feasible). These five worlds form a hierarchical spectrum of possibility, and which layer the real world falls into remains unresolved to this day.

What makes Minicrypt so significant for cryptography is that it precisely draws a boundary: in Minicrypt, primitives based on one-way functions—symmetric encryption, pseudorandom number generators, message authentication codes—can still be constructed, but primitives based on trapdoor functions—public-key encryption, key exchange, digital signatures—are mathematically proven impossible. This means that if we were Minicrypt residents, all security infrastructure relying on asymmetric cryptography—from key exchange in HTTPS handshakes to software signature verification—would face a fundamental rebuilding requirement rather than a simple parameter upgrade. Impagliazzo's framework is cited repeatedly precisely because it transforms the vague question of "is public-key encryption possible" into a proposition that can be discussed precisely within complexity theory.

The Real Problem: AI Surprises Fast, Standards Update Slow

Green's core argument isn't about probability—it's about pace:

"The speed at which AI produces surprises and the speed at which humans replace standards (even with the best AI assistance) are simply not on the same order of magnitude. Only by preparing in advance can you recover from such surprises."

This points to a structural contradiction. AI systems are being used for mathematical conjecture exploration, code auditing, cryptanalysis assistance, and more—and one day it could suddenly deliver a result that catches everyone off guard. Meanwhile, the update cycle for cryptographic standards is measured in years—from discovering a vulnerability, proposing new schemes, academic review, to standards being published by bodies like NIST, to industry-wide deployment, it often takes five to ten years or even longer.

This mismatch in timescales means retroactive fixes are almost impossible to make in time. Once a problem is exposed and the standard-update process begins, the gap in between is enough to leave systems relying on those ciphers exposed to risk.

The process of developing cryptographic standards is a highly deliberate multi-stage engineering effort. Take NIST's post-quantum cryptography standardization as an example: from the open call for algorithms in 2016 to the official release of the first standards (FIPS 203/204/205) in 2024, it took about eight years. This process includes: public submission, multiple rounds of academic review and cryptanalysis, performance and security trade-offs, draft publication, public comment, final standard release, and then industry implementation, testing, deployment, and migration. Every step must undergo adversarial scrutiny by the global cryptographic community, because an undiscovered design flaw might only be exploited years after deployment.

This deliberateness isn't bureaucratic inertia—it's a fundamental requirement of cryptographic security: once a standard is deployed at scale, the cost of replacement is extremely high and the window is long. For this reason, a decade is a realistic estimate from academic discovery to society-wide migration. This is precisely the source of the "order-of-magnitude gap" Green refers to—AI might reveal a destructive result in days or even hours, while human response mechanisms operate on a timescale of years. Historically, from the public demonstration of SHA-1 collision attacks to the full deprecation of SHA-1 by mainstream browsers and CAs, it also took nearly a decade.

Only Prepared Organizations Can Recover

The advice Green offers is essentially prepare in advance: build the capability to respond to cryptographic emergencies into daily work, rather than scrambling after a crisis hits. This includes a clear inventory of existing cryptographic dependencies, continuous tracking of alternatives like post-quantum cryptography, and preserving flexibility in system design to swap out cryptographic primitives.

For product teams and infrastructure operators relying on public-key encryption, the value of this reminder isn't whether those specific 1% or 15% figures are accurate—it's acknowledging that the worst case deserves to be taken seriously. Green describes himself as the person who "isn't afraid to look foolish by putting the worst possibilities on the table," and cryptographic history has repeatedly shown that it's precisely these voices that drive the industry to change before things actually go wrong.

Cryptographic agility is the core engineering principle for responding to cryptographic emergencies. It refers to designing systems so that cryptographic algorithms are abstracted as replaceable components, enabling a switch without large-scale system rewrites when an algorithm is broken or a standard is updated. In practice, this means avoiding hardcoding specific algorithms in protocols, data formats, and hardware, and instead managing the selection of cryptographic primitives through negotiation mechanisms, algorithm identifiers, and versioned interfaces.

Post-quantum cryptography (PQC) migration is the litmus test for cryptographic agility. Algorithms standardized by NIST such as CRYSTALS-Kyber (key encapsulation) and CRYSTALS-Dilithium (digital signatures) differ significantly from RSA and elliptic curves in key sizes, computational overhead, and protocol interaction patterns—meaning that even if the algorithms themselves are secure, the way existing systems integrate them needs to be redesigned. Organizations lacking agility often need years of system reengineering when facing such migrations, and that is precisely the window-of-risk that Green warns about. Establishing a cryptographic asset inventory in advance, tracking the maturity of alternatives, and preserving switching capability in architecture are key means of shortening this cycle.

One-line Summary

Green warns that AI discovers cryptographic surprises far faster than standards can be updated—only advance preparation enables recovery.

Paragraph Summary

Cryptographer Matthew Green suggests there's a 1% chance we live in a Minicrypt world where public-key encryption is mathematically impossible, and a 15% chance we'll substantively lose confidence in existing public-key encryption algorithms. But what he really wants to emphasize isn't the probabilities themselves—it's the order-of-magnitude gap between how fast AI produces surprising discoveries and how fast humans can replace cryptographic standards. Cryptographic standards typically take five to ten years from vulnerability discovery to industry-wide deployment, while AI could deliver disruptive results in an extremely short time, making retroactive fixes nearly impossible to make in time. Green advises organizations to build capabilities for responding to cryptographic emergencies in advance, including inventorying cryptographic dependencies, tracking alternatives like post-quantum cryptography, and preserving flexibility in system design to swap out cryptographic primitives.