InvestIndependently confirmed2 publishers2 min readPublished
Hoskinson says Buterin's AI warning could pull developers off lattice cryptography
Charles Hoskinson said on Oct. 9 that Vitalik Buterin's AI warning could slow the lattice-based protections NIST standardized in 2024. Ethereum is the one project the sources show moving away from lattices, so the test is whether anyone else follows.
The Investor · Invest desk
42 years separate the 1982 LLL lattice reduction algorithm from the August 2024 NIST approval of ML-KEM and ML-DSA. The LLL algorithm was introduced in 1982. Of the three NIST standards named, two are lattice-based. Hoskinson's reply came two days after Drake's warning.
| Figure | Value | Note | Claim |
|---|---|---|---|
| LLL algorithm to NIST approval | 42 years | 19 | |
| LLL lattice reduction introduced | 1,982 year | 14 | |
| Lattice-based of 3 NIST standards | 2 standards | 18 | |
| Drake warning to Hoskinson reply | 2 days | 20 |
What happened
- Hoskinson wrote that "The factoring analogy is wrong," saying the gains against factoring depended on techniques that have not been demonstrated against the lattice problems in modern cryptography.
- He said more than four decades of work on lattice reduction and sieving have improved attacks step by step without a general breakthrough against properly configured systems.
- He dismissed Buterin's illustrative idea of multiplying key sizes by ten as "numerology" and argued that parameters must follow measurable improvements in attack algorithms.
- On the hash side, he cited historical weaknesses in MD5 and SHA-1 as evidence that hash functions can contain exploitable structure, a point cryptoslate notes does not extend to SHA-256.
Why it matters
- exposure Hoskinson argued that Poseidon and Poseidon2, hash functions relevant to Ethereum's longer-term research, face the same AI risk Buterin assigns to lattices, so the hash route carries its own open question.
- contradiction Hoskinson says Buterin has not identified a credible new attack, while Buterin's argument concerns shortcuts nobody has found yet. The two answer different questions, and no published result separates them.
- decision Teams picking a post-quantum signature can already choose a lattice standard or a hash-based one, so the dispute does not have to be settled before they act.
Hoskinson's case has a mathematical half and a behavioral half, and only the first is documented. "The case against lattices is the GNFS story, a.k.a. a hunch about 'structure,' and a multiplier pulled out of thin air," Hoskinson wrote [4]. The second half is his warning that encouraging developers to abandon established approaches could slow adoption of protections already being deployed across internet infrastructure [23]. Neither source reports a project that has slowed or dropped lattice work since Buterin spoke.
Hash-based signatures can authorize transactions in a quantum-resistant way, while lattice techniques also cover key encapsulation for encryption [7], and ML-KEM is the NIST standard that lets parties establish shared secrets [12]. The hash-based route Ethereum favors covers signatures and proofs [2]. Of the three NIST standards crypto.news names, FIPS 203 and 204 are lattice-based and FIPS 205 is hash-based, two to one [18]. We think a lattice retreat would cost the most in encryption and the least in signing, where a hash-based standard already exists. The counter-thesis is that a debate over Ethereum's research agenda never reaches the engineers shipping those protections, in which case the delay is nil.
The history Hoskinson leans on is long. The LLL lattice reduction algorithm dates to 1982 [14] and NIST approved ML-KEM and ML-DSA in August 2024 [10], so 42 years separate the two [19]. Buterin's counterargument, as cryptoslate describes it, is that AI could deliver decades of comparable mathematical progress in a much shorter period [22]. A 42-year record is evidence about the past rate of discovery, and his claim concerns a future one.
Hoskinson's own terms leave room for being wrong. In cryptoslate's account, a change in attack efficiency might justify moderately larger parameters, while a fundamental mathematical breakthrough could require replacing an algorithm altogether [6].
Justin Drake's warning on Oct. 7 came two days before Hoskinson's reply [20] and concerned elliptic-curve cryptography, according to crypto.news [15]. Buterin backed taking it seriously but discouraged users from rushing to move funds into new wallets, the outlet reported [17]. We'd call the math rebuttal the stronger half and the delay forecast unproven. A deployer shown to have paused signing work because of the warning would show us wrong about where the damage lands.
What to watch
- A published attack on the lattice problems behind ML-KEM and ML-DSA that beats existing reduction and sieving results; on Hoskinson's own terms, larger parameters or a new algorithm would follow.
- Any project that cites the AI warning as its reason for pausing ML-KEM or ML-DSA work; that would confirm Hoskinson's forecast.
- Buterin's reply to the Oct. 9 post, and whether Ethereum's roadmap or its Poseidon research funding changes.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence42
- Adoption
- Insufficient
- Hype gap+15
- Incentives
- Insufficient
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
In an Oct. 9 post, Hoskinson challenged Buterin's skepticism toward lattice-based cryptography, arguing that decades of security research had already accounted for the technology's known weaknesses.
ReportedSupportedSource: cryptoslate.com2 sources— create a free account to open themView cited source - [2]
Buterin said Ethereum's long-term 'lean' roadmap has moved toward hash-based signatures and proofs, avoiding lattice-based designs.
ReportedSupportedSource: cryptoslate.com2 sources— create a free account to open themView cited source - [3]
The US National Institute of Standards and Technology standardized ML-KEM for key encapsulation and ML-DSA for digital signatures in 2024.
ReportedSupportedSource: cryptoslate.com2 sources— create a free account to open themView cited source - [4]
"The case against lattices is the GNFS story, a.k.a. a hunch about 'structure,' and a multiplier pulled out of thin air," Hoskinson wrote.
ReportedSupportedSource: Charles Hoskinson, quoted by cryptoslate.com2 sources— create a free account to open themView cited source - [5]
Hoskinson rejected Buterin's illustrative suggestion that multiplying key sizes by ten might protect public-key encryption against AI-driven advances, writing that "Multiply key sizes by ten" is "numerology" and arguing that security parameters must be adjusted according to measurable improvements in attack algorithms.
ReportedSupportedSource: cryptoslate.com2 sources— create a free account to open themView cited source - [6]
A change in attack efficiency might justify moderately larger parameters, while a fundamental mathematical breakthrough could require replacing an algorithm altogether.
ReportedSupportedSource: cryptoslate.com's account of Hoskinson's argument2 sources— create a free account to open themView cited source - [7]
Hash-based signatures can provide quantum-resistant transaction authorization, and lattice techniques also support key encapsulation for encryption and other advanced cryptographic constructions.
ReportedSupportedSource: cryptoslate.com2 sources— create a free account to open themView cited source - [8]
Hoskinson pointed to more than four decades of research, including advances in lattice reduction and sieving algorithms, that have progressively improved attacks without producing a general breakthrough capable of defeating properly configured systems.
ReportedSupportedSource: cryptoslate.com2 sources— create a free account to open themView cited source - [9]
"The factoring analogy is wrong," Hoskinson wrote, explaining that the improvements in integer factorization depended on specific mathematical techniques that have not been demonstrated against the lattice problems used in modern cryptography.
ReportedSupportedSource: Charles Hoskinson, as reported by crypto.news2 sources— create a free account to open themView cited source - [10]
NIST approved the lattice-based ML-KEM and ML-DSA in August 2024 under FIPS 203 and FIPS 204, and separately standardized the hash-based digital signature system SLH-DSA under FIPS 205.
- [11]
Hoskinson argued that Buterin had not identified a credible new attack that would justify abandoning lattice methods or substantially increasing cryptographic key sizes.
- [12]
ML-KEM allows parties to establish shared cryptographic secrets, while ML-DSA provides digital signatures.
- [13]
Hoskinson cited historical weaknesses in MD5 and SHA-1 as evidence that hash functions can contain exploitable structures, although those failures do not establish vulnerabilities in modern constructions such as SHA-256.
- [14]
Hoskinson pointed to research dating back to the introduction of the Lenstra-Lenstra-Lovasz lattice reduction algorithm in 1982, and cited later improvements in lattice sieving and other attack methods.
- [15]
Ethereum Foundation researcher Justin Drake warned on October 7 that powerful AI systems might eventually discover attacks against the elliptic-curve cryptography used to authorize blockchain transactions.
- [16]
Hoskinson argued that Poseidon and Poseidon2, hash functions relevant to Ethereum's longer-term cryptographic research, also present potential targets for AI-assisted mathematical discoveries.
- [17]
Buterin supported taking the possibility of AI-found attacks on elliptic-curve cryptography seriously but discouraged users from rushing to move their funds into new wallets.
- [18]
Of the three NIST standards named (FIPS 203, 204, 205), two are lattice-based and one is hash-based.
- [19]
42 years separate the 1982 LLL lattice reduction algorithm from the August 2024 NIST approval of ML-KEM and ML-DSA.
- [20]
Hoskinson's October 9 reply came two days after Drake's October 7 warning.
- [21]
Buterin warned that AI could uncover mathematical shortcuts that researchers have not discovered through conventional methods.
- [22]
Buterin suggested that AI could deliver decades of mathematical progress comparable to the general number field sieve in a much shorter period, potentially revealing unexpected shortcuts against lattice-based systems.
ReportedContestedSource: cryptoslate.com3 sources— create a free account to open themView cited source - [23]
Hoskinson warned that encouraging developers to abandon established approaches could slow adoption of protections already being deployed across internet infrastructure, leaving systems exposed to future quantum attacks.
Sources
2 independent publishers whose own reporting we read for this story.
- crypto.newsCardano’s Hoskinson challenges Vitalik over AI threats to crypto
1 article · October 9, 2026
- cryptoslate.comHoskinson says Vitalik’s AI warning could delay the internet’s quantum defenses
1 article · October 9, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Ethereum protocol roadmapFollow
- AI-assisted mathematical discoveryFollow
- Post-Quantum CryptographyFollow