Chapter 10 — Research reading and critique
Lesson map
Lesson 10 published. Map, example, EX046.
flowchart TD
N0["Learning outcomes"]
N1["10.1 Reading cryptanalysis"]
N2["10.2 Reading resource estimates"]
N3["10.3 Reading deployment studies"]
N4["10.4 Preprints and vendor research"]
N5["10.5 Structured critique"]
N6["10.6 Worked case"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX046"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 Reading cryptanalysis"]
N2["10.2 Reading resource estimates"]
N3["10.3 Reading deployment studies"]
N4["10.4 Preprints and vendor research"]
N5["10.5 Structured critique"]
N6["10.6 Worked case"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX046"]
[Learning outcomes]
|
v
[10.1 Reading cryptanalysis]
|
v
[10.2 Reading resource estimates]
|
v
[10.3 Reading deployment studies]
|
v
[10.4 Preprints and vendor research]
|
v
[10.5 Structured critique]
|
v
[10.6 Worked case]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX046]
Learning outcomes
You will (1) read cryptanalysis, resource-estimate and deployment papers critically; (2) extract assumptions and evaluate their realism; (3) judge preprints and vendor research appropriately; (4) translate research into practice implications; and (5) write a structured critique.
10.1 Reading cryptanalysis
Cryptanalysis papers state attack models, complexity and experiments. Ask: does the attack apply to the standardised parameter set or to a variant? Is it classical or quantum? Is complexity asymptotic or concrete? Has it been reproduced? Beullens's Rainbow break (2022) applied to submitted parameters with concrete laptop-scale experiments — decisive. Many claimed lattice attacks improve constants slightly without changing security categories — important but not urgent.
Record your reading in a short table: scheme and parameter set, classical or quantum, concrete or asymptotic, reproduced or not, and the practical implication. Share it with the Cryptography Authority when a paper affects an algorithm in use. Most papers will not require action; a few will, and the table shows which.
10.2 Reading resource estimates
Resource-estimate papers such as Gidney and Ekerå (2021) and Gidney (2025) assume physical error rates, connectivity, code distance, cycle time and algorithmic choices. Extract them into a table. Ask which assumptions current hardware meets and which it does not. A falling estimate under optimistic assumptions is a signal about the direction of travel, not a date.
Keep the assumptions table for each paper and add a column for whether current hardware meets each one. Compare the tables across papers to see which assumptions changed. Present the result to the board as direction of travel, as NRHT's critique of Gidney (2025) does.
10.3 Reading deployment studies
Deployment papers report negotiated groups, failure rates and performance from measurements. Ask: what population, which vantage point, which period, what biases (for example, scanning only popular websites)? Do results transfer to enterprise or clinical environments?
Write the answers to these questions in your critique, and say explicitly whether the results apply to NRHT's clinical networks. Internet-wide measurements may miss legacy inspection proxies and embedded clients, which NRHT's own evaluation found to matter. Treat a deployment paper as a prior to test locally.
10.4 Preprints and vendor research
Preprints (arXiv, IACR ePrint) are often the first credible source and are routinely cited in this field; weigh them by author track record, reproducibility and subsequent review. Vendor research may be careful but has interests; check whether data and methods are published.
Note the status of each source in your critique, and check later whether a preprint has been revised or published. For vendor research, ask whether results can be reproduced without the vendor's product. Weigh sources consistently, so that a convenient result is not given more credit than an inconvenient one.
10.5 Structured critique
A critique summarises the claim, evaluates evidence and assumptions, identifies what would change the conclusion, and states implications for practice. Keep it to one page for practitioners.
Use the same headings for every critique so that readers can compare them. End with one sentence on what NRHT should do differently, if anything. Keep the critique with the decision records it informs, dated, so it can be revisited when new work appears. Ask a colleague to check that the summary of the claim is fair.
10.6 Worked case
Critique of Gidney (2025) for NRHT's board, one page: claim — RSA-2048 could be factored with under one million noisy qubits in under a week; key assumptions — physical error rate around 10^−3, surface-code style error correction, specific connectivity and cycle times; status — preprint by an established author building on peer-reviewed predecessors; implication — the resource gap is narrowing, supporting the board's robust "act now on long-lived flows" decision; it does not give a date and should not be quoted as one.
The critique is short, cites the paper's assumptions and avoids converting them into a date. It also connects the paper to an existing decision rather than proposing a new one. File it with the decision record and revisit it when a revised estimate appears.
10.7 Common errors and limits
- Treating every new attack paper as urgent.
- Quoting resource estimates as forecasts.
- Dismissing preprints wholesale.
Each error has a guard. Ask whether a new attack applies to standardised parameters before calling it urgent. Present resource estimates with their assumptions and never as dates. Weigh preprints by author, method and reproduction rather than dismissing them. At NRHT the Gidney (2025) critique was presented as direction of travel and connected to an existing decision, not as a date. Apply the same discipline to cryptanalysis: check the parameter set first, then ask whether the attack has been reproduced before raising urgency.
Exercises
- EX046 — Assumption table. Build a five-row assumption table for a resource-estimate paper. Rubric: 3 = error rate, qubit count, runtime, code, connectivity with sources.
- EX047 — Urgency test. Give three questions that decide whether a new lattice attack paper changes NRHT's plans. Rubric: 3 = parameter applicability, category impact, reproduction.
- EX048 — Deployment bias. Name two biases in internet-wide scanning studies when applied to hospitals. Rubric: 3 = population and vantage biases explained.
- EX049 — Vendor whitepaper. List what you would need to trust a vendor's benchmark of hybrid VPN throughput. Rubric: 3 = method, configuration, data availability, independence.
- EX050 — One-page critique. Outline the five headings of your critique template. Rubric: 3 = claim, evidence, assumptions, sensitivities, implications.
Synthesis
Specialists read research for its assumptions and applicability, weigh sources by type and reproducibility, and translate findings into calm, specific implications for practice.
Continue studying — chapter 10 of 12
← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →