What is it about?
ML-KEM’s maths lets one public key be reshuffled into hundreds of valid-looking copies, seemingly free data for an attacker. We show each copy is just a rigid rotation of the same geometric puzzle, no easier to solve. Pooling them doesn’t help either. Published security estimates need no change.
Featured Image
Photo by Sasun Bughdaryan on Unsplash
Why is it important?
ML-KEM is the encryption standard being deployed worldwide to protect data against future quantum computers. Confidence in it rests entirely on estimates of how much computing power an attack would need — and those estimates assume no shortcut exists. The scheme’s underlying mathematics carries built-in symmetries that appeared to hand attackers hundreds of free samples, which would have forced the estimates down and the key sizes up. We prove the shortcut cannot work, and identify exactly what separates this case from related schemes it genuinely does break.
Perspectives
This started as an attempt to break something, not to reassure anyone. The Galois symmetry of ML-KEM’s ring is strikingly generous: it turns one public key into hundreds of equally valid ones, preserves the error distribution exactly, and costs an attacker nothing to compute. Extra samples normally make lattice attacks easier, so we expected to find at least a modest speed-up. What we found instead was that every rotated lattice is a rigid copy of the original same dimension, same volume, same short vector length, so the attack sees nothing new.
Narayan Ji Mishra
Indian Institute of Technology Delhi
Read the Original
This page is a summary of: Poster:The Galois Orbit Cannot Help the Primal Attack on Module-LWE, November 2026, ACM (Association for Computing Machinery),
DOI: 10.1145/3839338.3857268.
You can read the full text:
Contributors
The following have contributed to this page
