Simon’s Polynomial-Time Quantum Algorithm for the Dihedral Coset Problem: Claims, Skepticism, and What It Means for ML-KEM and ML-DSA

Simon’s paper presents a polynomial-time quantum algorithm for DCP, a problem long recognized as a potential bridge to lattice-based cryptography . The core claims are:

• Polynomial-time DCP solver. The algorithm solves DCP in polynomial time on a quantum computer, building on a 2002 reduction by Regev that links the Dihedral Subgroup Problem to DCP .
• Bridging a 20-year gap. If correct, this would resolve the open question left since Regev’s reduction connected DCP to lattice problems—a gap that has stood since roughly 2004 .
• A new technical approach. The algorithm replaces a key oracle used in prior approaches with a “block-and-query” technique for extracting hidden subgroup information .
• Claimed consequences for lattice problems. The paper states the algorithm can combine with reductions by Regev and improvements by Brakerski, Kirshanova, Stehlé, and Wen to yield polynomial-time quantum algorithms for solving lattice problems, such as finding a polynomial-factor approximation to the shortest vector (SVP) and the Learning With Errors problem (LWE) .

The paper also claims the algorithm can tolerate a faulty sample rate as high as 1/O(log n), which would allow its combination with the reduction path to efficiently solve lattice problems .

Verification Status: Skepticism and a “Wait and Verify” Posture

As of August 7–8, 2026, the community’s response is cautious and skeptical .

• No peer review. The draft is labeled “Preliminary Draft” and was posted to the IACR ePrint server on August 6, 2026 . It has not been peer-reviewed or published in a journal or conference.
• Skeptical early reactions. Multiple expert analyses note that several load-bearing proofs are presented as sketches, and the final corollary on SVP and LWE parameters rests partly on unpublished personal communications rather than published derivations . One industry analyst described the initial reaction as “heavy skepticism” .
• No independent confirmation. No independent verification or refutation has been published in the days since the preprint surfaced . The prevailing community sentiment is “facts before reaction” .
• Not a practical attack. Reporting unanimously emphasizes that this is a theoretical claim about DCP, not an implemented attack on any standardized cryptosystem .

What This Means for ML-KEM and ML-DSA

For organizations deploying or evaluating NIST-standardized post-quantum cryptography, the immediate answer is clear: there is no reason to change course based on this preprint .

• No immediate practical threat. The preprint does not implement an attack on ML-KEM (FIPS 203) or ML-DSA (FIPS 204) . No NIST parameter set has been attacked .
• Theoretical implications are indirect. DCP is connected to lattice problems through known reductions, but whether those reductions yield a concrete attack on Module-LWE or Module-SIS—the specific hardness assumptions underlying ML-KEM and ML-DSA—is a further theoretical step that has not been established .
• A structural, not practical, concern. If validated, the claim would strengthen the theoretical case that quantum computers can efficiently solve certain lattice problems. However, “lattice problems” in general is a broader category than the specific structured lattice assumptions used in the NIST standards .
• Context from prior work. In 2025, Bai et al. achieved a quasi-polynomial time algorithm for a restricted variant of DCP (the extrapolated DCP over power-of-two moduli) . Simon’s claim of full polynomial time would be a major leap beyond that, but it remains unconfirmed.

Expert Community Response: Heavy Skepticism and Calls for Caution

The cryptographic and post-quantum security community has responded with a clear message: wait, verify, and don’t overreact .

• “Heavy skepticism” reported. Post-quantum industry analysts point to the sketch-like nature of the proof and its reliance on unpublished references as major red flags that require careful scrutiny before any conclusions can be drawn .
• Conditional implications. Even if DCP is solvable in polynomial time, the theoretical implications for lattice-based PQC are “conditional”—they depend on the specific reduction path, not just on DCP being solvable .
• No major institutional statements yet. NIST, academic labs, and standards bodies have not yet issued formal statements, which is expected given the preprint is only days old .
• General posture. The community is treating this as an important claim requiring careful scrutiny, but not as a reason to change PQC deployment timelines or parameter sets .

In summary, Daniel Simon’s preprint is a significant theoretical claim that could, if verified, have profound implications for the foundations of lattice-based cryptography. But for now, it is an unverified preprint with significant reported flaws, and it does not change the practical security posture of NIST-standardized post-quantum algorithms like ML-KEM and ML-DSA.