A newly launched research initiative aims to bring empirical metrics to one of the most abstract debates in modern cybersecurity: exactly how much human effort has been expended attempting to break the foundational mathematical problems underpinning public-key cryptography. Hosted at bitsofwork.org, the project utilizes advanced artificial intelligence models, including Claude and GPT-6 Astra, to survey historical cryptanalysis literature and estimate the cumulative human-hours dedicated to attacking the mathematical assumptions behind contemporary digital security standards.
The platform represents a collaborative experiment between human security researchers and generative language models to catalog, quantify, and analyze decades of academic and clandestine cryptanalytic research. While the project is currently in a preliminary, work-in-progress state, its creators hope the initial dataset will inform ongoing discussions regarding cryptographic agility, long-term security margins, and the eventual transition to post-quantum cryptography.
Background and Motivation
Modern digital infrastructure relies heavily on public-key cryptography to secure data in transit and at rest. Protocols such as Transport Layer Security (TLS), Secure Shell (SSH), and secure messaging applications depend on mathematical hardness assumptions—problems that are computationally infeasible to solve with current technology, such as integer factorization or the discrete logarithm problem.
For decades, security standards have been evaluated based on theoretical complexity and algorithmic difficulty. However, measuring the practical security of a cryptographic primitive often involves evaluating the volume of human ingenuity and computational resources directed at breaking it. Until now, quantifying the accumulated cryptanalytic effort—often measured in human-hours of dedicated research, paper publication, and algorithm optimization—has been largely anecdotal or restricted to fragmented historical accounts.
The bitsofwork.org project attempts to systematize this inquiry. By systematically reviewing historical literature, academic papers, conference proceedings, and known cryptanalytic breakthroughs, the research team sought to build a comprehensive ledger of human labor invested in breaking or weakening specific cryptographic problems.
Methodology and AI Integration
Compiling a comprehensive historical survey of cryptanalytic results requires synthesizing vast quantities of technical literature spanning more than half a century. To manage this monumental data aggregation task, the project’s creators enlisted advanced artificial intelligence systems, specifically Claude and GPT-6 Astra.
These large language models were tasked with parsing historical papers, extracting cryptanalytic milestones, estimating research team sizes, and correlating publication timelines with sustained periods of academic and governmental investigation. Given the inherent complexities of historical research—such as distinguishing between theoretical proposals and active cryptanalytic campaigns, or accounting for classified work by intelligence agencies—the methodology relies on explicit heuristics and documented assumptions.
Recognizing that methodological debates are inevitable in quantitative historiography, the project maintainers have opened the platform to external peer review. The underlying data and code have been made available via a public GitHub repository, inviting the global cryptography and academic communities to inspect, critique, and contribute refinements to the dataset.
Implications for Post-Quantum Cryptography and Standardization
The release of the bitsofwork.org database arrives at a critical juncture for the global cybersecurity community. As organizations worldwide prepare for the migration to post-quantum cryptography (PQC)—driven by the National Institute of Standards and Technology (NIST) standardization process—policymakers and cryptographers are intensely evaluating the confidence levels associated with new mathematical primitives, such as lattice-based and hash-based cryptography.
Traditional public-key algorithms, including RSA and Elliptic Curve Cryptography (ECC), have benefited from decades of intensive cryptanalytic scrutiny. If thousands or tens of thousands of human-years have been spent trying to break RSA-2048 without success, that historical effort provides an empirical floor of confidence regarding its security against classical computers. Conversely, newer post-quantum candidates, while mathematically sound based on modern complexity theory, possess significantly shorter histories of public cryptanalytic study.
By attempting to quantify the historical human investment in older schemes, researchers hope to establish comparative baselines. Such metrics could eventually help risk assessors quantify the "maturity" or "battle-testedness" of different cryptographic families, offering a complementary perspective to pure asymptotic complexity analysis.
Community Reception and Future Outlook
Initial reactions from the cryptographic research community have focused on the utility of the dataset as a living document. While domain experts acknowledge the immense difficulty—and potential margin of error—in accurately estimating historical research hours, the centralization of this data provides a valuable starting point for structured discussions.
The project maintainers have emphasized that the current iteration of the site serves as an open invitation for collaboration rather than a definitive final authority. Feedback, corrections, and methodological adjustments are actively being solicited through community comments and GitHub issue tracking.
As the database is refined through peer review and ongoing AI-assisted auditing, it could evolve into a standard reference for historians of science, cryptographers, and policymakers tasked with evaluating the resilience of global digital infrastructure against both classical and emerging threats.
