On the Intractability of Chaotic Symbolic Walks: Toward a Non-Algebraic Post-Quantum Hardness Assumption

Mohamed Aly Bouke

REVIEW 4 major objections 6 minor 1 cited by

On the Intractability of Chaotic Symbolic Walks: Toward a Non-Algebraic Post-Quantum Hardness Assumption

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper's central claim is Assumption SPIP-H: no efficient probabilistic adversary can recover a valid intermediate path of a noisy contractive symbolic trajectory from its endpoints, a hardness the paper argues is PSPACE-hard and…

desk verdict New problem definition, but the central hardness claim collapses under the paper's own model: SPIP inversion is just reachability in a bounded layered graph, so the PSPACE-hardness proof is broken and the one-wayness evidence is absent. read the letter →

arxiv 2505.22644 v1 pith:LMEHUCY7 submitted 2025-05-28 cs.CR math.DS

Mohamed Aly Bouke This is my paper

classification cs.CRmath.DS MSC 94A6068Q1737B10

keywords post-quantumcryptographysymbolicdynamicsone-wayfunctionschaoticmapshardnessassumptionstructure-freeaffinepathinversion

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes a new cryptographic hardness assumption, the Symbolic Path Inversion Problem (SPIP): a trajectory is generated on the integer lattice $\mathbb{Z}^2$ by applying a sequence of contractive affine maps $T^{(\sigma_i)}(x) = \lfloor A^{(\sigma_i)} x + b^{(\sigma_i)} + \delta_i \rfloor$, with bounded noise $\delta_i$ and floor rounding. The assumption SPIP-H says that a probabilistic polynomial-time adversary given the start point, end point, transformation set, and length cannot recover any valid intermediate path with non-negligible probability. The authors prove that the decision version is PSPACE-hard, by reduction from symbolic reachability, and that counting valid trajectories is #P-hard, by reduction from s-t path counting; they also simulate the path space to show exponential growth and endpoint collisions. If SPIP-H holds, it offers a hardness basis that does not rely on groups, rings, or lattices, and it could serve as a building block for structure-free post-quantum one-way functions and related primitives. The paper explicitly does not present a full protocol.

What carries the argument

The central object is the symbolic trajectory over $\mathbb{Z}^2$: $x_{i+1} = \lfloor A^{(\sigma_i)} x_i + b^{(\sigma_i)} + \delta_i \rfloor$, where $\sigma_i \in \{1, \dots, m\}$ is a symbolic code choosing one of $m$ contractive affine maps, each with $\|A^{(\sigma_i)}\|_2 < 1$, and $\delta_i \in [-\varepsilon, \varepsilon]^2$ is bounded noise. The mechanism that carries the argument is rounding-induced non-injectivity: the floor function plus noise makes each step branch into $k$ possible integer outputs, so the number of valid length-$n$ paths is at least $(m \cdot k)^n$, while many distinct paths land on the same endpoint. This per-step branching is exactly what the PSPACE-hardness and #P-hardness reductions exploit, and it is the reason the paper classifies the system as non-algebraic: the maps are locally affine, but the composed, rounded, noisy transformation has no group or ring structure to invert.

What would settle it

Implement the paper's Theorem 2 encoding on a small DAG with a known number of s-t paths, enumerate all length-$n$ SPIP trajectories under the specified affine maps and noise, and compare the count of valid trajectories from encoded $s$ to encoded $t$ with the true path count; any mismatch, or any trajectory that uses a non-existent edge, refutes the claimed #P-hardness reduction. Separately, for $n=3$, $m=2$, $\varepsilon=0.5$, exhaustively search all $8$ symbolic sequences with sampled noise to see whether every endpoint admits a valid intermediate path; if a cheap lookup covers all endpoints, SPIP-H is empirically falsified at those parameters.

Watch

Extended reading notes

Core claim

On its own terms, the paper's contribution is Assumption 1 (SPIP-H): fix a sequence of contractive affine maps with bounded noise $\delta_i \in [-\varepsilon, \varepsilon]^2$ and rounding, and let a trajectory be $x_{i+1} = \lfloor A_i x_i + b_i + \delta_i \rfloor$ of length $n$ with start $x_0$ and endpoint $x_n$; no PPT adversary given $(x_0, x_n, T, n)$ can recover any valid intermediate path $P' = \{x_0, x'_1, \dots, x_n\} \in W_n(T)$ with non-negligible probability. The paper claims that this hardness is intrinsic rather than cryptographic: it arises from a combinatorial explosion of the path space, from many-to-one endpoint collisions caused by rounding and noise, and from the absence of any global algebraic symmetry. Theorems 1 and 2 state that SPIP is PSPACE-hard and that SPIP-Count is #P-hard, via polynomial-time encodings of transition systems into contractive affine maps. The quantum section argues that Grover-style search cannot deliver a practical speedup because the success oracle is ambiguous, evaluation is non-injective, and floor and noise operations are not efficiently reversible.

Load-bearing premise

The argument depends on being able to rewrite any symbolic transition system as a set of contracting affine maps with small random noise so that the valid paths line up exactly, and this rewriting is assumed rather than shown.

Editorial extensions

If this is right

A one-way function can be defined directly as forward evolution $f(x_0) = x_n$, with preimage recovery blocked by SPIP-H.
Any polynomial-time algorithm that inverts SPIP would solve a PSPACE-hard reachability problem and, in its counting variant, a #P-hard path-counting problem, so breaking the assumption would imply a major complexity collapse.
Hardness scales with path length $n$, transformation count $m$, and noise bound $\varepsilon$; the paper estimates that even $n = 128$ with branching $k = 4$ gives more than $2^{256}$ candidate paths, so parameter tuning can target concrete security levels.
Because no algebraic symmetry is present, Shor's algorithm does not apply, and Grover-style search is limited to a square-root speedup on an already exponential search space with an ambiguous oracle.
The paper does not provide an instantiation; building one-way functions, pseudorandom generators, key derivation, or public-key schemes from SPIP, and proving them under the quantum random oracle model, are explicitly left as future work.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Inference: The claimed PSPACE-hardness depends on the unsupported ability to encode arbitrary transition systems into contractive affine maps with bounded noise so that valid SPIP trajectories exactly match reachability paths; a reader should treat that encoding as the open gap rather than the complexity argument.
Inference: The assumption is really a constraint-satisfaction claim: given endpoints, find a sequence of rounding choices and noise values that lands each step on an integer point. Local-search or SMT solvers over the floor constraints could be tested on the paper's own small parameters ($n=3$, $m=2$, $\varepsilon=0.5$) to probe whether the claimed infeasibility shows up at that scale.
Inference: Endpoint collisions make unique inversion information-theoretically impossible, but SPIP-H only requires any valid path; if collisions are too dense, an adversary might find a path by random forward sampling and matching endpoints, so the assumption needs the path space to be large and the endpoint distribution diffuse.
Inference: The noise distribution is load-bearing for the claim of being structure-free; if an implementation uses deterministic pseudorandom noise, the system may become a deterministic finite automaton whose inverse is computable by standard automata algorithms, so the claim cannot be tested without a precise, reproducible noise model.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: this paper defines a new problem, Symbolic Path Inversion (SPIP), and is honest that it is not a protocol design paper. That newness is real, but the central claim that SPIP is hard does not survive the paper's own definitions. I would not send it to referees in its current form.

What the paper does well: Definition 1 is a clean formalization of inverting rounded contractive affine walks, and it does not appear in the cited literature. The paper is explicit about its scope (Section 6.3), ships simulation code, and the writing is clear.

Now the soft spots, which are load-bearing. The PSPACE-hardness proof reduces from "Symbolic Reachability" as defined in Definition 2. That problem is not PSPACE-complete; it is explicit reachability in a finite transition system, which is NL-complete. Reducing from NL-complete gives at best NL-hardness, which tells us little.

More decisively, the stress-test note lands. Under the paper's own model, every reachable state lies in a bounded ball because the affine maps are contractive. So the inversion problem is simply reachability in a layered graph with at most O(n * B^4) vertices (in 2D). Standard dynamic programming over layers decides reachability in polynomial time and returns a valid path if one exists. In the paper's illustrative example, B is about 5, so the graph is tiny. The paper's emphasis on an exponentially large path space is a red herring: finding one path is not the same as enumerating all paths.

The #P-hardness reduction also doesn't work as stated. The supposed one-to-one mapping between DAG paths and SPIP trajectories is asserted without controlling for rounding and noise collisions, so the counting problems are not shown equivalent.

The empirical results cut against the paper. Entropy plateaus around 4 bits and unique endpoints saturate at 29 for n up to 1200. That is consistent with a small reachable state space and easy inversion by forward search, not with one-wayness. The quantum security discussion is informal and does not repair any of this.

To be fair, the paper flags its own limitations and does not oversell a protocol. But the hardness evidence fails on inspection. The author should re-examine the complexity claims and the actual state-space size before resubmitting. As it stands, the right call is to reject without peer review.

Referee Report

4 major / 6 minor

Summary. The paper proposes the Symbolic Path Inversion Problem (SPIP), in which an adversary is given the start point x0, endpoint xn, and the sequence of contractive affine maps with bounded noise and floor rounding, and must recover any valid intermediate trajectory. The paper claims SPIP is PSPACE-hard (Theorem 1) and #P-hard (Theorem 2), introduces Assumption 1 (SPIP-H) stating that no probabilistic polynomial-time adversary can recover a valid path, discusses quantum security, and presents simulations that report entropy growth, endpoint collisions, and a tiny number of unique endpoints. The paper explicitly disclaims being a protocol-design paper and provides code on GitHub.

Significance. If the hardness assumption were valid, SPIP would constitute a genuinely novel, non-algebraic candidate hardness assumption for post-quantum cryptography, with the merit of being explicitly self-contained and accompanied by reproducible simulations. The paper also honestly scopes itself as a hardness-assumption paper rather than a full cryptographic construction. However, the central complexity-theoretic claims are incorrect: the problem reduced from in Section 4.1 is NL-complete rather than PSPACE-complete, the counting reduction in Section 4.2 is not parsimonious, and the model itself permits an elementary polynomial-time inversion algorithm, as confirmed by the paper's own Table 1. The evidence does not support the main assumption.

major comments (4)

[Section 4.1, Definition 2 and Theorem 1] The 'Symbolic Reachability' problem defined in Definition 2 is exactly the directed st-connectivity problem on an explicitly represented graph, which is NL-complete, not PSPACE-complete; the cited reference [12] does not state otherwise. Therefore the reduction in Theorem 1, even if correct, would establish only NL-hardness. Moreover, Step 2 of the reduction specifies only that T(i,j)(φ(si)) ≈ φ(sj) with 'minor deviation' and 'allowing rounding', which is not an exact encoding: the proof does not show that valid SPIP trajectories correspond exactly to valid reachability paths, nor that spurious transitions generated by the noise or the floor function cannot occur. Since the PSPACE-hardness claim is the paper's primary theoretical justification for SPIP-H, this is a load-bearing error.
[Section 4.2, Theorem 2] The purported reduction from #PATH COUNT is not parsimonious. Step 4 asserts that each graph path maps to a trajectory 'unique (up to bounded noise)', but the same edge (u,v) with different noise vectors δ(u,v) ∈ [−1,1]^2 can produce multiple distinct SPIP trajectories, so the number of SPIP trajectories does not equal the number of s-t paths in the DAG. The proof requires an exact one-to-one correspondence to conclude #P-hardness, and this correspondence is not established. Consequently, the #P-hardness claim is unsupported.
[Section 4.4, Assumption 1 and Section 2.1] Assumption 1 is contradicted by the paper's own model. Because every matrix A_i satisfies ‖A_i‖₂ < 1 and the noise is bounded by ε, every reachable state x_i lies in the ball of radius B = max(‖x0‖, (max_i‖b_i‖ + ε + 1)/(1 − λ)), where λ = max_i ‖A_i‖₂ (Section 2.1). The reachable layered graph therefore has at most (2B+1)^2 vertices per layer, and a simple dynamic program finds a valid path in O(n(2B+1)^4) time. For the paper's illustrative configuration (A = 0.5I, ε = 0.5, Section 3.3), B is about 5, so inversion of the n=3 example is trivial. Table 1 confirms the state space is tiny (at most 29 unique endpoints for n up to 1200), which is consistent with easy inversion by forward exploration and directly invalidates the claimed hardness of SPIP-H for the demonstrated parameter regime.
[Section 4.3] The lower bound |W_n| ≥ (k·m)^n is not a lower bound on the number of valid trajectories ending at a given endpoint xn; it is a count of all possible trajectory prefixes under varying noise and symbol choices before imposing the endpoint constraint. As the paper itself notes in Section 3.2, many of these prefixes collide at the same endpoint. The counting reduction in Theorem 2 requires distinct paths, but collisions mean that the exponential size of the prefix space does not imply hardness of finding any valid path to a given endpoint. The argument conflates the size of the forward trajectory tree with the difficulty of the inversion task.

minor comments (6)

[Section 4.6] There is a typo: 'Furhtermore' should be 'Furthermore'.
[Section 5] The text contains malformed phrases such as 'non, injective mappings' and 'complexity, theoretic reductions'; these should be corrected to 'non-injective' and 'complexity-theoretic'.
[Section 2.1 and Section 4.3] The symbol T is used both for the transformation sequence {T_i} and for the finite set of maps {T^(1), ..., T^(m)}, which is confusing. Additionally, in Section 4.3 the notation m is reused for the transformation count and for the factor in (m·k)^n; the lower bound (m·k)^n double-counts the branching, because k already accounts for noise-induced outcomes under a fixed transformation, and independence across symbols is not shown.
[Section 4.1] The paper claims 'SPIP is PSPACE-hard under polynomial-time reductions', but SPIP is a search problem while PSPACE-hardness is defined for decision problems; the reduction from a decision problem to a search problem needs a formal treatment of this mismatch (e.g., via a decision version of SPIP).
[References] Reference [12] (Arora-Barak) does not support the claim that the 'Symbolic Reachability' problem of Definition 2 is PSPACE-complete; the authors should cite the standard NL-completeness of directed st-connectivity, and for the #P-hardness of counting paths in DAGs they should cite a more specific source than Valiant's original permanent paper.
[Section 5, Table 1] The column labeled 'Collisions' is unclear: the values seem to correspond to a count of trajectories or to some other statistic, and the relationship to 'Most Frequent Count' is not explained; the paper should define all table columns explicitly.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: SPIP-H is an explicit hardness assumption, the empirical section measures the forward model rather than predicting fitted values, and the self-citation to the author's RNIFS work is historical and not load-bearing.

full rationale

Walking the claimed derivation chain, no step reduces to its own input by construction. SPIP is defined as a search problem (Definition 1) and SPIP-H is stated as an explicit cryptographic hardness assumption (Assumption 1), not as a theorem derived from that same assumption. The PSPACE-hardness and #P-hardness arguments attempt reductions from external problems, and while those reductions appear technically unsound (explicit finite-transition-system reachability is not PSPACE-complete, and counting s-t paths in a DAG is polynomial), unsoundness is not circularity. The empirical simulations in Section 5 report entropy, unique endpoints, and collision statistics generated from the paper's own forward dynamics; they do not fit a parameter to a target and then relabel that fit as a prediction. The only self-citation is to the author's prior RNIFS preprint [5], used for motivation and framing ('This work builds directly on our prior study of RNIFS [5]'), but the definitions, equations, and experiments in the present paper are self-contained, and no load-bearing theorem or uniqueness result is imported from [5]. Accordingly, the correct finding is no significant circularity.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim rests on several unproven domain assumptions: the uniform noise model, the mischaracterized PSPACE-complete problem, and the ability to encode arbitrary graphs into affine maps with rounding and noise while preserving exact reachability. These are all assumed without rigorous justification, and the free parameters (k, epsilon, alpha) are chosen heuristically rather than derived.

free parameters (3)

per-step branching factor k = 4 (assumed lower bound)
Used in the growth bound |W_n| >= (k*m)^n; the paper assumes k>=4 based on a simple example, but the value depends on the contraction matrix, translation vector, and noise bound.
noise bound epsilon = 0.3 to 0.7 (claimed optimal range)
Chosen per experiment; the paper claims an empirically optimal range for entropy, but this is a heuristic derived from their own simulations, not a fitted constant.
contraction factor alpha = 0.5I (used in examples)
The concrete examples use A=0.5I, but the hardness analysis allows any contractive matrix. The specific choice affects rounding behavior and branch counts.

assumptions (4)

domain assumption Noise vectors are drawn from a uniform distribution over [-epsilon, epsilon]^2 independently at each step.
Stated in Section 2.3 without justification; the uniform distribution is not derived from any physical or computational principle.
ad hoc to paper The Symbolic Reachability problem as defined in Definition 2 is PSPACE-complete.
The problem as stated is ordinary graph reachability, which is NL-complete, not PSPACE-complete. The proof relies on this incorrect assertion.
ad hoc to paper Any finite set of states can be bijectively mapped to points in Z2 while preserving the required affine transition constraints exactly.
The reductions in Sections 4.1 and 4.2 assume a bijection phi with precisely constructed affine maps T(i,j) that map phi(s_i) to phi(s_j) under floor rounding and bounded noise. No construction or proof of existence is given for arbitrary graphs.
domain assumption The floor rounding and noise do not create spurious transitions in the reductions.
The proofs assume that the encoding is 'exact' and that noise and rounding do not produce valid transitions that do not correspond to edges in the original graph. This is not proven and is generally false.

how reviews work

0 comments

Cite this review

Pith. "Pith review of On the Intractability of Chaotic Symbolic Walks: Toward a Non-Algebraic Post-Quantum Hardness Assumption." pith.science (2026). https://pith.science/paper/LMEHUCY7

@misc{pith2026250522644,
  author       = {Pith},
  title        = {Pith review of: On the Intractability of Chaotic Symbolic Walks: Toward a Non-Algebraic Post-Quantum Hardness Assumption},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LMEHUCY7}},
  note         = {Machine review of arXiv:2505.22644}
}

read the original abstract

Most classical and post-quantum cryptographic assumptions, including integer factorization, discrete logarithms, and Learning with Errors (LWE), rely on algebraic structures such as rings or vector spaces. While mathematically powerful, these structures can be exploited by quantum algorithms or advanced algebraic attacks, raising a pressing need for structure-free alternatives. To address this gap, we introduce the Symbolic Path Inversion Problem (SPIP), a new computational hardness assumption based on symbolic trajectories generated by contractive affine maps with bounded noise over Z2. Unlike traditional systems, SPIP is inherently non-algebraic and relies on chaotic symbolic evolution and rounding-induced non-injectivity to render inversion computationally infeasible. We prove that SPIP is PSPACE-hard and #P-hard, and demonstrate through empirical simulation that even short symbolic sequences (e.g., n = 3, m = 2) can produce over 500 valid trajectories for a single endpoint, with exponential growth reaching 2256 paths for moderate parameters. A quantum security analysis further shows that Grover-style search offers no practical advantage due to oracle ambiguity and verification instability. These results position SPIP as a viable foundation for post-quantum cryptography that avoids the vulnerabilities of algebraic symmetry while offering scalability, unpredictability, and resistance to both classical and quantum inversion.

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

The Hashed Fractal Key Recovery (HFKR) Problem: From Symbolic Path Inversion to Post-Quantum Cryptographic Keys
cs.CR 2025-06 reject novelty 2.0 of 10

HFKR hashes noisy affine-map trajectories over Z^2 to derive keys, and the paper reports fractal dimension and hash diffusion metrics, but it does not prove the claimed post-quantum security.

Reference graph

Works this paper leans on

16 extracted references · 13 canonical work pages · cited by 1 Pith paper

[12]

Arora and B

S. Arora and B. Barak, Computational complexity: a modern approach. Cambridge University Press, 2009

work page 2009
[1]

Algorithms for quantum computation: Dis- crete logarithms and factoring,

P. W. Shor, “Algorithms for quantum computation: Dis- crete logarithms and factoring,” in Proceedings 35th an- nual symposium on foundations of computer science , Ieee, 1994, pp. 124–134

work page 1994
[2]

Pqc: R-propping a chaotic cellular automata,

P. Hecht, “Pqc: R-propping a chaotic cellular automata,” Cryptology ePrint Archive, 2021

work page 2021
[3]

Status report on the first round of the additional digital signature schemes for the nist post-quantum cryptography standardization process,

G. Alagic, M. Bros, P. Ciadoux, et al., “Status report on the first round of the additional digital signature schemes for the nist post-quantum cryptography standardization process,” NIST IR, vol. 8528, 2024

work page 2024
[4]

Lattice problems in npA ∩ B conp,

D. Aharonov and O. Regev, “Lattice problems in npA ∩ B conp,” Journal of the ACM (JACM) , vol. 52, no. 5, pp. 749–765, 2005

work page 2005
[5]

M. A. Bouke, Fractal attractors in random nonlin- ear iterated function systems: Existence, stability, and dimensional properties , 2025. arXiv: 2505 . 18849 [math.DS]. [Online]. Available: https://arxiv. org/abs/2505.18849

arXiv 2025
[6]

Rsa chips (past/present/future),

R. L. Rivest, “Rsa chips (past/present/future),” inWork- shop on the Theory and Application of of Cryptographic Techniques, Springer, 1984, pp. 159–165

1984
[7]

Secure communications over insecure channels,

R. C. Merkle, “Secure communications over insecure channels,” Communications of the ACM, vol. 21, no. 4, pp. 294–299, 1978

work page 1978

Show all 16 references

[8]

On lattices, learning with errors, random linear codes, and cryptography,

O. Regev, “On lattices, learning with errors, random linear codes, and cryptography,” Journal of the ACM (JACM), vol. 56, no. 6, pp. 1–40, 2009

2009
[9]

On ideal lattices and learning with errors over rings,

V . Lyubashevsky, C. Peikert, and O. Regev, “On ideal lattices and learning with errors over rings,” in Advances in Cryptology–EUROCRYPT 2010: 29th Annual Inter- national Conference on the Theory and Applications of Cryptographic Techniques, French Riviera, May 30–June 3, 2010...

2010
[10]

Numerical solution of multivariate polynomial systems by homotopy continuation methods,

T.-Y . Li, “Numerical solution of multivariate polynomial systems by homotopy continuation methods,” Acta nu- merica, vol. 6, pp. 399–436, 1997. Page 10 of 11 Short communication Bouke, 2025

1997
[11]

Rainbow, a new multivari- able polynomial signature scheme,

J. Ding and D. Schmidt, “Rainbow, a new multivari- able polynomial signature scheme,” in International con- ference on applied cryptography and network security, Springer, 2005, pp. 164–175

2005
[13]

The complexity of computing the per- manent,

L. G. Valiant, “The complexity of computing the per- manent,” Theoretical computer science , vol. 8, no. 2, pp. 189–201, 1979

1979
[14]

Introduction to the theory of computation,

M. Sipser, “Introduction to the theory of computation,” ACM Sigact News, vol. 27, no. 1, pp. 27–29, 1996

1996
[15]

A fast quantum mechanical algorithm for database search,

L. K. Grover, “A fast quantum mechanical algorithm for database search,” in Proceedings of the twenty-eighth annual ACM symposium on Theory of computing, 1996, pp. 212–219

1996
[16]

Hidden fields equations (hfe) and isomor- phisms of polynomials (ip): Two new families of asym- metric algorithms,

J. Patarin, “Hidden fields equations (hfe) and isomor- phisms of polynomials (ip): Two new families of asym- metric algorithms,” in International conference on the theory and applications of cryptographic techniques , Springer, 1996, pp. 33–48. Page 11 of 11

1996

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [12]

Arora and B

S. Arora and B. Barak, Computational complexity: a modern approach. Cambridge University Press, 2009

work page 2009

[2] [1]

Algorithms for quantum computation: Dis- crete logarithms and factoring,

P. W. Shor, “Algorithms for quantum computation: Dis- crete logarithms and factoring,” in Proceedings 35th an- nual symposium on foundations of computer science , Ieee, 1994, pp. 124–134

work page 1994

[3] [2]

Pqc: R-propping a chaotic cellular automata,

P. Hecht, “Pqc: R-propping a chaotic cellular automata,” Cryptology ePrint Archive, 2021

work page 2021

[4] [3]

Status report on the first round of the additional digital signature schemes for the nist post-quantum cryptography standardization process,

G. Alagic, M. Bros, P. Ciadoux, et al., “Status report on the first round of the additional digital signature schemes for the nist post-quantum cryptography standardization process,” NIST IR, vol. 8528, 2024

work page 2024

[5] [4]

Lattice problems in npA ∩ B conp,

D. Aharonov and O. Regev, “Lattice problems in npA ∩ B conp,” Journal of the ACM (JACM) , vol. 52, no. 5, pp. 749–765, 2005

work page 2005

[6] [5]

M. A. Bouke, Fractal attractors in random nonlin- ear iterated function systems: Existence, stability, and dimensional properties , 2025. arXiv: 2505 . 18849 [math.DS]. [Online]. Available: https://arxiv. org/abs/2505.18849

arXiv 2025

[7] [6]

Rsa chips (past/present/future),

R. L. Rivest, “Rsa chips (past/present/future),” inWork- shop on the Theory and Application of of Cryptographic Techniques, Springer, 1984, pp. 159–165

1984

[8] [7]

Secure communications over insecure channels,

R. C. Merkle, “Secure communications over insecure channels,” Communications of the ACM, vol. 21, no. 4, pp. 294–299, 1978

work page 1978