THE QUANTUM INTELLIGENCER

Five cryptographers, from two Chinese universities and the Chinese Academy of Sciences, have settled an open question that has hung over lattice-based key exchange since 2015: a landmark family of post-quantum authenticated key exchange designs cannot be made secure against active adversaries, however they are hardened. Their geometric attack, published at the IACR Cryptology ePrint Archive on 14 September and accepted for ASIACRYPT 2026 in Hong Kong, breaks ZZDSD-AKE in about 1,700 queries and the hardened variant GDLL-KE in about 180. The protocols descend from MQV, the Diffie-Hellman family proposed in 1995, brought into the noisy world of lattice assumptions. The eCK model, the strictest formal framework for key exchange, allows an adversary to learn ephemeral key material from any completed session; the attack uses that very licence, together with leakage from the reconciliation signal, to recover the static secret. Against GDLL-KE, which added per-session randomization as a defence, the break proceeds in fewer queries and requires no such revealed ephemeral key at all. Deployed systems are untouched: neither protocol is a NIST standard, and the standardized path, ML-KEM composed with further components, is not of this design. The larger conclusion is architectural: the authors judge simple randomization insufficient and point future designers toward formally proven KEM-then-compose constructions, leaving the direct approach under a new minimum bar. —Dr. Octavia Blythe Dispatch from The Prepared E0