Lattice cryptography is the math that will protect your data from future quantum computers. It underpins ML-KEM and ML-DSA, the two NIST post-quantum standards that browsers, messaging apps, VPNs, and federal agencies are now being told to deploy.

In October 2026, Vitalik Buterin and Charles Hoskinson argued publicly about whether that math is strong enough. Buterin co-founded Ethereum and steers its technical roadmap. Hoskinson, also an early Ethereum co-founder, went on to create Cardano and has a background in mathematics. Neither is a lattice cryptographer, but between them they influence where a large share of real-world cryptographic engineering effort goes, and Buterin has already moved Ethereum’s roadmap away from lattices entirely.

The dispute matters beyond blockchains because the algorithms in question are the same ones in your TLS handshakes and your CNSA 2.0 migration plan. Most security teams were told to deploy ML-KEM without the background to judge the argument. This piece gives you that background in plain terms.

What a Lattice Is

A lattice is a grid of points. Pick two arrows from a starting point, then mark every spot you can reach by adding or subtracting whole copies of them. In two dimensions, the result looks like graph paper, sometimes slanted into diamonds.

The starting arrows are called a basis, and many different bases produce the same grid. Short arrows at nearly right angles make the grid easy to work with. Long arrows pointing in almost the same direction describe the same grid but make it very hard to navigate.

That gap is the whole trick. The easy basis is the private key. The hard basis is the public key: accurate, but no help finding shortcuts. Real schemes use hundreds of dimensions, not two, so treat the picture as an aid, not the real thing.

The Hard Problems

Two problems make lattices useful for security:

• Shortest Vector Problem (SVP): find the shortest nonzero point in the lattice.
• Closest Vector Problem (CVP): given a point off the grid, find the nearest grid point.

An answer is easy to check but hard to find. Think of finding the nearest lamppost. On a square city grid, you just round to the nearest corner. With streets running in 512 directions and only a confusing map, you have to search an enormous area.

One caveat matters later: these problems are believed hard, not proven hard.

Learning With Errors: The Noise Is the Lock

Most deployed schemes rely on a related problem called Learning With Errors (LWE). You get a large set of linear equations, and every answer is off by a small, hidden random amount. Your job is to recover the secret values.

Without the noise, this is basic algebra a computer solves instantly. With the noise, the usual methods fail, because every step that cancels a variable also piles up the errors.

The noise is deliberate. It must be large enough to bury an attacker and small enough that the key holder can round it away. Choosing that balance is what “parameter selection” means. Variants called Ring-LWE and Module-LWE add algebraic structure to get smaller keys and better speed. The NIST standards use the module form; most homomorphic encryption uses the ring form. Either way, a small family of closely related assumptions now underpins key exchange, signatures, and homomorphic encryption at once.

Where You Already Use Lattices

Two names show up in configuration files:

• ML-KEM establishes shared encryption keys.
• ML-DSA creates digital signatures.

NIST finalized both as federal standards in August 2024 (FIPS 203 for ML-KEM, FIPS 204 for ML-DSA), and governments and technology companies are already migrating. Lattices lead because no known quantum algorithm breaks them the way Shor’s algorithm breaks RSA and elliptic curve cryptography, and they are fast enough for everyday traffic. The tradeoff is size: keys, ciphertexts, and signatures are larger than their elliptic curve equivalents.

The clock is already running. Attackers can record encrypted traffic today and decrypt it once quantum hardware arrives. If your data must stay secret for ten years, your deadline has already started.

The Dispute in Plain Terms

Both men are arguing about one number: the concrete security margin, meaning how much work a real attacker needs to break the scheme. Neither claims lattices are broken today.

Buterin says AI may be a nearer-term threat than quantum hardware. In an October 7 post on X, reported by BigGo Finance, he argued that AI-accelerated math could undermine the concrete security of lattice cryptography within two years, naming ML-DSA, fully homomorphic encryption, and lattice-based systems as the new core risk. CaptainAltcoin explains his reasoning: if machine learning compresses decades of math progress into a few years, today’s security estimates may be too generous. His advice is to use hash-based schemes where possible, be “much more paranoid” about parameter sizes where lattices are unavoidable (he floated multiplying key sizes by ten for long-term security), keep privacy-protocol notes off-chain, and hold funds in addresses that have never transacted. He also cautions that migrations carry their own risk, noting he has personally lost more money to botched migrations than to all hacks combined.

Hoskinson says lattices are well tested and the warning names no attack. In his October 9 reply, he cited four decades of attacks (LLL, BKZ, lattice sieving, pruned enumeration) that already shaped how ML-KEM and ML-DSA were sized, and noted that the known structural attacks hit ideal lattices and NTRU, not the module schemes NIST standardized. His challenge to critics: name the mathematical structure that would allow a hidden weakness. He called the ten-times multiplier “numerology,” since lattice attack cost grows exponentially with dimension, so a modestly better attack calls for a modestly larger parameter, not a tenfold one. He also argued that hashes are not structure-free (MD5 and SHA-1 fell to cryptanalysis, and Ethereum’s hash-only roadmap depends on the deliberately algebraic Poseidon hash), and that casting doubt on ML-KEM while harvest-now-decrypt-later attacks are under way could keep traffic on classical crypto longer.

Both can be right. Security estimates are based on the best known attacks, so they shift whenever a better attack is published. Hoskinson points to four decades of steady, manageable shifts. Buterin argues AI could speed those shifts beyond what standards bodies can keep up with. BigGo Finance suggests the likely result is more pressure on projects to spread risk across several cryptographic families instead of relying on lattices alone.

What to Do Now

Lattice security is an estimate that changes over time, so someone on your team has to own it.

• This week: build or refresh a one-page cryptographic inventory covering key exchange, signatures, and any data that must stay confidential beyond five years. Include firmware, certificates, and vendor products you don’t control.
• This quarter: name an owner for post-quantum parameter decisions. Document which schemes and parameter sets you use and why. Treat them as reviewed engineering choices, not library defaults.
• Run hybrid: keep classical and post-quantum algorithms together in the same handshake so one break doesn’t expose the session.
• Set a review date: plan to swap algorithms again. Choices made in 2026 should be re-examined, not inherited.