AlgoNumbers

You thought this was a bad week in crypto? You might have missed the bigger news. Two results just landed on elliptic-curve cryptography. Both are worrying. Neither one breaks a key anyone uses today. 1️⃣ The problem under ECC is less hard than we thought. ECC is secure because the elliptic-curve discrete log is hard. The best general algorithm we had was Pollard's rho, and it is exponential: add bits to the key, and breaking it gets exponentially harder. That assumption is now false, with one caveat. A paper from Bochum and MPI-SP gives a subexponential algorithm. It assumes an OpenAI claim that is still under review. If the claim holds, the new algorithm is faster asymptotically. In practice it changes nothing. On secp256k1, P-256, or Ed25519, rho is still the best algorithm, and it still takes the age of the universe. The new one only pulls ahead on hypothetical curves of enormous size, and there the cost is even more absurd. github.com/bochum-crypto/sub… 2️⃣ The quantum circuit is getting cheaper. The computer is not here. We still have no quantum computer. The circuit that would run on one to break ECDSA keeps getting cheaper. ecdsa.fail is a public auto-research loop aimed at exactly that. Its current best is about 70% cheaper than the circuit Google reported, on logical qubits times Toffolis (0.91 billion against 2.99 billion). Google's circuit was already two to three times cheaper than the previous published one. Alice & Bob @Alice__Bob , a French Quantum Computing company, just estimated that breaking secp256k1, the Bitcoin curve, takes at most about 30,000 cat qubits and one hour. That figure assumes a machine nobody has built. We are still far from it. The machine being asked for keeps getting smaller. eprint.iacr.org/2026/2665 What a crazy time to be alive.