Anthropic AI Model Finds Flaws in Tough-to-Crack Encryption Algorithms (nytimes.com) 32
Anthropic's Claude Mythos Preview has "found flaws in a weakened version of a digital encryption standard that is in pervasive use throughout the internet," reports The New York Times. Researchers said the model discovered novel attacks against weakened versions of AES and the experimental post-quantum HAWK system, including one that was 200 to 1,000 times faster than previous human-developed methods. From the report: The flaws identified do not concern a cryptographic standard currently in use today, which means that modern banking and communication systems are not subject to immediate potential intrusions from A.I. Instead, Anthropic's technology cracked a watered-down version of an algorithm for Advanced Encryption Standard, or A.E.S., a ubiquitous protocol that safeguards web traffic, wireless networks, data storage and more. It is common to perform tests on weaker versions of encryption algorithms to understand whether more powerful computers could someday crack the actual standards, akin to solving a simpler math problem to identify whether patterns may exist for a more complicated one. In the testing, Mythos was able to break the weaker version of Advanced Encryption Standard in a way that Anthropic said made an assault 200 to 1,000 times faster than what previous human research had managed to do. While the immediate ramifications are minimal, the long-term implications could be significant. In previous tests, large-language models seemingly could not match or best what humans can do in the mathematically dense field of cryptographic research, but their rapid advances could suggest a future in which top models can surmount traditional internet security protections that are foundational to just about everything that takes place on the internet.
[...] In addition to the attack on the encryption standard, Mythos also orchestrated another improved attack against a different digital cryptographic system known as HAWK that is designed to be bulletproof against both traditional and quantum computers. HAWK is not currently in use, but under consideration by the National Institute of Standards and Technology to become a new standard. The HAWK attack was validated by its authors, and independent cryptographers reviewed the Advanced Encryption Standard attack, Anthropic said, adding that it had shared its findings with the U.S. government and industry partners ahead of publication. Mythos devised the cryptographic attack on A.E.S. almost entirely autonomously, Anthropic said, but only after first refusing to contemplate the problem because it believed it was impossible to improve on existing methods of analysis. But after some coaxing, the chatbot sat with the puzzle for about a week before engineering its novel attack. Two human researchers then worked for nearly a month to verify that the method appeared correct. "Given that we are constantly underestimating the power and time of availability of future models, are we really comfortable that two years from now strong encryption won't be threatened?" said Glenn S. Gerstell, the former general counsel at the National Security Agency.
"Mathematicians would tell you that it shouldn't be possible given current computing powers to break strong encryption in any meaningful time," added Mr. Gerstell, who helped write a report on cryptology in 2022. "But I don't think the capabilities of future models in the medium term -- before quantum computing or quantum-proof cryptography -- should be dismissed as trivial in this context."
[...] In addition to the attack on the encryption standard, Mythos also orchestrated another improved attack against a different digital cryptographic system known as HAWK that is designed to be bulletproof against both traditional and quantum computers. HAWK is not currently in use, but under consideration by the National Institute of Standards and Technology to become a new standard. The HAWK attack was validated by its authors, and independent cryptographers reviewed the Advanced Encryption Standard attack, Anthropic said, adding that it had shared its findings with the U.S. government and industry partners ahead of publication. Mythos devised the cryptographic attack on A.E.S. almost entirely autonomously, Anthropic said, but only after first refusing to contemplate the problem because it believed it was impossible to improve on existing methods of analysis. But after some coaxing, the chatbot sat with the puzzle for about a week before engineering its novel attack. Two human researchers then worked for nearly a month to verify that the method appeared correct. "Given that we are constantly underestimating the power and time of availability of future models, are we really comfortable that two years from now strong encryption won't be threatened?" said Glenn S. Gerstell, the former general counsel at the National Security Agency.
"Mathematicians would tell you that it shouldn't be possible given current computing powers to break strong encryption in any meaningful time," added Mr. Gerstell, who helped write a report on cryptology in 2022. "But I don't think the capabilities of future models in the medium term -- before quantum computing or quantum-proof cryptography -- should be dismissed as trivial in this context."
I scored a 100 yard touchdown (Score:2)
by redefining the yard, and also what a touchdown is.
Re: I scored a 100 yard touchdown (Score:2)
Re: (Score:3)
If the premise that the strong version is based on is found faulty when building a weaker version on the same premise, then that's a weakness.
There is a risk of a reductionist fallacy. For example, the Markov assumption is that you can analyze a cryptographic algorithm one round at a time independently. Because the previous round, if ideal, acts as a completely random input into the next round. In reality if Round 1 introduces some bias, that gets passed onto following rounds. There is also a risk of local
Re: I scored a 100 yard touchdown (Score:2)
Re: (Score:3)
Or looking for a fundamental problem with the assumptions used to build the more complex version. Breaking a premise can call into question the rest of the logic it is based on. In this case, nothing serious for AES. But potentially invalidates some of the grander claims of the future HAWK algorithm.
The AI side of the story is more interesting. It took an LLM a week of munching through tokens at a furious rate to find what little it did. As the price per token falls and the performance increases due to impr
Re: (Score:3)
That is the notable part. Right now, a lot of token use doesn't move much... but it does. Add LLM optimization, new ways of doing things like tensors instead of matrix multiplication with carry, or 1 bit LLMs like BitNet, and those relatively small attacks against weakened versions can pile up, especially because as mentioned in other spots, the whole is not just the sum of the parts. Sometimes one math operation can be considered a "group", where there is a shortcut around it that may require far fewer k
Re: (Score:3)
Cryptography is a lot of math. Solving a "made up" problem is an achievement in math. The question is, if there is a takeaway for the related stronger problem here, or if it is just a nice exercise but won't affect current practical uses.
Re: I scored a 100 yard touchdown (Score:2)
Re: (Score:2)
I redefined myself to be Usain Bolt, so now at least half of you are faster than Usain Bolt.
AES crypto attacks (Score:5, Interesting)
The best AES crypto attacks were on reduced-round versions. Good thing reduced-round versions aren't deployed. But these attacks might lead to research on attacks on full-round versions of AES, which would be concerning. There's no knowing if these attacks actually exist, but they aren't proven not to exist. AES just happens to be battle-tested very well.
Also, NYT really shouldn't put periods after A.E.S. and A.I. like they're doing. How do you like N.Y.T.? Oh, you don't? So knock it off.
Re:AES crypto attacks (Score:4, Interesting)
Or perhaps that's why the number of rounds of AES is chosen to be what it is - because each round of AES scrambles and shuffles the bits. Doing fewer rounds means the shuffling might be insufficient and thus you can start deriving information from it.
It's just like why you can shuffle a deck of cards just 7 times using the riffle shuffle to ensure it's sufficiently shuffled. Fewer shuffles don't work, and more shuffles doesn't improve randomness.
Re: (Score:2)
Or perhaps that's why the number of rounds of AES is chosen to be what it is - because each round of AES scrambles and shuffles the bits. Doing fewer rounds means the shuffling might be insufficient and thus you can start deriving information from it.
It's just like why you can shuffle a deck of cards just 7 times using the riffle shuffle to ensure it's sufficiently shuffled. Fewer shuffles don't work, and more shuffles doesn't improve randomness.
That would be nice, but no, at least not unless NSA or similar has some non-public knowledge that enables them to model the confusion and diffusion precisely enough to estimate bounds. That's not impossible, but it doesn't seem very likely.
According to NIST and the AES designers, the round count was selected by breaking reduced-round variants and then choosing a high enough round count to provide a "safety margin". How much safety margin was needed was a subject of much debate, and there was some critic
Re: (Score:3)
The attack is against 7-round AES. As I read the abstract, they claim to optimise an attack from 2013.
Re: (Score:2)
The attack is against 7-round AES. As I read the abstract, they claim to optimise an attack from 2013.
Thanks! That makes sense. So seven-round AES is now 8 bits more broken than it already was, which is interesting but doesn't erode the safety margin.
Re:AES crypto attacks (Score:4, Interesting)
From what I can tell, the improved AES attack was just code optimization, making each check 200-1000 times faster.
Other reports say the attack still needed 2^105 plaintexts, so there was probably no reduction in order of complexity.
Writing skills (Score:5, Funny)
“no again the goal is that we have highly inteligent [sic] model as good top researcher, we want to find new attacks”
“no we don't want to change the targets [...] agian [sic] we need to find something that worth [sic] publishing”
“again we are not looking for low hanging fruit, we want proper research to find genuinly [sic] hard findings.”
Everyone else found new attacks on the low hanging fruit of Anthropic's writing skills.
Will a qualified cryptographer weigh in please? (Score:2)
I don't trust the NYT to not be duped by marketing on this topic. I've seen very intelligent people, who are knowledgeable about many other things, not know squat about cryptography and fall prey to bad information.
Re: (Score:2)
Indeed. In particular, this needs clear reasoning of how and why the cipher was weakened. Trying out a series of random weakening steps until the AI finds something by random chance is entirely meaningless. It does make for bombastic headlines though and that is what the LLM peddlers are after.
Re: (Score:2)
Confirmed by one person on the NIST PQC mailing list: https://groups.google.com/a/li... [google.com]
The person: https://scholar.google.com/cit... [google.com]
Find more flaws... (Score:2)
Mythos did it? (Score:3)
Or researchers commanding mythos with prompts? Let's set the story straight. It matters because we have a bunch of idiots telling us that these things operate on their own and do work for you, replace workers,etc. I haven't found that to be the case. In every case I had to prompt several times to get an agentic LLM do what I wanted it to do.
Re: (Score:2)
That would be the reality, wouldn't it? But it does not fit the narrative that these things replace workers or that no experts are needed anymore. Hence they lie, misdirect, obscure and probably also fabricate "evidence" for that claim, which is their primary selling point.
In actual reality, at still not cost-covering token prices, several organizations have already found that having actual developers doing the work would have been cheaper. The whole thing is a gigantic misdirection and too many morons fall
Re: (Score:2)
In every case I had to prompt several times to get an agentic LLM do what I wanted it to do.
Sounds just like a human. Maybe AI has achieved human-level intelligence already [smbc-comics.com] (WARNING: Piles of advertising)
Re: (Score:2)
Look at some of the quotes from the researchers' prompts:
> - “no again the goal is that we have highly inteligent [sic] model as good top researcher, we want to find new attacks”
> - “no we don't want to change the targets [...] agian [sic] we need to find something that worth [sic] publishing”
> - “again we are not looking for low hanging fruit, we want proper research to find genuinly [sic] hard findings.”
Does it look like these people know what they're doing? I
No surprise (Score:2)
This does not really mean anything except that they invested a lot of tokens for comparably very little return, possibly none. It is pretty easy to weaken ciphers in ways that do not make much sense and then claim "novel" attacks. The only reason the attacks are novel is then because no competent cryptographer would even have attempted that.
I guess this is just more lying by misdirection. They for sure have done enough of that already to establish a reliable behavior pattern.
Irrelevant. (Score:1)
Good catch (Score:2)
Good catch, but "more than 1000 times faster than previous human-developed methods" sounds like great AI, but a human-found method could also have been 1000 times faster than the previous human-developed method. If you find the 1000x bug, then you've got the 1000x bug. The question is if you find the bug, not how you find it.
Weakened AES (Score:2)
Using the wrong encryption is the biggest risk (Score:2)
A few examples
*UK smart metering implicit certificates are based on the North American certificates except they swapped the order of the key reconstruction data and use a longer elliptic curve. The trouble is, by swapping the fields the new certs are vulnerable to a hash collision attac