It is possible to estimate the cryptographic security of tropical cryptography without directly attacking it. To evaluate the security of tropical cryptography, we need to estimate whether tropical algebras contain the right kind of mathematical structure to be considered secure. I claim that tropical algebras do not have the right kind of mathematical structure for cryptographic security.
Define a operations $\oplus_\epsilon$ on $\mathbb{R}$ by setting $x\oplus_\epsilon y=\log_\epsilon(\epsilon^x+\epsilon^y)$. Then $x\oplus y=\lim_{\epsilon\rightarrow 0}x\oplus_\epsilon y$.
Therefore, the tropical semiring $(\mathbb{R},\oplus,\otimes)$ is a limit of the ring $(\mathbb{R},\oplus_\epsilon,\otimes)$ as $\epsilon\rightarrow 0$, but $(\mathbb{R},\oplus_\epsilon,\otimes)$ is isomorphic to $(\mathbb{R},+,\cdot)$. In general, the process of taking a limit decreases the cryptographic security of the underlying ring. The process of simplifying $(\mathbb{R},+,\cdot)$ to $(\mathbb{R},\oplus_\epsilon,\otimes)$ should be contrasted with the process of simplifying $\mathbb{Z}$ to the finite field $\mathbb{F}_p$ by taking a quotient modulo a maximal ideal. For cryptography, one should prefer algebraic structures that are finite and simple (by simple, I mean that the structure has no non-trivial quotient structures). If $X$ is a non-simple algebraic structure, then one may try to break a cryptosystem based on $X$ by first breaking $X$ in quotient structures $X/\simeq$ and then by using the information in $X/\simeq$ to break the cryptosystem in $X$. Therefore, the simplicity of $\mathbb{F}_q$ makes $\mathbb{F}_q$ a more secure platform than $\mathbb{Z}$.
One can show that the tropical semiring $(\mathbb{R},\oplus,\otimes)$ is simple by first showing that if $\simeq$ is a congruence on $(\mathbb{R},\oplus)$ and $x\leq y\leq z,x\simeq z$, then $x\simeq y$. While the tropical semiring $(\mathbb{R},\oplus,\otimes)$ is still simple, the tropical semiring $(\mathbb{R},\oplus,\otimes)$ is a degenerate form of $\mathbb{R}$.
On the other hand, the field of complex numbers is isomorphic to an ultraproduct
$\prod_{p\in P}\overline{\mathbb{F}_p}$ where $P$ is the set of all primes and $\overline{K}$ denotes the algebraic closure of $K$. In other words, one can recover all the information from the field of complex numbers from the algebraic closures of finite fields, so finite fields are not that much simpler than the field of real or complex numbers. I would therefore prefer finite fields to tropical semirings since tropical semirings exhibit a level of degeneracy that we do not find in finite fields.
While tropical semirings exhibit some degeneracy, they can still be useful and they still exhibit complicated behavior. For example, neural networks with ReLU activation are essentially just $n$-th roots of rational functions over the tropical semiring $(\mathbb{R},\oplus,\otimes)$.
Observation 0: Tropical matrix exponentiation:
If $(v_{i,j})_{i,j}$ is a square tropical matrix and is the adjacency matrix for a directed graph (where directed loops have possibly zero weight), then
$(v_{i,j})_{i,j}^n=(u_{i,j})_{i,j}$ where $u_{i,j}$ is the weight of the shortest path from $i$ to $j$. Now if $v_{i,j}\geq 0$ and $v_{i,i}=0$ for all $i$, then the $(v_{i,j})_{i,j}^m=(v_{i,j})_{i,j}^n$ whenever $m,n$ are at least as large as the number of nodes in the graph. This means that matrix exponentiation is eventually constant in this case.
Observation 1: The operation $\oplus$ is commutative, associative, and idempotent. In other words, the $\oplus$ operation is the meet operation on a semilattice, and this semilattice is totally ordered. Lattice operations do not have the characteristics that we want for cryptography because they are too simple and lack the invertibility that algebraic structures like group have.
Observation 2: Every tropical polynomial function of several variables is concave (and much more). It is hard to get cryptographic security when one does not have access to non-concave functions.
Observation 3: Tropical matrix multiplication is non-avalanching. If $A_0,\dots,A_{2r},B_0,\dots,B_{2r}$ are tropical matrices, and $A_i=B_i$ for $i\neq r$, and $A_r,B_r$ differ by only a few entries, then
$A_0\otimes\dots\otimes A_{2r},B_0\otimes\dots\otimes B_{2r}$ will closely resemble each other.
Tropical algebras do not bear much resemblance to the type of mathematical structure that is useful for cryptography. And some tropical cryptosystems have been broken in the past, so I would not bet too highly on the security of tropical cryptography. It is interesting to study tropical cryptography though since tropical cryptography can at least tell us what kinds of structures are good for cryptography and what kinds are not.
