Matthew Green Puts 15% Odds on AI Eroding Trust in Public-Key Cryptography

Cryptographer Matthew Green has put out two numbers that people don't usually say out loud. By his estimate, the probability that we live in "Minicrypt" is 1%. He puts the probability that we functionally lose trust in existing public-key encryption algorithms at 15%. Simon Willison quoted his tweet on October 9, 2026. Green himself jokes that everyone else is preoccupied with respectability, so he will take on the role of the "crank with the worst-case scenarios."

What Is Minicrypt and Where Does the 1% Come From

The term comes from Russell Impagliazzo's classification, which describes five hypothetical "computational worlds." Minicrypt is a world where one-way functions exist but public-key encryption is impossible. Hashes, block ciphers and symmetric cryptography still work there. Key exchange over an open channel, digital signatures built on asymmetric math and a significant part of modern TLS do not.

Green's two estimates describe different events. The 1% concerns fundamental mathematics: asymmetric cryptography being impossible in principle. The 15% concerns practice: the specific algorithms that hold up the internet stop being trustworthy, for example because of an unexpected attack. The second scenario does not require proving a new theorem. One working attack is enough.

The Speed of Surprises vs. the Speed of Standards

Green's main argument is about time, not math. In his words, the speed at which AI produces surprises and the speed at which people replace standards differ by orders of magnitude, even with the best AI support. Recovery from such a surprise is possible only if preparation is done in advance.

History gives reason for skepticism. NIST's post-quantum competition started in 2016, and the first standards, FIPS 203, 204 and 205, came out in August 2024. That is about eight years for selection and standardization, before any mass deployment. The breaks are just as telling: in 2022, the SIKE candidate, which had reached the final round, was broken by a classical attack in about an hour on a single core of an ordinary processor. The Rainbow scheme was broken over a weekend on a laptop. People did this, without language models. If AI speeds up the search for such vulnerabilities, the window between "found" and "replaced" will stretch even further.

An important caveat: the quote does not point to any specific AI result that prompted Green's estimates. This is an expert judgment in a tweet, not a study. No method for calculating the percentages is given, and the numbers are best read as an expression of his level of concern.

Key Numbers

• 1%: the chance that we live in Minicrypt, by Green's estimate.
• 15%: the chance of a functional loss of trust in current public-key algorithms.
• ~8 years: from the start of the NIST competition (2016) to the first post-quantum standards (2024).
• ~1 hour: the time it took to break SIKE on a single core in 2022.
• Primary source: a tweet, with no published estimation method.

What Teams Should Do Right Now

The main practical takeaway from Green's logic is cryptographic agility. If swapping an algorithm requires rewriting a protocol, migration will drag on for years. The first step is an inventory: where your products and infrastructure use RSA, ECDH and ECDSA, and which certificates and keys stay in service for decades.

The second step is hybrid schemes, which combine classical key exchange with post-quantum key exchange. If one component is compromised, the other keeps protecting the traffic. The third is sorting data by how long it must stay confidential: anything that must remain secret for ten years or longer needs a replacement plan first. And the fourth is rollback drills: how long an emergency algorithm swap would actually take in your system, from shipping a patch to updating clients. Green asserts that recovery after a surprise is possible only if these answers are known in advance.