Post-Quantum Saturday — August 15 2026 Weekly Update

TL;DR — This Week

1. Daniel Simon claims a polynomial-time quantum algorithm for the Dihedral Coset Problem (ePrint 2026/1591, August 6). Simon — creator of Simon's algorithm, the 1994 result that enabled Shor's breakthrough, now at AWS Cryptography — has posted a preliminary draft claiming a poly-time quantum solver for the DCP, replacing the subset-sum bottleneck in Regev's 2004 lattice reduction. If it survives review and composes, it is the most credible theoretical challenge to lattice cryptography in two decades. It has not been peer-reviewed, load-bearing proofs are sketches, and the final SVP/LWE corollary rests on unpublished personal communications (Ragavan, Micciancio). No attack on ML-KEM, ML-DSA, or any concrete parameter set is presented. Nobody credible is recommending pausing ML-KEM rollouts. Everyone credible is recalculating confidence intervals.

2. A peer-reviewed CRYPTO 2026 paper closes the Module-LWE gap that Simon's claim needs. Wen and Zheng (Télécom Paris, ePrint 2026/155) prove a quantum polynomial-time equivalence between Module-LWE and a structured variant of the Extrapolated Dihedral Coset Problem (IP-M-EDCP), plus a reduction from IP-M-EDCP to plain EDCP — for power-of-two cyclotomic rings with constant module rank, which is precisely ML-KEM's parameter regime (ℤ_q[x]/(x²⁵⁶+1), module rank 2/3/4). The chain is now: Module-LWE ↔ IP-M-EDCP → EDCP → DCP → Simon's algorithm. Before this paper, connecting "DCP is broken" to "ML-KEM is threatened" required hand-waving across the module gap. No more. The composition at ML-KEM's concrete parameters remains unproven — but the research line is now aimed directly at the deployed standard, and the authors explicitly invite cryptanalysts to attack IP-M-EDCP ("it seems interesting to ask whether there exists an algorithm that solves IP-M-EDCP asymptotically faster than EDCP").

3. The IETF Last Call on pure ML-KEM for TLS closed August 13 — with a final avalanche of opposition. The last 72 hours of the comment window produced six Bernstein messages, a downgrade/negotiation-policy thread (Langston, Dukhovni, Liusvaara), late comments from Sophie Schmieg (Google) and Muhammad Usama Sardar, and formal Secdir (Melnikov) and Genart (Bryant) reviews. Bernstein's closing argument cites Paul Romer's estimate: draft-ietf-tls-mlkem saves ~2.9 nanodollars per connection for a security cost of at least 270,000 nanodollars per connection. The IESG decision is expected "in the next few weeks." If approved, expect appeals; if rejected, expect an appeal from the proponents. This saga is not over.

4. CRYPTO 2026 proceedings published (August 17–20, Santa Barbara; Heninger & Rosulek chairs): 189 full papers from 781 submissions across 10 LNCS volumes. The Wen-Zheng equivalence is in it. Combined with Simon's unverified preprint and Bai et al.'s CRYPTO 2025 quasi-polynomial EDCP algorithm, the dihedral-coset attack line is now the single most active front in quantum lattice cryptanalysis. AM-PQC 2026 (Ohrid, Aug 10–14) concluded this week; watch for its working-group outputs.

5. Merkle Tree Certificates gained their first external CA. TrustAsia (Shanghai; Chrome-qualified CT log operator since 2021) filed the first third-party application to Chrome's MTC test root program (Chromium Issue 538260165, reported August 4) — implementing RFC 9925 unsigned cosigner certificates and the critical MTCCertificationAuthority extension from the IETF PLANTS draft. MTC has moved from Google–Cloudflare experiment to a system independent CAs are building against. Chrome Phase 2 (Q1 2027), Let's Encrypt staging (late 2026), CQRS root store (Q3 2027).

6. The execution gap, quantified twice in one week. DigiCert's 2026 Quantum Readiness Outlook (1,001 orgs, US/UK/AU): 87% pursuing PQC, only 7% have deployed quantum-safe certs at scale — up less than 2 points in a year. The #1 barrier is legacy system complexity (26%), not awareness. HKMA's Quantum Preparedness Index scored Hong Kong's banks 2.3/10 (Pilots: 1.8/10) against a 10-by-2030 target — while banks' own estimated implementation time is 5.6 years, which exceeds the time remaining. The migration problem has changed character: from persuasion to execution, and execution is losing.

7. qLDPC "mitten codes" compress quantum error-correction overhead (arXiv:2607.28795, Caltech/Oratomic, July 30). 195 logical qubits in 975 data qubits (20% encoding rate, vs ~8% for IBM's gross codes), built from non-abelian group algebras; at 0.4% physical error the 975,195,≤24 block beat a 112,320-qubit surface-code stack by ~2 orders of magnitude in logical error rate. Full processor with magic states: 22,815 total qubits. Not a CRQC timeline change by itself — but it widens the uncertainty band on long-term resource estimates, and several authors are the same team behind March's "Shor's algorithm with 10,000 reconfigurable atomic qubits" analysis.

Freedom-tech implication: nothing deployed is broken, and the correct deployment posture is unchanged — hybrid X25519MLKEM768 for transport, hybrid Ed25519+ML-DSA for long-lived signatures, SLH-DSA as the conservative backbone, crypto-agility as architecture. What changed this week is the shape of the tail risk: the dihedral-coset research line is no longer pointed at "lattices in general" — it is pointed at Module-LWE over ML-KEM's exact ring family, by a chain of published reductions, with a claimed poly-time solver at the end awaiting verification. Any freedom-tech stack whose entire cryptographic estate is lattice-only (ML-KEM + ML-DSA and nothing else) now has a nameable concentration risk. Diversify (HQC when standardized, SLH-DSA now) and build for replacement.

The Week in Detail

1. Simon's DCP Claim — The Most Credible Lattice Challenge in Two Decades

Paper: Daniel R. Simon (AWS Cryptography Group), "preliminary draft," IACR ePrint 2026/1591, posted ~August 6, 2026.

Who and what

Daniel Simon is not a random preprint author. His 1994 fault-tolerant quantum algorithm (Simon's problem) was the direct precursor that Shor built on; he has spent three decades in quantum computing and cryptography. When this person claims a quantum algorithm for the Dihedral Coset Problem, the community reads it before breakfast.

The twenty-year context

The DCP has been the center of quantum lattice cryptanalysis since Regev 2004, which gave a polynomial-time quantum reduction from approximate unique-SVP (and related lattice problems) to the DCP — conditional on an efficient coherent solver for average-case modular subset-sum. No such solver was known, so for twenty years the best quantum attack on the dihedral problem remained Kuperberg's 2005 subexponential algorithm (2^O(√n)). For polynomial-factor approximate SVP, nothing — classical BKZ or quantum — beat fully exponential time. Quantum computing offered lattice attackers nothing worth having. That was the load-bearing assumption under ML-KEM, ML-DSA, FN-DSA, and the entire NIST lattice portfolio.

What Simon claims

A technique that replaces the subset-sum procedure: Hadamard transforms plus a grouping strategy that erases sample bits while tolerating a faulty-sample rate up to 1/O(log n). Composed with Regev (2004) and Brakerski–Kirshanova–Stehlé–Wen (2018, the LWE↔EDCP tightening), Simon claims polynomial-time quantum algorithms for approximate lattice problems and LWE.

Subexponential → polynomial is a qualitative change, not incremental. It is the difference between "quantum computers don't help against lattices" and "quantum computers solve lattice problems efficiently, given the hardware."

Why it is not yet time to panic

The community precedent matters: the 2024 Seoul National University episode (and the Luo preprint covered in the August 08 update) showed that plausible-looking quantum lattice attacks fail under expert scrutiny more often than they survive. But it also showed the verification process works. Expect assessments from Micciancio, Peikert, Regev, and Ducas to circulate over the coming weeks — likely at and after CRYPTO 2026.

Sources: ePrint 2026/1591 (eprint.iacr.org/2026/1591); PostQuantum.com analysis (Ivezic, August 6, 2026); Regev, FOCS 2004; Brakerski, Kirshanova, Stehlé, Wen, EUROCRYPT 2018; Kuperberg, 2005.

2. Wen–Zheng (CRYPTO 2026): Module-LWE ↔ Structured EDCP — The Bridge to ML-KEM

Paper: Weiqiang Wen, Jinwei Zheng (Télécom Paris), "Module Learning With Errors and Structured Extrapolated Dihedral Cosets," ePrint 2026/155 — full revision of a paper accepted to CRYPTO 2026 (peer-reviewed; in the published proceedings).

The result

Two theorems plus a sample-amplification step:

1. Theorem 1 (equivalence): For f(x) = x^d + 1 with d a power of two, a quantum polynomial-time equivalence between Module-LWE and Gaussian IP-M-EDCP (Integer Polynomial Module Extrapolated Dihedral Coset Problem), with module rank n = O(1), modulus q = poly(d).
2. Theorem 2 (reduction): IP-M-EDCP reduces in quantum polynomial time to plain EDCP, with a dimension-modulus switching step that collapses the exponentially large modulus down to polynomial q.
3. Sample amplification: the equivalence needs poly(κ) samples but the reduction produces O(log κ); the gap is closed via the Lyubashevsky–Peikert–Reggev Regularity Lemma — which is why the result requires cyclotomic rings specifically.

The chain the paper completes:

Module-LWE  ↔  IP-M-EDCP  →  EDCP  →  DCP  →  [Simon's claimed solver]

Why the ring family matters

f(x) = x²⁵⁶ + 1 over ℤ_q with constant module rank is ML-KEM's exact setting: ML-KEM-512 = rank 2, ML-KEM-768 = rank 3, ML-KEM-1024 = rank 4, all over ℤ_3329[x]/(x²⁵⁶+1). The authors themselves flag the setting as "of particular relevance in cryptographic applications." Before this paper, Simon's plain-LWE consequences did not automatically reach Module-LWE; the module step was the hand-wave. It is now published mathematics — though composition at ML-KEM's concrete parameters, noise distribution (centered binomial, not Gaussian), sample budget, and decision formulation remains undemonstrated.

The open-problem invitation

The equivalence is with search Module-LWE; the Rényi-divergence technique "does not naturally extend to decision variants" (the form ML-KEM's security proof uses). More striking: the converse of Theorem 2 is not established — IP-M-EDCP may be strictly easier than EDCP. The authors explicitly invite attacks: they name adapting Kuperberg's algorithms and adapting Bai et al.'s 2025 EDCP algorithm as the two promising directions. Their own summary of the pre-Simon state: "no subexponential-time quantum algorithm in n is known for solving EDCP with parameters enabling a reduction from LWE." That sentence is the load-bearing assumption under a great deal of deployed cryptography — and three research efforts (Chen 2024/withdrawn, Bai et al. 2025, Simon 2026/unverified) are now pushing on it, with Wen on both the 2018 and 2026 papers (same research program, not coincidence).

Exposure by algorithm family

Sources: ePrint 2026/155 (eprint.iacr.org/2026/155); PostQuantum.com analysis (Ivezic, August 6, 2026 — two articles, "CRYPTO 2026 Paper Links ML-KEM's Math to EDCP" and the Simon analysis); Bai, Jangir, Kirshanova, Ngo, Youmans, ePrint 2025/1046 (CRYPTO 2025); CRYPTO 2026 proceedings (Springer LNCS, 10.1007/978-3-032-35377-1).

3. Pure ML-KEM TLS Last Call Closes — The Final 72 Hours

The IETF-wide Last Call on draft-ietf-tls-mlkem-09 closed August 13, 2026. The closing days were a flood:

The Bernstein finale (Aug 11–12)

Six messages in two days, cross-posted to last-call, TLS, and IESG. Key threads:

• The nanodollars argument. Citing Paul Romer's quantitative estimate (solicited corrections; none materialized): the draft saves ~2.9 nanodollars per connection (dropping X25519 costs ~2 nanodollars at 2^47 cycles/dollar plus a few nanodollars of networking) for a security cost of "at least" 270,000 nanodollars per connection. Bernstein: "This makes draft-ietf-tls-mlkem look like a stunningly bad deal."
• The process complaint. Bernstein states the newer IESG Last Call "was triggered by the same false claim" as the WGLC, and that he had posted his WGLC-era replies online because "the TLS WG chairs were censoring the mailing list at that point" (his copyright-protest footnote was repeatedly moderated — a pattern freenode.net has documented, and which has since escalated into a formal RFC 2026 complaint in the parallel SSH signature fight).
• The ECC fallback case: "ECC reduces the damage from PQ security failures."

The downgrade-policy thread (Aug 12)

Mark C. Langston raised the named-group downgrade / negotiation policy issue; Viktor Dukhovni and Ilari Liusvaara engaged. The concern: once pure ML-KEM code points exist, misconfigured or hostile negotiation can downgrade hybrid-capable pairs to solo ML-KEM — the exact downgrade-attack surface Cloudflare warned about. This thread demonstrates the operational risk survives regardless of what the RFC text says about Recommended=N.

The rest of the closing window

• Sophie Schmieg (Google) — final comment Aug 12 (she has argued hybrid signatures are less critical than hybrid KEX; Bernstein's June paper dismantled that position).
• Muhammad Usama Sardar — two comments Aug 12 (formerly a blocker; had said -08 resolved his technical objections).
• David Benjamin (Google, draft author of both the MTC RFC 9925 and the ecdhe-mlkem hybrid draft) — comments Aug 11–12.
• Secdir review (Alexey Melnikov, Aug 12) and Genart review (Stewart Bryant, Aug 7) filed via Datatracker.
• Earlier window: Josefsson ("reject"), Paul Wouters, Russ Housley, Paul Hoffman, S Moonesamy, Thomas Bellebaum (July 30–Aug 1).

What happens next

The IESG said it plans a decision "in the next few weeks." Scenarios:

Freedom-tech position (unchanged): deploy hybrid X25519MLKEM768 (Standards Track, Recommended=Y, deployed by Chrome/Cloudflare/AWS/Apple). Treat pure ML-KEM code points as a CNSA 2.0 compliance profile. New this week: the downgrade-policy thread gives concrete operational weight to the recommendation — pin hybrid preference in configuration, monitor for solo-ML-KEM negotiation in your TLS estate, and treat any appearance of it as a misconfiguration signal.

Sources: IETF mailarchive last-call and TLS threads (Aug 7–13, 2026); freenode.net (July 21 & 31 analyses); PostQuantum.com (July 30); datatracker.ietf.org/doc/draft-ietf-tls-mlkem.

4. CRYPTO 2026 — The Venue Where This Gets Settled

The proceedings are published (Springer, 10 volumes, Heninger & Rosulek as editors): 189 full papers from 781 submissions — including Wen–Zheng, and a Springer-indexed result on hinted ISIS solvers that contradicts a Lombardi–Vaikuntanathan (CRYPTO'20) conjecture, "suggesting that hinted ISIS is hard." The conference itself runs August 17–20 in Santa Barbara — the single most likely venue for first expert reactions to Simon's preprint. AM-PQC 2026 (Algebraic Methods in PQC, Ohrid, Aug 10–14) concluded this week; its scope (multivariate, code-based, isogeny, working groups) complements the lattice focus.

What to watch for next week: hallway-track verdicts on Simon's Lemmas 3–4 (the pairwise-independence and amplitude-concentration machinery), any Micciancio/Peikert/Regev statement on the personal-communication corollaries, and whether anyone sketches the IP-M-EDCP + Kuperberg adaptation Wen–Zheng invited.

Sources: crypto.iacr.org/2026 (accepted papers, program); ACM DL proceedings; Springer LNCS; pqcrypto.cs.ru.nl/ampqc.

5. Merkle Tree Certificates — First External CA Files for Chrome's Test Root

The event: TrustAsia Technologies (Shanghai) filed what appears to be the first certificate-authority application to Chrome's MTC test root store — Chromium Issue 538260165, highlighted by PKI standards expert Corey Bonnell (early August 2026; PostQuantum.com analysis August 4).

Why it matters: three data points in five months — Google+Cloudflare experiment (spring) → Let's Encrypt commitment (June) → now an independent third-party CA implementing against draft-stage IETF specs. MTC is no longer a Google-dominated architecture; the PLANTS draft is provably implementable outside its originating collaboration.

What the filing implements: - RFC 9925 unsigned CA cosigner certificates (Feb 2026, David Benjamin): the MTC CA cosigns Merkle subtrees rather than signing individual certs; RFC 9925's placeholder signature algorithm lets X.509 represent this safely — legacy relying parties reject rather than mis-trust. - The critical MTCCertificationAuthority extension (PLANTS draft §5.5): marks the subject as an MTC-issuing CA, carries issuance-log hash algorithm, cosigner signature algorithm, and serial-number range. Critical marking = non-MTC X.509 stacks must reject, preventing transition-period confusion with conventional CAs.

Rollout state:

PLANTS draft (v03, April 2026; Benjamin/Google, O'Brien/Apple, Westerbaan & Valenta/Cloudflare, Valsorda/Geomys) still needs ~12–18 months to Proposed Standard — aligning with CQRS Q3 2027.

Freedom-tech angle: MTC is the rare PQ story that decentralizes rather than concentrates — it replaces per-certificate CA signatures (the trust chokepoint) with batched Merkle roots plus transparency logs, and every independent CA that implements it pushes toward an open standard rather than proprietary infrastructure. Update to Merkle Tree Certificates noted below.

Sources: PostQuantum.com (Ivezic, August 4, 2026); Chromium Issue 538260165; RFC 9925; datatracker.ietf.org/doc/draft-ietf-plants-merkle-tree-certs; Chrome Q2 2026 security update; security.googleblog.com (Feb 2026).

6. The Execution Gap — DigiCert and HKMA Put Numbers on It

DigiCert Quantum Readiness Outlook (July 23; 1,001 IT/security decision-makers, US/UK/AU, surveyed May 2026)

The barrier breakdown is the story: awareness and buy-in are solved problems (exec buy-in 8%, "don't know where to start" 3%); legacy complexity, performance, and budget are not. At the current deployment velocity (~2 points/year), enterprises reach ~15% certificate deployment by the time NIST IR 8547's deprecation window opens after 2030. Notable omission (from a CA): the Trust Now, Forge Later signature-forgery threat is absent — yet signatures are where orgs are furthest behind, and where EO 14412's 2031 deadline bites.

HKMA Quantum Preparedness Index (July 27; 56-page whitepaper, all Hong Kong AIs surveyed)

Aggregate PQC readiness: 2.3/10, target 10 by 2030. Sub-scores: Awareness 2.4, Planning 2.5, Pilots 1.8, Practical Preparedness 2.3; weakest sub-indices: Cryptography Migration Testing 1.8, Risk & Vulnerability Management 1.9, Monitoring 1.9, Training 1.9, Funding 2.0.

• 68% have basic awareness; 50% discussed at board level — but 68% have zero quantum initiatives, 71% never tested PQC, 45% no CBOM, 66% haven't assessed exposure.
• Barriers are vendor-dominated: 87% rank critical third-party dependencies as top-3; 85% cite absent vendor PQC roadmaps. Banks cannot migrate past their own perimeter — core banking, payment processors, HSMs, CAs, FMIs all sit outside it.
• The timeline killer, from Carmen Chu's own FiNETech8 speech: banks with existing transition plans estimate 5.6 years average implementation — exceeding the time remaining before 2030.
• Support measures: PQC toolkit with HKUST, training, FiNETech coordination forums; positioned inside existing TM-G-1/C-RAF/OR-2 supervisory frameworks.

Context: FINMA (Switzerland, July 2026) found 72% of 60 institutions had planned/implemented nothing quantum-safe, 8% had a roadmap. Hong Kong's banks are not uniquely unprepared — their regulator is uniquely transparent.

Freedom-tech relevance: the 87%-vendor-dependency finding maps directly onto decentralized infrastructure's thesis — systems whose trust roots you can operate yourself (MTC issuance logs you can run, Nostr keys you hold, Hybrid KEM Migration you control) are insulated from exactly the third-party boundary where institutional migration stalls.

Sources: DigiCert Quantum Readiness Outlook 2026 (digicert.com/.../quantum-readiness-outlook.pdf, July 23); HKMA whitepaper (hkma.gov.hk/.../20260727e3a1.pdf, July 27); FiNETech8 speech (Carmen Chu); PostQuantum.com analyses (Ivezic, July 23 & August 3).

7. qLDPC Mitten Codes — Error-Correction Overhead Remains Compressible

Paper: arXiv:2607.28795 (July 30, 2026) — Caltech (Bhardwaj, Ma, Meister) + Oratomic (King, Bluvstein, Cain, Xu); Preskill and Huang dual-affiliated. Code and tools: github.com/a7b/yarn (MIT license).

The headline: non-abelian group-algebra qLDPC codes ("mitten codes" — check matrices shaped like four fingers and a thumb) with a guaranteed 20% encoding rate: the 975, 195, ≤24 block encodes 195 logical qubits in 975 data qubits, vs ~8% for IBM's gross codes. At 0.4% physical error, it beat a 112,320-data-qubit stack of 195 surface-code patches by ~2 orders of magnitude in logical error rate (115× fewer data qubits; different decoders caveat applies).

The processing result: universal fault-tolerant Clifford processing from five reusable surgery gadgets (vs 38,415 for a generic k-logical-qubit code), a novel "telescoping decoder," parallel magic-state injection for all |G| logical qubits in Θ(d_rep) time. At 0.1% physical error: ~9.5×10⁻¹² block logical error/round (300,60,14); 15 billion simulated surgery quops on 540,108,18 with 2 logical errors — processing capacity of order 10 billion quops.

The caveats: the 5:1 ratio excludes ancillas, surgery overhead, and magic-state factories — the paper's own full-processor figure for 195 logical qubits is 22,815 total qubits (still ~10× better than surface codes). Distance of the largest block is estimated (≤24), not certified. Two concurrent independent papers (Hong; Zheng/Zheng/Jiang/Xu, both July 30) landed on the same non-abelian/structured lifted-product insight.

CRQC timeline meaning: none by itself — no hardware validation, no end-to-end cryptanalytic resource analysis, no justification for moving Q-Day estimates. What it does show: QEC overhead is still algorithmically compressible, widening the uncertainty band on long-term resource estimates. And the same team produced the March 2026 "Shor's algorithm is possible with as few as 10,000 reconfigurable atomic qubits" analysis — the pipeline from code theory to CRQC costing is shortening. Regulator-set deadlines (2030/2031/2035) do not consult this research calendar; that is precisely why they were set conservatively.

Sources: arXiv:2607.28795; PostQuantum.com analysis (Ivezic, August 3, 2026); github.com/a7b/yarn; concurrent arXiv:2607.27644, 2607.28605.

Evidence at a Glance

The Dihedral-Coset Threat Model — One-Page Summary

For quick reference, the full reduction chain as of this week:

            published, peer-reviewed                unverified (Simon 2026)
  ┌────────────────────────────────────┐   ┌─────────────────────────────┐
  ML-KEM / ML-DSA (Module-LWE)          │   │                             │
     ↕ Wen–Zheng (CRYPTO 2026)          │   │  claimed poly-time DCP      │
  IP-M-EDCP ──→ EDCP ──→ DCP ───────────┼──→│  quantum solver             │
     (BKSW 2018, Regev 2004 lineage)    │   │  (replaces subset-sum step) │
  └────────────────────────────────────┘   └─────────────────────────────┘

Unproven composition steps: decision-MLWE (ML-KEM's actual formulation) ↔ search-MLWE; centered-binomial noise ↔ Gaussian; ML-KEM's small sample budget ↔ poly(κ) samples; the personal-communication SVP/LWE parameter corollaries; any end-to-end costing.

Historical base rates: Chen 2024 (poly-time lattice claim via EDCP variant) — withdrawn in days after expert scrutiny. Luo 2026 — fatally flawed. Bai et al. 2025 — real algorithm, doesn't compose at standard parameters. Kuperberg 2005 — subexponential, unchanged for 20 years. The base rate says "wait for verification"; the author's identity says "verify fast."

Correct responses: (1) no deployment changes; (2) hybrid everywhere (already the recommendation for independent reasons — Bernstein's ML-DSA bug analysis); (3) name the concentration risk in your register: "entire estate = Module-LWE family"; (4) SLH-DSA in signature planning now, HQC tracked for 2027; (5) crypto-agility as architecture.