Cardano Founder Charles Hoskinson Publicly Refutes Ethereum Co-Founder Vitalik's Risk Assessment on Lattice Cryptography

Cardano founder Charles Hoskinson publicly refuted Ethereum co-founder Vitalik Buterin's risk assessment on lattice cryptography, stating that he mischaracterizes lattice-based schemes as having hidden flaws based solely on analogies to the history of integer factorization, intuitive notions of "structure," and arbitrary key amplification factors. He also claimed that the other party has invested too deeply in hash cryptography research and is finding it difficult to withdraw.

Hoskinson pointed out that the number field sieve is not a universal smart algorithm, but rather a specific arithmetic involving smooth numbers, factor bases, and linear algebra to solve quadratic residues. He clarified that the general complexity of the number field sieve should be exp(O(n^(1/3)(log n)^(2/3))), and stated that the formula in the other party's post is incorrect. The number field sieve was completed in 1993, and since then, the RSA key length has not significantly increased due to new frameworks; he believes the lessons from the history of factorization indicate that usable structures have been exhausted.

He traced the sieve method for lattice cryptography back to the LLL algorithm in 1982, as well as BKZ and pruning enumeration. The cost of the sieve method was estimated at 2^0.415n in 2008 and at 2^0.292n in 2016. He noted that these results were immediately incorporated into parameters, and ML-KEM and ML-DSA were sized according to such attacks, with the cost model even offering memory for free to attackers while discarding polynomial factors. He limited quantum attacks on ideal lattices to rings and cyclotomic fields, claiming he has attacked real schemes but cannot target the small modulus lattice schemes ML-KEM and ML-DSA.

He also turned his criticism towards the hash route defended by the other party. Among the deployed hashes, MD5 and SHA-1 have been broken by differential analysis. Ethereum's hash-only route uses Poseidon and Poseidon2, both of which are low-degree polynomial mappings over small finite fields. The Ethereum Foundation has previously funded bounties for cryptanalysis of Poseidon. The proofs on the side, FRI, STIR, and WHIR, rely on unproven Reed-Solomon proximity gap conjectures under aggressive parameters. He referred to the "tenfold key amplification" as a numerological divination without a formula, stating that the cost of lattice attacks is of the form 2^(c·β), where a 20% improvement in constants roughly requires an increase in dimension of about 25%, not tenfold.

Hoskinson extended the other party's suggestions to off-chain systems. In a post on October 7, Vitalik Buterin described new risk areas as ML-DSA, fully homomorphic encryption, and lattices, stating that if artificial intelligence compresses fifty years of mathematics into two years, the specific security of lattices could be severely compromised. He suggested using hashes wherever possible, adopting more conservative lattice parameters, sending privacy notes through third-party off-chain channels, and keeping funds in addresses that have never made transactions. Hoskinson stated that browsers and communication tools have already deployed hybrid ML-KEM to counteract the threat of preemptive theft followed by decryption. He questioned the only existing post-quantum key encapsulation that might increase dimensions to the point of handshake failure, which would leave traffic lingering longer on classical cryptography.

This debate directly affects research budgets and migration orders, not the cryptocurrency prices themselves. Buyers include those who have already integrated hybrid ML-KEM into browsers, VPNs, Tor, and communication software, as well as companies procuring lattice schemes based on NIST parameters. The pressure on sellers falls on engineering teams being asked to abandon lattices in favor of WOTS and SPHINCS-. The event is driven by the threat model of artificial intelligence accelerating mathematics, not by publicly disclosed vulnerabilities. Hash signatures and Ethereum's streamlined route benefit from cautious narratives. Lattice scheme implementers and those already online with hybrid post-quantum handshakes are under pressure. If migration is delayed, the immediate beneficiaries will be those still using classical key exchanges for eavesdropping.

Source: Public Information