Why Assumption Diversity Matters: The Systemic Risk of a Single-Family Break

The post-quantum standards are a quiet monoculture. The key-encapsulation mechanism rests on lattice hardness; the primary and the compact signatures rest on lattice hardness; only the conservative hash-based signature stands on entirely different ground. This concentration is efficient — lattices give the best balance of size and speed — but it means that a single unexpected advance against the lattice family would compromise most of the deployed post-quantum cryptography simultaneously. That systemic risk is the reason the standardization process deliberately keeps non-lattice schemes in reserve, and this series is the honest tour of those alternatives. This first article makes the case for why diversity is worth its considerable cost.

Cryptographic monoculture and systemic risk

A cryptographic monoculture is the concentration of many systems' security on a single hardness assumption. It is efficient in the same way an agricultural monoculture is productive, and fragile in the same way: a single pathogen can wipe out the entire crop. If the key mechanism, the main signature, and the compact signature all reduce to lattice problems, then a single breakthrough in lattice cryptanalysis does not weaken one scheme but topples the whole set at once, because they share the assumption that failed. The risk is not the probability of any one scheme breaking but the correlation of their failures.

Assumption diversity is the countermeasure: basing different parts of the infrastructure on hardness assumptions that are believed independent, so that a break in one does not imply a break in another. If the key mechanism rested on lattices but a backup rested on the hardness of decoding random codes, an advance against lattices would leave the code-based backup standing, and the infrastructure could fail over to it. Diversity converts a single point of failure into a portfolio whose parts fail independently, which is a dramatically stronger position.

The value of diversity is precisely a systemic-risk argument, not a claim that any current scheme is in doubt. The standardized lattice schemes are well analyzed and trusted; the point is that trust, however well founded, is not certainty, and the cost of being wrong when everything shares one assumption is total. Insurance is bought not because the house is expected to burn but because the loss if it did would be unbearable, and cryptographic diversity is insurance of exactly that kind.

A whole family can fall

The argument for diversity is not hypothetical, because a whole assumption family has collapsed within recent memory. An isogeny-based scheme — resting on the hardness of finding maps between elliptic curves — advanced to a late round of the standardization process as a promising, compact candidate, admired for its small keys. In 2022 it was broken decisively: a new mathematical insight recovered its secret key efficiently, and not merely for weak parameters but for the scheme as proposed, ending that family's candidacy for the purpose almost overnight.

The lesson is sobering precisely because the scheme was not obviously flawed and had survived years of scrutiny. Its collapse came from a genuinely new idea, not an incremental improvement, and it fell completely rather than gradually. This is the shape of the risk that diversity guards against: not a slow erosion that gives warning, but a sudden, total break of an assumption that looked healthy until the moment it did not. A young assumption family, however carefully vetted, carries this tail risk.

This history reframes confidence in the lattice family. Lattices are older and more studied than the isogeny scheme was, which is reassuring, but the isogeny break shows that maturity is a matter of degree, not a guarantee, and that even a well-examined family can harbor a fatal idea not yet found. Keeping an independent backup is the rational response to the possibility, demonstrated rather than merely imagined, that any single family can fall.

Independence is what makes a backup valuable

A backup is only as good as its independence from the primary. If two schemes rest on assumptions that are secretly related — different-looking problems that a single advance could break together — then deploying both provides the illusion of diversity without its substance. The value of a code-based backup to a lattice primary depends on the belief that decoding random codes and finding short lattice vectors are genuinely different problems, so that progress on one does not transfer to the other. That independence is a judgment, informed by the very different mathematics involved, but it is the load-bearing assumption of the whole hedge.

This is why the choice of backup family matters and why more than one is kept. Code-based hardness rests on the difficulty of decoding, a problem with a long and separate history from lattices; multivariate hardness rests on solving systems of polynomial equations, different again. The more distinct the mathematics, the more confident one can be that a break in one will not cascade into the others, and the more genuine the diversity. A portfolio of assumptions that merely look different is not diverse; one whose members are believed independent is.

Framed statistically, independence is what lets the failure probabilities multiply rather than coincide. Under a monoculture, the chance that the deployed cryptography fails is the chance that the one assumption falls. Under genuine diversity, the chance that both a primary and an independent backup fall is the product of two small probabilities, vastly smaller. The entire benefit of diversity is this multiplication, and it holds only to the degree the assumptions are truly independent.

The standards' non-lattice reserve

The standardization process maintains this diversity deliberately. Alongside the lattice-based key mechanism, a separate track has pursued a non-lattice key-encapsulation backup, and a code-based scheme was selected in that role in 2025 precisely so that a lattice break would not leave key establishment without a standardized alternative. The families in the reserve are code-based cryptography — including the venerable and conservative Classic McEliece and the more compact quasi-cyclic schemes — and multivariate cryptography, each resting on assumptions distinct from lattices and from each other.

The table of families the rest of this series examines shows a spectrum of maturity and cost. Code-based cryptography built on decoding random codes has a track record stretching back decades and is among the most trusted assumptions in the field, at the price of very large keys. The quasi-cyclic code schemes trade some of that conservatism for practicality. Multivariate cryptography offers compact signatures but has proven fragile, with prominent schemes broken, so it is the most cautionary of the reserves. Each occupies a different point in the trade of maturity, size, and risk.

The reserve is not a set of also-rans but a deliberate hedge, kept ready even though the lattice schemes are the efficient default. The purpose of standardizing and maintaining these alternatives is so that, if the unthinkable happened and the lattice family fell, the infrastructure would have a vetted, independent scheme to fail over to rather than facing a crisis with no standardized option. That readiness is the whole point of diversity.

The cost of insurance

Diversity is not free, and the cost is the reason it is a hedge rather than a default. The most conservative non-lattice backup has enormous public keys, hundreds of kilobytes to a megabyte, dwarfing the lattice schemes; the more compact code schemes are still larger or carry a decoding-failure subtlety; the multivariate schemes that remain unbroken are niche. Deploying a backup everywhere would impose real bandwidth, storage, and performance costs, which is why the practical posture is to run the efficient lattice scheme as the primary and keep the backup vetted and ready to deploy rather than active everywhere.

This is where the crypto-agility of the migration series pays off: a system built to swap algorithms can fail over to a backup family if a break occurs, without the invasive rework that a hard-coded primitive would require. Diversity and agility are complementary — diversity provides the independent alternative, agility provides the ability to switch to it — and together they turn a potential catastrophe into a manageable migration. Maintaining the backup as a tested, deployable option is the insurance premium; the agility to activate it is what makes the policy claimable.

For autonomous AI systems the argument is sharpened by data lifetime. Long-lived model weights and training-data archives that must remain confidential for years, and that a harvest-now-decrypt-later adversary is recording today, are exactly the assets for which a single-family bet is most dangerous, because a lattice break years hence would retroactively expose everything protected under it. For such durable, high-stakes secrets, weighing an independent backup or a diversified combination is prudent despite the cost, and the following articles give the detail needed to judge which non-lattice family, if any, fits a given long-horizon need. The efficient present and the uncertain future are balanced precisely by keeping a diverse, agile portfolio.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

assumption_diversity:
  primary_family: lattice
  backup_family: code_based       # independent of lattices
  independence_reviewed: true
  agility_for_failover: required
durable_secrets:
  consider_diversity_now: true    # harvest-now-decrypt-later
cost:
  backup_active_everywhere: false # kept ready, not deployed everywhere

Glossary

Cryptographic monoculture

The concentration of many systems' security on a single hardness assumption, so that one break causes correlated, simultaneous failures.

Assumption diversity

Basing different parts of an infrastructure on independent hardness families so a break in one does not imply a break in another.

Independence

The property that progress against one assumption does not transfer to another; the load-bearing belief that makes a backup valuable.

Code-based cryptography

Schemes resting on the hardness of decoding random linear codes (syndrome decoding), a family with a decades-long track record.

Multivariate cryptography

Schemes resting on the hardness of solving systems of multivariate quadratic equations; compact but historically fragile.

Systemic risk

The risk that correlated failures across many systems occur together because they share a common assumption, versus independent failures.

References

1. NIST IR 8545, Status Report on the Fourth Round of the NIST PQC Standardization Process (2025)
2. Berlekamp, McEliece & van Tilborg, On the Inherent Intractability of Certain Coding Problems (IEEE Trans. Information Theory, 1978)
3. McEliece, A Public-Key Cryptosystem Based on Algebraic Coding Theory (JPL DSN Progress Report, 1978)
4. Beullens, Breaking Rainbow Takes a Weekend on a Laptop (CRYPTO, 2022)
5. NIST FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard (2024)