What happened to SIKE and Rainbow, the post-quantum candidates broken by classical computers?

As of November 6, 2026, the two most advanced candidates ever broken in NIST's post-quantum process — a signature finalist and a round-4 encryption candidate — fell to classical computers, not quantum ones. Rainbow, one of the three digital-signature finalists, fell on February 25, 2022 to a key-recovery attack that averages 53 hours on a standard laptop (IACR ePrint 2022/214). SIKE, a round-4 KEM candidate, fell on July 30, 2022, just 25 days after NIST advanced it, to an attack built on a theorem published in 1997; the final version of that attack breaks SIKEp434 in about 10 minutes on a single core (IACR ePrint 2022/975). The count of keys broken by quantum computers on the public record was 0 then and is 0 today — Rosetta Quantum re-verified that count this morning. The lesson of 2022 is not panic. It is hybridity and crypto-agility, and it is the strongest argument on record that public cryptanalysis works.

This piece is the deep file behind the summary table our crypto-agility explainer published on November 5: what exactly broke, who broke it, with what mathematics, and what it means for a security leader reading vendor claims in 2026.

What was Rainbow, and how did a laptop beat a NIST finalist?

Rainbow was a multivariate signature scheme — one of only three signature finalists left in round 3 of NIST's post-quantum process — and it fell when Ward Beullens, then at IBM Research Zurich, published a key-recovery attack whose title is the whole story: «Breaking Rainbow Takes a Weekend on a Laptop» (IACR ePrint 2022/214, February 25, 2022). For a given Rainbow public key at security level 1, the attack returns the corresponding secret key after on average 53 hours — one weekend — of computation on a standard laptop. The precision that travels with that number: the practical runtime was demonstrated against the SL 1 parameters of Rainbow's second-round submission, and the paper's new attacks outperformed the previously known ones for all the parameter sets submitted to NIST.

Rainbow had been a finalist since July 22, 2020 — nineteen months — when the attack landed. The design was an extension of Oil and Vinegar (UOV), a multivariate scheme from 1999: Rainbow added extra layers of structure on top of UOV to make keys smaller and signing faster. That additional structure, not the base design, is what the attack exploited — a distinction that matters for reading today's candidate list, as we show below. On July 5, 2022, NIST closed round 3 (NIST IR 8413) selecting CRYSTALS-Dilithium, Falcon and SPHINCS+ for signatures. Rainbow was not among them.

How did a 1997 theorem kill SIKE in 25 days?

SIKE — the isogeny-based KEM with the smallest keys in the whole competition — was advanced to round 4 on July 5, 2022, in the same NIST announcement that dropped Rainbow. Twenty-five days later, on July 30, 2022, Wouter Castryck and Thomas Decru of KU Leuven posted «An Efficient Key Recovery Attack on SIDH» (IACR ePrint 2022/975). The first version broke SIKEp434 — the parameter set aimed at NIST security level 1 — in about 62 minutes on a single core of an Intel Xeon E5-2630v2, a CPU launched in 2013 (The Register, August 3, 2022). The final version of the paper, published at EUROCRYPT 2023, states about 10 minutes on a single core. Microsoft had posted a 50,000-dollar bounty on its SIKE challenge instances; the SIKEp182 and SIKEp217 challenges fell in roughly 4 and 6 minutes.

The mathematics is the part no one predicted. The attack rests on a reducibility criterion that Ernst Kani published in 1997 — the «glue-and-split» theorem, from a paper on genus-2 curves with elliptic differentials written with no cryptographic intent, since SIDH would not exist for another 14 years. SIDH, the protocol under SIKE, published auxiliary torsion-point images alongside every public key as part of its design; Castryck and Decru used Kani's criterion to turn exactly those auxiliary points into a key-recovery oracle, assuming knowledge of the endomorphism ring of the starting curve. On August 10, 2022, Damien Robert of Inria removed that assumption: «Breaking SIDH in polynomial time» (IACR ePrint 2022/1038) extended the break to a classical polynomial-time attack that works even with a random starting curve. The SIKE team conceded in a note that still sits on NIST's round-4 page: SIKE and SIDH «are insecure and should not be used».

One more measured fact completes the file: SIKE was not a paper scheme. It had been field-tested at Internet scale — Cloudflare and Google ran it in real TLS connections for 53 days between August and October 2019 (the CECPQ2b experiment, Chrome Canary/Dev as clients), always in hybrid with X25519. That detail will matter in a moment.

What exactly broke — and what did it leave standing?

The attacks broke specific structures, not whole families of mathematics — and the distinction is measurable in today's candidate lists.

The survivor's list is the half of this story that rarely gets told. On May 14, 2026, NIST advanced nine signature schemes to round 3 of its additional-signatures process. Four of the nine — UOV, MAYO, QR-UOV and SNOVA — are built on the same Oil-and-Vinegar design that Rainbow extended: the 1999 base survived the 2022 break of its most famous descendant. And the single isogeny-based candidate still standing, SQIsign, was redesigned using the same higher-dimensional isogeny machinery that the Castryck-Decru attack introduced — the mathematics that killed SIKE now powers the leading isogeny signature, which reaches 148-byte signatures at security category 1. SQIsign publishes no torsion points, which is why the 2022 oracle does not apply to it. Whether it survives round 3 will be known when NIST publishes its next report, in the future.

Was a quantum computer involved in any of this?

No. Zero quantum involvement, on both counts. Rainbow fell to a laptop; SIKE fell to one core of a 2013 server CPU running Magma. As of November 6, 2026, Rainbow remains the only NIST signature finalist ever fully broken and SIKE the only round-4 candidate ever fully broken — and both breaks were classical cryptanalysis.

The quantum side of the ledger, re-verified by Rosetta today: 0 RSA-2048 or ECC-256 keys broken by a quantum computer on the public record, and 0 public breaches attributed to a quantum attack. The largest RSA modulus ever factored remains a classical result: RSA-896, on September 19, 2026. The full dossier of that zero — what has actually been factored with Shor's algorithm and how far it sits from RSA-2048 — lives in its own piece in this series. The house's Q-Day position (RQ-PRED-QDAY-001: floor 2031, window 2033–2039) remains what it has always been: a sealed, refutable judgment, not a measurement.

What should a security leader do with this history?

Read 2022 as evidence that the vetting process works — and buy the insurance it points to. Four moves, in order.

First, register what did not happen: neither break was discovered after standardization, in deployed products, by an attacker. Both landed in public, before any final standard existed, with reproducible code. A CISO quoted at the time put it plainly: better discovered now than after it is standardized (Kevin Reed, in The Register's August 3, 2022 coverage). The counterfactual — a structural break found in a deployed standard — is precisely the scenario the multi-year, adversarial NIST process exists to make rare.

Second, hybridity is the insurance that has already paid out once. The only large-scale deployment SIKE ever had — the 2019 Cloudflare-Google TLS experiment — wrapped it with X25519 in the CECPQ2b construction. When SIKE fell in 2022, nothing recorded from that experiment became readable, because the classical half of every handshake still stood. Had SIKE-only traffic shipped at scale, every recorded session would be readable today — that is the harvest-now-decrypt-later scenario measured in this series' first piece. Today's deployed default, the X25519MLKEM768 hybrid built on ML-KEM, follows exactly the same logic; the mechanics and byte costs of that handshake will get a piece of their own in this series.

Third, ask the agility question in procurement, not the algorithm question. The measured history says candidates can fall in 53 hours or 25 days; the relevant question for your stack — developed in our crypto-agility explainer — is how long a swap would take you if a deployed algorithm had a 2022 of its own, a question that presupposes the cryptographic inventory, or CBOM, covered earlier in this series. No published measurement of enterprise swap time exists, which is itself a finding.

Fourth, treat diversity as policy, not paranoia. NIST selected HQC on March 11, 2025 explicitly as a backup KEM built on different mathematics than ML-KEM, with a final standard expected in 2027 — in the future, and declared, not guaranteed. A portfolio that assumes any single family might have a bad year is the institutional version of the hybrid handshake.

PQC Board — status as of 2026-11-06

The standing indicators Rosetta tracks for this series, with the latest reading of each and its source. Two were re-measured today; the rest show their most recent dated reading.

What we don't know

• Whether the standards now deployed harbor a structural weakness of SIKE's kind. This is unknowable in advance by anyone — it is the argument for hybrids and agility, not a prediction of failure.
• The base rate of future classical breaks. Two breaks in one year is a sample, not a rate; no published measurement of such a rate exists as of today.
• Whether SQIsign's redesign will survive round 3 of the additional-signatures process. NIST's report will come on its own schedule; no date is published as of November 6, 2026.
• What SIKE deployment would have looked like had the break arrived two years later. No published counterfactual exists; the only at-scale deployment datum is the 2019 hybrid experiment, which lasted 53 days.
• When HQC's final standard will actually land. NIST declared 2027 as the expectation; that is a declared date, not a measured one.
• Whether and when a cryptographically relevant quantum computer will arrive. The house window (floor 2031, window 2033–2039) remains a sealed, refutable judgment — the measured count of quantum-broken keys is still 0.

Rosetta Quantum publishes verdicts with raw, reproducible data and dated sources. This is educational content — not a product claim, not vendor advice, and not investment advice.