The Leviathan and the Seed — The Distance of the Secret — VThe Leviathan and the Seed — The Distance of the Secret — V

Security is a pact. But who writes the clauses?

---

Modern cryptography rests on a tacit pact: users trust that technical institutions — NIST, the research community, standards bodies — have correctly chosen the algorithms that will protect their secrets. But what happens when the pact is not between equals?

Hobbes described the Leviathan as the sovereign to whom individuals cede their power in exchange for collective security. In cryptography, the Leviathan has a name: NIST. The agency that, after eight years of public process, selected a single lattice-based key encapsulation scheme — Kyber — as standard FIPS 203.

This is not the first time NIST has decided a cryptographic standard. It did so with DES in 1977, with AES in 2001, with SHA-1, SHA-2, and SHA-3. But there is a fundamental difference: DES, AES, and SHA are symmetric or hash primitives — constructions whose hardness conjectures are not interrelated. Kyber represents the bet that one specific family of problems — LWE over lattices — is the correct foundation for global post-quantum asymmetric cryptography.

No other mathematical family has a FIPS standard for KEM. The entire ecosystem — TLS, Signal, iMessage, AWS KMS, Cloudflare — is building its post-quantum future on a single conjecture.

What Was Left Behind

NIST's process received 82 initial proposals. In the final round, Kyber was selected as the sole KEM. But there were qualitatively different alternatives, with independent mathematical foundations:

Classic McEliece is the most revealing case. Published in 1978 by Robert McEliece — one year after RSA — it has withstood 48 years of cryptanalysis without an efficient attack being found, not even a quantum one. Its security does not rest on a novel conjecture, but on a problem — linear code decoding — that has been known to be NP-complete since the 1970s. Its security credentials are, objectively, the strongest of any candidate.

But its ~1 MB keys make it impractical for most applications:

Classic McEliece

  Public key: 1,049,600 bytes (≈ 1 MB)
  Transmission time on 5G: ~8 ms
  Firmware storage: infeasible
  Use in TLS handshake: infeasible (the entire handshake fits in ~5 KB)

Kyber-768

  Public key: 1,184 bytes (≈ 1 KB)
  Transmission time on 5G: ~0.01 ms
  Firmware storage: trivial
  Use in TLS handshake: natural

Cryptography does not choose the most secure. It chooses secure enough that it works.

NTRU, published in 1996, predates Kyber by more than two decades. It too uses lattices, but with a different structure — the original NTRU cryptosystem, not LWE. It was a finalist but not selected; its techniques were partially absorbed into the evolution of Kyber's parameters (such as changing the modulus q to 3329, inspired by NTRU's design).

HQC, selected in round 4 of the NIST process (2024) as a backup scheme, is based on codes, not lattices. If LWE is broken, HQC still stands. But HQC is not yet a FIPS standard — it is in process — and its adoption is marginal compared to Kyber.

The Monoculture

The risk of centralization is not theoretical. If within 20 years an attack against LWE is discovered — quantum or classical — the global dependence on Kyber means everything falls simultaneously:

  Attack against Module-LWE / LWE
  │
  ├─► ML-KEM-512    →    broken
  ├─► ML-KEM-768    →    broken (with more resources)
  ├─► ML-KEM-1024   →    broken (with many resources)
  ├─► ML-DSA        →    broken (same family, same foundation)
  │
  └─► Every scheme based on LWE lattices  →  broken
      (Kyber, Dilithium, NewHope, etc.)

It is not a likely scenario. But it is possible. And the history of cryptography — MD5 (1991→2004), SHA-1 (1995→2017), RC4 (1987→2015), Dual_EC_DRBG (2006→2013) — is full of schemes that were secure until they were not.

  The monoculture question:

  If we plant a single crop (LWE lattices) across the entire world
  and a plague arrives (attack against LWE), what do we eat?

Diversification has a cost: complexity, interoperability, performance. It is not obvious that the industry should implement two KEMs simultaneously. But it is obvious that it should be able to do so if necessary. And today, the global post-quantum infrastructure is built on a single mathematical foundation.

Trust and Institutions

In 2013, the Snowden revelations showed that the NSA had influenced the selection of the pseudorandom generator Dual_EC_DRBG as a NIST standard, with the well-founded suspicion that it contained a backdoor. The scandal shook trust in the standardization process. NIST responded with transparency: the PQC process was public, open, documented, with open meetings, public comments, and international peer review.

But transparency does not eliminate centralization. The Leviathan can be benevolent, informed, technically impeccable — it is still the Leviathan. The decision to bet on lattices was reasonable, perhaps correct. But it concentrates the risk of global post-quantum security in a single mathematical family.

Trust in the NIST PQC process:

  In favor:                         Against:
  • 8 years of public analysis      • Lattice monoculture
  • 82 proposals evaluated           • Classic McEliece discarded due to
  • Open and documented                  size, not security
    process                          • No alternative with the same
  • International participation          level of deployment
  • HQC as backup (round 4)          • Institutional trust is a
  • Staged migration until               requirement, not a luxury
    2035

The Seed

In cryptography, the seed is the random value from which everything else is derived: keys, nonces, parameters. A compromised seed invalidates any derived security.

The analogy with the standardization process is tempting: the "seed" of post-quantum security is the decision to trust LWE. If that decision is correct, everything else works. If it is incorrect, nothing matters.

But the analogy has a limit: in cryptography we can generate multiple seeds. In standardization, diversity has costs that the market is not always willing to pay.

Hobbes wrote that the state of nature is the war of all against all. Post-quantum cryptography is, in a certain sense, an attempt to escape that state — to build an order where secrets can circulate without fear of future interception. But order requires a sovereign, and the sovereign requires trust.

The question that this series has raised from the beginning — "when can we say that something is secure?" — has no definitive answer. But it has a practical consequence: trust in Kyber is not a mathematical certainty. It is a collective decision, informed by available evidence and by the credibility of the institutions that support it.

It is not blind faith. It is a pact.

---

In VI: Knowing and Doing, we will close the cycle with what implementing Kyber in Dart teaches us: the distance between theoretical knowledge and practical action, and why cryptography demands both the paper and the code.

---

Cross-references with the research:

• Standardization — The NIST process, selection criteria, controversies
• Fundamentals of LWE — The hardness conjecture versus alternatives
• Attacks — The risk of a future attack against LWE
• Conclusions — Final synthesis of the series: indicators, not proofs