On July 28th Anthropic announced new cryptanalytic attacks discovered utilizing their LLM Claude Mythos:
A key-recovery attack connected HAWK, a post-quantum signature strategy campaigner successful NIST’s “Additional Digital Signatures” standardization project. Except for the artifact type HAWK-256 whose 64-bit information is practically breakable, the new onslaught is not practical. But it's a meaningful break of HAWK’s security, arsenic it reduces the estimated information level of HAWK-512 from its 128-bit target to astatine astir 108 bits and, speculatively, arsenic small arsenic 81 (see Appendix C of the paper.)
An improved key-recovery onslaught connected 7-round AES-128, while the afloat type does 10 rounds. The onslaught is , and wholly not a surprise, posing no threat to AES. But since caller cryptanalytic results for AES are rare, this consequence is noteworthy sloppy of the measurement it was found. The antagonistic consequence is, perhaps, much significant: Mythos recovered nary stronger attack, fto unsocial against full-round AES.
In the AES onslaught paper, Anthropic writes “We judge that further exploring the guidance of LLM-assisted cryptography investigation is interesting—particularly successful cases wherever the attacks developed are computationally intractable to instrumentality and require that the connection exemplary show its correctness done a operation of approaches. One guidance we judge to beryllium peculiarly important is to formalize the onslaught techniques utilized successful the cryptographic community.”
I work together pinch that, notably the past statement: symmetric cryptanalysis needs much unified descriptive frameworks and abstraction; excessively galore papers usage advertisement hoc formalism and civilization notations and terminology erstwhile they’re fundamentally doing the aforesaid point arsenic others.
I besides expect LLMs to find errors successful cryptanalytic attacks’ complexity estimates and successful information proofs. Earlier this twelvemonth I asked LLMs to find bugs successful information proofs of EUROCRYPT 2026 papers and they recovered issues successful astir of the proofs (showing that the proof, though not needfully the result, was incorrect.)
Anthropic besides helped create CryptanalysisBench, an LLM benchmark comprising cryptanalysis tasks connected full- and reduced-round versions of AES, ChaCha, and connected algorithms submitted to NIST’s competitions—like BLAKE—including post-quantum schemes.
If you’re unfamiliar pinch cryptanalysis, it’s not unreasonable to wonderment whether LLMs could break AES, ChaCha, SHA-3, and different symmetric algorithms successful usage today—as a friend asked me, “aren’t you worried that Mythos could break BLAKE3?”. I’m not.
More broadly, I’m assured that LLMs won’t break immoderate of the established cryptographic schemes, and won’t disprove Too Much Crypto’s conjectures.
In an fantabulous post, Matthew Green writes [with my notes] that “our symmetric ciphers [block/stream ciphers but besides hash functions and MACs] are very messy [again, nary “unified theory”] and robust [empirically so; much connected this later]. Imagine a husbandman who drags a tractor retired into a spot of quicksand, and past buries it nether cement. That’s what symmetric cipher creation is like; it’s deliberately designed to travel up pinch structures that are speedy and easy to use [typically, a round’s operations], but very messy and difficult to untangle [as you iterate rounds]. The summation of galore caller earthy intelligence-hours astir apt aren’t going to magically amended this.”
I'd for illustration to elaborate connected what Matt calls messiness and structure, and why these are cardinal reasons why LLMs won’t find a applicable collision onslaught connected SHA-3 aliases BLAKE3.
So, why LLMs won’t break symmetric crypto? In largely-but-not-totally-arbitrary order:
Their high-level building is secure: Here I mean constructions specified arsenic the GCM and CTR modes of cognition for artifact ciphers and hash-function modes specified arsenic the sponge construction. I besides see the round-based building of the keyed aliases unkeyed permutations astatine the halfway of astir symmetric schemes—though not each of them; Poly1305, for example, isn’t round-based.
They person nary mathematical structure. Unlike actual mathematics problems and dissimilar astir public-key schemes, symmetric ciphers can’t mostly beryllium described arsenic cleanable transforms wrong a mathematical structure—structure that allows reduction-based information proofs, but besides what whitethorn beryllium exploited for cryptanalysis (an objection is arithmetization-oriented primitives and successful peculiar alleged algebraic hash functions, specified arsenic Poseidon, arsenic utilized successful ZK impervious systems and FHE; different objection is VSH, a hash usability based connected RSA-like operations, which was proved collision-resistant but turned retired not to beryllium preimage resistant, showing structure’s double edge.) When designing a hash usability aliases artifact cipher, your extremity is to destruct immoderate structure, symmetry, aliases shape that would fto an attacker picture the computation arsenic thing simpler than the apparently senseless series of simple operations it performs. BLAKE3, for example, is fundamentally a agelong series of XORs, modular additions, and spot rotations. There’s nary different measurement to picture it. There’s nary evident abstraction to navigate aliases high-level building to logic about: XOR destroys linearity pinch respect to modular addition, while modular summation destroys linearity pinch respect to XOR. Consider the n-bit permutation of a sponge building arsenic a bijection complete GF(2)ⁿ: its practice arsenic a strategy of multivariate equations complete GF(2) is expected to person nary singular structure: maximal degree, a precocious density of monomials, and truthful on. The aforesaid should clasp for representations complete different fields. That’s Matt’s thought of messiness.
It’s mostly differential cryptanalysis. Whether it’s linear cryptanalysis, rectangle attacks, boomerang attacks, merge attacks, cube attacks, arsenic good arsenic descent attacks and astir cryptanalysis tricks, each are forms of differential cryptanalysis: they utilization input–output patterns of the shape “if we use this quality successful the input [wrt immoderate operator, typically XOR], past the output [of immoderate constituent of the cipher] statistically deviates from the ideal/expected case.” For example, collision attacks connected SHA-1 exploited that immoderate differentials has exceptionally precocious probability, while intolerable differential techniques utilization probability-zero differentials. If a symmetric primitive's mode is (proved) secure, past very small other to do than differential cryptanalysis. This territory has already been explored extensively; LLMs are truthful improbable to observe wholly caller classes of attack.
Differential cryptanalysis is empirical, astatine slightest partially. In galore cases cryptanalysts find statistical biases by moving experiments without knowing precisely why those biases exist. After watching comparatively ample biases, for illustration 2-10, they whitethorn infer the beingness of smaller biases that would require excessively galore samples to measurement reliably but could nevertheless beryllium exploited successful an attack. I’m not claiming that an LLM cannot tally specified experiments, but the request to design, execute, and construe them makes its task much difficult.
They’re time- and battle-tested: These designs person received thousands of hours of cryptanalytic scrutiny, astir of it unsuccessful and truthful unpublished. Researchers person applied quality ingenuity, creativity, and immense amounts of computation to hunt for biased statistic and to execute automated study and sometimes general verification. And what person they found? Mostly the predictable consequence that reduced-round variants are easier to break, while the spot of the algorithms increases dramatically arsenic rounds are added.
As a friend commented, "it's benignant of a humanities quirk that we had unsafe symmetric crypto." Symmetry cryptography is the strongest portion of our information systems, frankincense LLM tokens are overmuch amended spent uncovering bugs elsewhere, including successful underanalyzed post-quantum standardization candidates.
Featured image: Peter Bruebel, The Fall of the Rebel Angels (detail)
English (US) · 
Indonesian (ID) ·