The Conjecture and the Contract — The Distance of the Secret — IThe Conjecture and the Contract — The Distance of the Secret — I

We call secure what we do not yet know how to break.

---

There is a question that cryptography does not answer well: when can we say that something is secure? I do not mean practical security — keys of sufficient length, parameters that make an attack cost more than any available resource — but fundamental security, the kind that promises to resist not only today's attacks but tomorrow's.

Kyber, the post-quantum standard that NIST selected in 2024, is secure by every known analysis. But that security rests on a conjecture: that the Learning With Errors (LWE) problem over polynomial modules has no efficient solution, neither classical nor quantum.

There is no proof. There is no demonstration. There is a contract.

The Structure of the Leap

Modern asymmetric cryptography rests on hardness conjectures. RSA relies on the difficulty of factoring large integers. ECDH relies on the discrete logarithm in elliptic curves. Kyber relies on LWE.

The difference is that RSA and ECC fall to a sufficiently large quantum computer — Shor's algorithm solves them in polynomial time — while LWE has no known Shor. But "no known Shor" is not the same as "unbreakable."

State of knowledge (July 2026):

  RSA-2048:    Shor breaks it with ~4099 logical qubits
  ECC P-256:   Shor breaks it with ~2330 logical qubits
  Kyber-768:   No subexponential quantum attack known

  Open question: does a quantum algorithm for LWE exist?
  Answer: unknown. It is a conjecture.

The conjecture is plausible: thirty years of analysis have found no efficient algorithm against LWE, not even with quantum help. But the history of cryptography is full of conjectures that were plausible until they were not.

The Social Contract of Security

Rousseau wrote that society is founded on a contract: individuals give up part of their freedom in exchange for collective security. Cryptography works the same way. Every time we use Kyber — or RSA, or ECC — we are signing a tacit contract:

We accept that the security of this scheme is sufficient for the foreseeable present, and we trust that the cryptographic community will alert us if the conjecture ceases to hold.

It is not a promise of eternal security. It is a pact of transparency: as long as the scheme withstands public scrutiny, we consider it secure. When someone finds an attack, we migrate.

# The cryptographic contract, informally expressed
def is_secure(scheme, time):
    known_attacks = cryptanalysis(scheme)
    if not known_attacks:
        return True  # for now
    else:
        return all(a.cost > AVAILABLE_RESOURCES for a in known_attacks)

The variable AVAILABLE_RESOURCES changes over time. Not only because of technological progress but also because of the emergence of new computational paradigms.

The Problem of Induction

Hume pointed out that we cannot logically justify induction: assuming the sun will rise tomorrow because it has risen every previous day is a belief, not a demonstrable truth. Cryptography suffers from the same problem.

That LWE has resisted thirty years of analysis does not guarantee it will resist thirty more. That no known quantum algorithm solves LWE does not guarantee that one does not exist. Post-quantum cryptography is, in this sense, an exercise in applied induction: we assume the future will resemble the past.

$$P(\text{secure at } t+n) \propto \frac{\text{years of analysis without break}}{\text{structural complexity of the problem}}$$

It is not a rigorous formula — it cannot be — but it describes the implicit criterion we use to trust a scheme. Classic McEliece, with ~40 years of analysis and a more conservative structure (Goppa codes), would have a higher value than Kyber, with ~20 years and a more novel structure. But Classic McEliece has ~1 MB keys, and that makes it impractical for almost everything.

Security is not only mathematical. It is also logistical.

What Does "Secure" Mean Then?

In Kyber's domain, "secure" means:

1. Resistance to known attacks: no practical published attack breaks the recommended parameters.
2. Security margins: the parameters are chosen with a safety factor that comfortably exceeds what is needed against the best known attacks.
3. Continuous analysis: the cryptographic community has examined the scheme since 2017 and has found no fundamental weaknesses.
4. Multiple implementations: independent implementations exist (C, Go, Rust, Python) that cross-verify each other.
5. Early adoption: the scrutiny that comes with mass deployment (Chrome, Cloudflare, Signal) is the most demanding form of audit.

None of these criteria is a proof. They are indicators. Trust in Kyber is reasonable — more reasonable than trust in RSA/ECC in the long term — but it remains trust, not certainty.

---

In II: The Layer That Fails, we will explore the abyss between the algorithm and its implementation: how a mathematically sound scheme can collapse due to an error in Dart code, a non-constant-time variable, or a compiler that optimizes where it should not.

---

Cross-references with the research:

• Fundamentals of LWE — The LWE hardness conjecture in technical detail
• Known Attacks — State of the art of cryptanalysis against Kyber
• Standardization — The NIST process and controversies over trust in lattices
• Conclusions — Integrated analysis on the provisional nature of security