Why do lattice-based schemes like Kyber resist the same quantum algorithms that break RSA and elliptic curves?

# Why Lattice-Based Cryptography Resists Quantum Attacks

The core reason is that Shor's algorithm—the quantum breakthrough that breaks RSA and elliptic curves—exploits a very specific mathematical structure that lattice problems don't have [AG-2024.05-2225].

The Problem Shor Solves

Shor's algorithm is devastatingly efficient at solving the *discrete logarithm problem*: given a number *g* and its power *g^x*, find the exponent *x*. This is the trap door that both RSA and Elliptic Curve Cryptography depend on [AG-2024.05-2225]. A quantum computer using Shor's can crack both in polynomial time—meaning the time grows reasonably with problem size, not exponentially.

Why Lattice Problems Are Different

Lattice-based schemes like Kyber instead rely on the *Learning with Errors (LWE) problem*: roughly, you're given noisy linear equations and asked to recover a hidden vector. This is a fundamentally different beast. The noise is crucial—it's what makes the problem hard, and crucially, Shor's algorithm has no purchase on it because there's no discrete logarithm or factorization hiding underneath.

Even more remarkably, LWE appears to remain hard *even against quantum computers* [AG-2025.09-1078]. The paper on holographic attacks shows that even with exotic quantum resources (like quantum gravity duals of spacetime), extracting the information you'd need to break LWE still requires exponentially many measurements—no shortcut exists.

What About Grover's Algorithm?

You might wonder: couldn't Grover's algorithm, which provides a quadratic speedup for searching, help attack lattice cryptography? It could in principle speed up some lattice problems (like the Shortest Vector Problem), but only by a square root [AG-2024.02-1901]. That means if Kyber's parameters use a lattice where classically finding the shortest vector takes time 2^256, Grover's gets you down to 2^128—still exponentially hard, and designers simply tune parameters to account for this modest quantum advantage [AG-2024.02-1901].

In contrast, Shor reduces exponential problems to polynomial time, which is why it's civilization-threatening for RSA but merely inconvenient for lattices.