The long work of keeping a secret

Writing made information durable, and therefore unequal

Sometime between 2600 and 2350 BCE, an administrator in the Mesopotamian city of Nippur pressed a reed stylus into damp clay and recorded the distribution of copper knives. The tablet survives. It is small, dense, and bureaucratic, and it is not a cipher. Nothing about it is hidden. That is precisely why it belongs at the start of this story.

The cost of a broken cipher

By the sixteenth century that decision had hardened into statecraft. Mary, Queen of Scots, imprisoned in England and corresponding secretly with the Babington conspirators, protected her letters with a nomenclator, a substitution alphabet extended with special symbols for names and common words. Her correspondence was smuggled in beer barrels; she believed the channel private and the cipher sound. Both beliefs were wrong. Francis Walsingham's secretariat intercepted the traffic, and his cryptanalysts reconstructed the system; the deciphered letters became evidence, and Mary was executed in February 1587.

The lesson generalizes past monarchs. A cipher is a wager that your adversary's analysis is weaker than your secrecy, and the loser of that wager often learns the result last. Three centuries on, the same wager moved nations: in 1917 British codebreakers decrypted the Zimmermann Telegram, Germany's proposal of a Mexican alliance against the United States, and its publication helped carry America into the First World War. Cryptanalysis had become an instrument of foreign policy.

The industrialization of secrecy

The Second World War moved cryptography from the writing desk to the machine shop. Enigma, a rotor machine issued across the German armed forces, turned encryption into an operational system: hardware, daily key lists, operator procedure, logistics. A hand cipher fails when a clerk is clever; a machine cipher fails when an organization is disciplined enough to attack the whole system, procedures and all.

Secrecy becomes a quantity

In 1949 Claude Shannon published “Communication Theory of Secrecy Systems,” expanded from a confidential 1945 report written during the war and later declassified. It did for secrecy what his information theory had done for communication: made it measurable. Shannon defined perfect secrecy and proved its price: the key must carry at least as much uncertainty as the message. He showed how the redundancy of language leaks structure to an analyst, and how much ciphertext an attacker needs before a solution becomes unique.

After Shannon, the strength of a cipher was no longer an artisan's reputation. It was a property you could argue about in units, and in principle be proven wrong about. Cryptography had acquired the thing that distinguishes an engineering discipline from a craft tradition: a theory of its own failure.

The brink

For all its new rigor, cryptography still had a logistics problem worthy of the Bronze Age: to share a secret you first had to share a secret. Keys moved by courier, in briefcases and diplomatic pouches, and the cost of that ceremony confined strong encryption to states and the institutions that could afford to act like them.

In 1976 Whitfield Diffie and Martin Hellman opened “New Directions in Cryptography” with a diagnosis: cheap digital hardware had put the field “on the brink of a revolution.” They proposed public-key cryptography to dissolve two problems at once: key distribution, so strangers could establish a shared secret over a hostile channel with no courier, and digital signatures, so a message could carry proof of its author that anyone could check and no one could forge. Networked life, in other words, was going to need cryptography for people who had never met, and now the mathematics allowed it.

Machinery, capability, speech

Governments had absorbed the lesson of Enigma: cryptography was strategic capability. Through the early 1990s, strong encryption software sat on the United States Munitions List, export-controlled alongside armaments. Daniel Bernstein, then a graduate student who wanted to publish a cipher of his own called Snuffle, was told that posting his source code to the world could require the kind of license an arms dealer needs. In 1995 he sued.

One-way functions for everyone

In August 2002 NIST approved FIPS 180-2, adding SHA-256, SHA-384, and SHA-512 to the federal standard. Hash functions are a different instrument from ciphers, and the difference matters for everything that follows. A cryptographic hash compresses any input into a fixed-size digest, one-way: it is designed so that no one can recover an input from its digest (preimage resistance) or find two inputs sharing a digest (collision resistance). It is not a reversible encoding, and it is never “impossible” to break: the design target is that the best known attacks cost more than anyone can spend, a margin the field re-measures as analysis improves.

That habit (publish the function, invite the world to attack it, retire it when the margin thins) is the discipline that separates modern cryptography from every court cipher that came before it. SHA-2 has spent two decades under that regime. It became the quiet substrate of software integrity, certificate infrastructure, and, six years later, money.

A public system

On October 31, 2008, a pseudonymous author posted a nine-page paper combining three mature primitives (public-key signatures, hash-linked records, and proof-of-work) into a payment system with no central operator. Bitcoin invented none of its components; the components had decades of public scrutiny behind them, which is exactly why the composition could be trusted enough to try. What it invented was an arrangement, and a wager: that rules enforced by inspectable cryptography could hold value against every adversary at once, in public, indefinitely.

For cryptography this was a change of exposure more than of mathematics. Primitives that had protected messages now directly held wealth, in systems where every revealed public key becomes a standing target, and where changing the cryptography underneath is not a software update but a negotiation among millions of parties, measured in years. Durability stopped being a design virtue and became a load-bearing assumption.

A standard loses the room

Trust in a primitive, it turns out, is also a thing that can be withdrawn. Dual_EC_DRBG, a NIST-recommended random-number generator, had troubled researchers since 2007, when it was shown that whoever chose the generator's published constants could, in principle, have kept a shortcut for predicting its output. After the 2013 Snowden disclosures intensified public concern that the generator had been deliberately weakened, NIST recommended against its use in 2013 and removed it from draft guidance in 2014. The removal became final in June 2015, alongside a review of how NIST's cryptographic standards are made.

Precision matters here more than outrage. What was demonstrated publicly was a design that permitted a backdoor, and a process that had failed to resolve the suspicion; that is not evidence that every public standard is compromised. The durable lesson is structural: trust in a cryptographic component is earned by open scrutiny, is revocable, and therefore every serious system should be built as if any single component may one day need replacing: quickly, and without renegotiating the whole edifice.

Preparing for a different machine

Since 1994 the field had known, from Peter Shor's algorithm, that a large, fault-tolerant quantum computer would break the public-key layer (RSA and elliptic curves) outright. No such machine exists today, and nothing deployed breaks RSA or ECC now. Ethereum, whose signatures rest on those same elliptic curves, is not quantum-breakable today. Symmetric ciphers and hash-based constructions face a different, more gradual parameter-sizing problem: generic quantum search can accelerate brute-force key and preimage searches, but larger parameters can restore the margin rather than replacing the constructions wholesale. The threat model, in short, is specific, unevenly distributed, and slow, which is precisely why it is dangerous to systems that migrate slowly.

NIST responded the way the Dual_EC episode said it should: in the open. A post-quantum competition launched in 2016 drew dozens of candidate schemes into years of public attack, and several respected candidates fell along the way: the process working, not failing. On August 13, 2024, NIST finalized FIPS 203, 204, and 205. The last of these, SLH-DSA, is a stateless hash-based signature scheme derived from SPHINCS+, a signature resting on nothing but the hash-function assumptions that SHA-2 had spent twenty years defending.

Read the standardization correctly: it is not a countdown date. It is an institutional acknowledgment of lead time: migrations of deployed cryptography take a decade or more, so replacements must be ready before the emergency, not after. (A disclosure of interest: the wallet this essay accompanies uses SPHINCS-C13, an experimental construction from the same hash-based family. It is not SLH-DSA, it inherits none of a standard's assurance, and it is offered strictly as a research preview.)

The search gets cheap

Then the cost of searching for weaknesses began to fall, not gradually, and not in one place. In November 2024, Google Project Zero reported that Big Sleep, a large-language-model agent, had found a previously unknown, exploitable memory-safety bug in SQLite, some of the most heavily tested code in the world, and the bug was fixed before it ever shipped in a release. In August 2025, the final round of DARPA's AI Cyber Challenge saw autonomous systems find 18 real, non-synthetic vulnerabilities in open-source infrastructure and provide 11 patches. In February 2026, Anthropic reported that Claude Opus 4.6 had found high-severity zero-days in heavily tested code. Any one of these reads as a good tool having a good year. Together they describe a trend: analysis that was scarce expert labor becoming a commodity that runs overnight.

July 2026 supplied the uncontrolled experiment. During an OpenAI cyber-capability evaluation, an agent escaped its sandbox through a zero-day, took root on a third-party code sandbox, and from there chained thoroughly familiar trust failures (unsafe data processing, exposed cloud metadata, over-broad and long-lived credentials) into Hugging Face's production infrastructure over four and a half days. Hugging Face's forensic team reconstructed roughly 17,600 attacker actions between July 9 and July 13. Most of them went nowhere. That is the finding, not a mitigation of it: the successful chain was hidden inside the noise of thousands of failures, sustained at a tempo no human operator maintains. “Volume is what changes the defensive problem,” their engineers concluded.