- The paper develops an integrated defense-in-depth framework showing that quantum computing threatens cryptographic algorithms while AI targets physical implementations through neural side-channel attacks, requiring simultaneous mitigation across security layers.
- The paper finds major deployment gaps: hybrid post-quantum key exchange reached 52% of client web traffic but only 3.7% of servers by mid-2025, while digital-signature migration remained near zero and no FIPS 140-3-validated PQ modules existed.
- The paper shows that classical protections weaken against neural attackers—first-order masking may provide only about a threefold trace increase—while blinding, threshold implementations, formal verification, crypto-agility, and early action against harvest-now-decrypt-later risks offer stronger strategic defenses.
Overview and scope
This review by Mothukuri and Parizi synthesizes the convergent threats that quantum computing and artificial intelligence pose to deployed cryptographic systems, and derives a defense-in-depth migration strategy from that synthesis. The paper's central analytical claim is that the two threat classes are orthogonal: quantum computing attacks the mathematical algorithm layer via Shor's algorithm, while AI—specifically neural networks—attacks the physical implementation layer via side-channel analysis. Because these vectors penetrate different layers of the security stack, no single countermeasure addresses both, and simultaneous mitigation across algorithm, implementation, protocol, hardware, and agility layers is mandatory rather than optional. The review is organized around four research questions covering threat characterization, deployment reality, implementation vulnerabilities of newly standardized post-quantum algorithms (PQC), and an integrated risk assessment framework.
The authors are explicit about scope and uncertainty. Quantum computing and AI are treated as threat motivators establishing migration urgency rather than as subjects of exhaustive technical survey, and the paper repeatedly concedes that quantum timeline estimates carry substantial uncertainty given two decades of field delays.
The dual-threat landscape
On the quantum side, the review assembles three independent lines of evidence. First, hardware progress: Google's Willow chip demonstrated below-threshold error correction with 105 superconducting qubits, validating exponential error suppression, though the authors note the gap between 105 physical qubits and the roughly one million estimated for RSA-2048 factorization spans four orders of magnitude. Complementary results on neutral atoms (6,100-qubit tweezer arrays), trapped-ion single-qubit gate errors of 1.5×10−7, and two-qubit fidelities exceeding 99.99% indicate the path to fault tolerance is not contingent on one platform. Second, algorithmic progress: resource estimates for RSA-2048 factorization dropped 95%, from approximately 20 million to under 1 million physical qubits, under assumptions of 10−3 gate error rates and specific error-correction codes—an assumption dependence the paper flags plainly. Third, expert consensus: the Global Risk Institute's 2024 survey of 47 experts assigns a 34% probability of cryptographically relevant quantum computers (CRQC) by 2034, double the 2022 estimate of 17%.
On the AI side, the paper's most distinctive contribution is documenting a three-way capability split:
- Neural networks excel at side-channel analysis, achieving single-trace AES key recovery against protected implementations [1906.xxxx-class results cited via Kim et al.], cross-device accuracy above 99.9% with roughly 10× lower minimum traces to disclosure than correlation power analysis, electromagnetic key extraction at 25 meters in laboratory conditions, and single-trace attacks on CRYSTALS-Kyber key generation published at TCHES 2025.
- LLMs fail completely at algorithm-level cryptanalysis: every tested model achieved exactly 0% success on properly implemented modern encryption (AES, RSA, ECC) in the CipherBank benchmark of 18 models over 2,358 problems; even the best model (Claude 3.5 Sonnet) reached only 45.14% overall.
- LLMs show partial effectiveness at identifying implementation-level code vulnerabilities, with CryptoScope improving over baselines by 11–29% and finding nine previously undisclosed flaws in open-source cryptographic projects, though unaugmented LLM use produces false positive rates above 50%.
The paper grounds the LLM failure mechanistically rather than treating it as temporary: causal intervention studies classify 91% of arithmetically important neurons as implementing memorized "bags of heuristics"; GSM-Symbolic shows 12–15% performance variance across mathematically equivalent problems; communication complexity arguments prove transformers cannot compose functions over large domains; and the "flat loss landscape" observation notes that almost-correct decryption is indistinguishable from random output, providing no gradient signal. The implication is that this failure reflects architectural constraints, not insufficient scale—a claim the paper states boldly but which remains contingent on current architectures.
A critical quantitative finding for defenders is the countermeasure asymmetry: first-order masking increases required traces by d! against classical statistical attacks but only about 3× against neural network attackers. Shuffling and noise injection fare worse against learned models. Only blinding and threshold implementations retain high effectiveness against both attack classes. This means existing hardening frameworks designed for classical DPA profiles transfer poorly to the AI-enhanced threat environment.
Harvest now, decrypt later
The HNDL threat model decouples vulnerability from exploitation capability across harvest, storage, and decrypt phases, creating present-tense exposure regardless of when CRQC arrives. The review cites documented BGP incidents—the 2020 Rostelecom announcement of 8,000+ US technology prefixes and the 2019 Safe Host leak routing 70,000+ routes through China Telecom—as evidence that the interception prerequisite is demonstrably satisfiable, while acknowledging these may be configuration errors rather than deliberate collection. Joint CISA/NSA/NIST guidance treats HNDL as an active concern. The Federal Reserve's analysis adds that blockchain systems create permanent public records vulnerable retroactively even after future migrations. Mosca's inequality (X+Y>Z) formalizes the resulting urgency: healthcare (X+Y≥60 years), government, and energy operators satisfy it under nearly all timeline estimates.
Standards, deployment, and implementation security
NIST finalized ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205) in August 2024. The review emphasizes that SIKE and Rainbow were broken during evaluation, demonstrating that absence of known attacks differs from proof of hardness—and that module lattices, the structured variant underlying ML-KEM and ML-DSA, might harbor vulnerabilities absent in unstructured lattices, though current cryptanalysis reveals none. SLH-DSA offers conservative hash-based security at the cost of 17–50 KB signatures.
Deployment metrics reveal stark asymmetries as of mid-2025:
| Metric |
Value |
| Client-side hybrid PQ key exchange (web traffic) |
52% |
| Server-side hybrid PQ support |
3.7% |
| Digital signature migration |
~0% |
| FIPS 140-3 validated PQ modules |
0 |
| Organizations at crypto-agility Level 3+ |
15% |
The 14× client/server gap shows browser defaults drive adoption where unilateral updates are possible, while server operators, PKI hierarchies, and hardware lifecycles (HSM replacement cycles of 10–20 years; 12–18 month FIPS validation queues) dominate remaining timelines. Near-zero signature migration is particularly consequential because signatures protect firmware, code integrity, and certificate chains—all retroactive forgery targets.
Implementation security receives dedicated treatment: lattice algorithms leak through rejection sampling, polynomial multiplication, and Gaussian sampling; an ML-DSA signing vulnerability permits a 20% attack improvement from single-bit randomness leakage; and performance spans two orders of magnitude across platforms (ML-KEM-768: 150 ops/s on ARM Cortex-A53 vs. 85,000 on i7-12700K), with 2–5× memory growth and 15–50% energy increases constraining embedded deployments.
Supporting infrastructure and adjacent technologies
The literature review covers QKD (China's 10,103 km CN-QCN network with trusted-node limitations every 50–150 km; per-node costs of $50,000–500,000 making PQC economically favorable in most contexts), homomorphic encryption (CKKS/BGV/BFV share Module-LWE foundations with ML-KEM; Orion achieves encrypted inference at 100–1000× overhead), QRNG (relevant because ML-DSA security proofs assume true randomness), hybrid protocols (X25519+ML-KEM-768 in TLS 1.3, Signal's PQXDH, Apple's PQ3, OpenSSH sntrup761x25519), post-quantum PKI (a 33× certificate overhead expansion from ECDSA-P256 to ML-DSA-65 threatening congestion windows), blockchain exposure (an estimated 25% of bitcoins in public-key-exposed addresses; DeFi TVL above $100 billion in immutable contracts), and testing/interoperability gaps documented in cross-vendor TLS studies.
Limitations and open questions
The paper is candid about several constraints. Quantum resource estimates depend on specific error-rate and code assumptions; expert forecasts have historically underestimated delays; BGP incident evidence for HNDL is circumstantial; neural side-channel results derive from controlled laboratory conditions on specific implementations; and the claim that LLM cryptanalytic failure is architecturally fundamental rests on current transformer designs. Four research gaps are identified as critical: hybrid quantum-classical adversary models (no existing security proof covers adversaries combining both paradigms); lower bounds on trace requirements for neural key recovery, which determine whether countermeasures or physical isolation is the long-term defense; formal verification methods for side-channel freedom in lattice implementations; and standardized cryptographic agility frameworks.
Conclusion
This review's principal contribution is integrative: it demonstrates quantitatively that quantum and AI threats target orthogonal layers, that classical side-channel countermeasures degrade sharply against neural attackers, and that deployment progress is dangerously asymmetric between key exchange (partially migrated) and signatures (essentially unmigrated). Its four-dimensional risk framework—exposure window, implementation attack surface, regulatory pressure, and agility maturity—translates Mosca's inequality into sector-specific prioritization. The paper leaves open whether countermeasure-based defense can remain viable against scaling neural attackers and whether defenses validated against each threat class individually compose securely under combined adversaries; resolving these questions is prerequisite to confident large-scale post-quantum deployment.