The Limit of Error — The Distance of the Secret — IIIThe Limit of Error — The Distance of the Secret — III

No algorithm exists that physics cannot, given enough time, undo.

---

Kyber is secure today. It will be for years, probably decades. But it will not be secure forever. No cryptographic scheme ever has been.

The question — the uncomfortable one that engineers postpone and vendors avoid — is: when will it cease to be? And more importantly: does any definitive refuge exist?

Energy and Security

Cryptography is measured in bits of security. A 128-bit scheme theoretically requires $2^{128}$ operations to break by brute force. But that measure is computational, not physical. It ignores the constraints of the real universe.

Every operation costs energy. The Landauer limit states that erasing one bit of information requires at least $k_B T \ln 2$ joules, where $k_B$ is Boltzmann's constant and $T$ is temperature.

At room temperature:

$$E_{Landauer} = k_B \cdot 300\text{K} \cdot \ln 2 \approx 2.9 \times 10^{-21} \text{ J}$$

Even operating at the theoretical Landauer limit, breaking AES-128 would require:

$$E_{128} = 2^{128} \cdot 2.9 \times 10^{-21} \text{ J} \approx 9.9 \times 10^{17} \text{ J}$$

That is ~240 megatons of TNT. A lot of energy, but not impossible. If the computer operates at the temperature of the cosmic microwave background ($\sim 3\text{K}$), the energy per operation decreases and the total cost is reduced.

For Kyber-768, the best known classical attack requires > $2^{207}$ operations:

$$E_{Kyber} > 2^{207} \cdot 2.9 \times 10^{-21} \text{ J} \approx 5.9 \times 10^{41} \text{ J}$$

To put this in context: the Sun's total energy output per second is $\sim 3.8 \times 10^{26} \text{ J}$. Breaking Kyber-768 by classical brute force would require more energy than the Sun has emitted in the entire history of the universe.

But cryptography is not broken by brute force. It is broken by better attacks.

The Quantum Projection

For a quantum attack against LWE, we need a different metric. Not bits of security, but qubits and circuit depth.

The best known bound for a quantum attack against Module-LWE (using Regev's algorithm and later improvements) requires:

$$Q_{attack}(n, k) \approx O\left(n \cdot k \cdot \log q \cdot \text{poly}(\lambda)\right)$$

For Kyber-768 ($n=256, k=3, q=3329$):

One logical qubit requires ~1000 physical qubits (with current error correction codes). This gives:

$$Q_{physical} \approx 125000 \times 1000 = 125 \text{ million physical qubits}$$

Today (July 2026), the largest quantum computer has ~1500 physical qubits. At the current growth rate (Neven's law: quantum capacity doubles every ~2 years):

$$Q_{available}(t) = 1500 \cdot 2^{(t - 2026) / 2}$$

Solving:

$$125 \times 10^6 = 1500 \cdot 2^{(t - 2026) / 2}$$ $$\frac{125 \times 10^6}{1500} = 83333 = 2^{(t - 2026) / 2}$$ $$\log_2 83333 = 16.35 = (t - 2026) / 2$$ $$t \approx 2026 + 32.7 \approx 2059$$

~33 years. By 2059, if Neven's law holds, a quantum computer could have the physical qubits needed to attack Kyber-768.

But this assumes that:

1. A quantum algorithm for LWE exists requiring ~125K logical qubits (it is an optimistic lower bound).
2. Quantum error correction reaches that level of efficiency (it does not today).
3. Quantum coherence is maintained during operations of that depth (it is not today).
4. Neven's law holds for three decades (it is an extrapolation).

Each of these assumptions is optimistic. The actual date could be 2059, or 2080, or never, if LWE turns out to be quantum-hard.

The Entropic Analogy

The second law of thermodynamics states that the entropy of an isolated system never decreases. Cryptography is, in this sense, a fight against entropy: we try to keep distinguishable two probability distributions (the real and the random) that the attacker wants to confuse.

The analogy is precise:

$$\Delta S_{crypto} \approx -\log_2 P(break)$$

Where $P(break)$ is the probability that an attacker breaks the scheme. The lower the probability, the greater the "negative entropy" that cryptography must maintain. But maintaining that separation costs energy — in the form of computation time, bandwidth, larger keys.

Scheme        Negative entropy      Physical cost (bits)
──────        ─────────────────     ────────────────────
AES-128       128 bits              128 bits of key
RSA-2048      ~112 bits             2048 bits of key
Kyber-768     ~207 bits             1184 bits of pk + 2400 bits of sk
One-time pad  ∞ bits (perfect)      ∞ bits (key = message)

The one-time pad is the only scheme with provable security (Shannon, 1949), and it is impractical. Everything else — including Kyber — is an approximation that consumes resources to maintain the entropic separation long enough.

The Limit of Error

The LWE hardness conjecture says: "the error added to the equation $b = A \cdot s + e$ makes the system difficult to invert." But the cryptographic error must exceed the quantum error — the noise of qubits, the imprecision of gates, the decoherence.

The final battle, if it comes, will not be between algorithms. It will be between two scales of error: the mathematical error (LWE) that protects the secret, and the physical error (quantum noise, energy) that the attacker must overcome to compute.

$$\text{Security} = \min(\text{LWE error}, \text{implementation error}, \text{physical limit})$$

Of the three, the physical limit is the only absolute one. No matter how good the hardness conjecture is if the energy available in the universe is insufficient for the attack. But that limit — the total energy of the universe ~ $10^{69}$ J — is so enormous that only the most aggressive schemes (512 bits of security or more) reach it.

Kyber-1024 (~272 bits of security) is far from that limit. Kyber-768 (~207 bits) as well. The physical limit does not protect them. What protects them is the absence of an efficient algorithm.

And that absence is not a law of nature. It is a conjecture.

The Provisional Refuge

Frankl wrote that between stimulus and response there is a space, and in that space lies our freedom. In cryptography, the space is the distance of the secret: the time between the publication of a scheme and the attack that breaks it.

The distance of the secret is, for Kyber, unknown. No one knows if it will be broken in 2035, 2050, or 2100. No one knows if it will be broken by a quantum algorithm, an algebraic attack, or an implementation vulnerability that no one foresaw.

Intellectual honesty demands recognizing this: Kyber is secure today. It is the best option we have to protect communications against a quantum future. But it is a provisional refuge, not a definitive one.

Like all refuges in cryptography.

---

The series "The Distance of the Secret" has ended. The exploration of that distance — between conjecture and proof, between algorithm and code, between required energy and available energy — has no conclusion because the problem has no solution. The distance is measured, managed, postponed. It is not eliminated.

---

Cross-references with the research:

• Fundamentals of LWE — The hardness conjecture and the modulus q=3329
• Attacks — State of the art of quantum attacks against LWE
• Conclusions — What remains open
• Security Parameters — Equivalent strength and margins