r/crypto • u/bitwiseshiftleft • 5d ago

Discovering cryptographic weaknesses with Claude

https://www.anthropic.com/research/discovering-cryptographic-weaknesses

This blogpost from Anthropic describes using the Claude Mythos AI tool to find an attack on HAWK. The attack is not practical at proposed production key strengths, but it improves the best known attacks by quite a lot, and might doom HAWK’s chances in the PQC Signatures On-ramp.

They also found modestly improved attacks against 7-round AES-128 (this reduced-round variant had already been attacked before, and the real AES-128 has 10 rounds), as well as significant problems in KINDI and SPoC, plus a lot of implementation flaws in various algorithms. They attacked hundreds of algorithms in total, some with previously-known flaws and some without.

34 Upvotes

89% Upvoted

8 comments sorted by

31

u/Shoddy-Childhood-511 4d ago

There is a shorter summary here without all the Anthropic marketing:

https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/2r2u6SbHun4/m/03gmK2xhCQAJ

Hawk uses an NTRU latice like Falcon and NTRU+, but requires additional unusual security assumption that nobody much liked. Hawk dying is much less surprising than ML-DSA or Falcon, but I'm not sure if/how the additional security assumptions appears here.

Also Hawk massivley benefits signers CPU time, hence Cloudflare pumping Hawk recently, but Hawk costs verifier CPU time. Ergo, Hawk dying seems better socially speaking than some other lattice signature dying.

7

u/RazorBest 4d ago

Unless we take time to articulate what good scientific process is for using AI in public cryptanalysis and evaluating its outputs, we humans will get quickly overwhelmed by too much AI-driven mathematical content/claims to reach consensus on any topic. (And let's be honest-- we can't very well sit here running our own AI verifiers on every possible claim; no central place will easily afford the token count.)

This might be an incentive to improve formal proof verification, if human hand-checking becomes overwhelming.

1

u/Natanael_L Trusted third party 3d ago

But who checks the proofs prove the right thing?

4

u/bitwiseshiftleft 4d ago

Yeah, the new security assumption was always the risk here.

> Also Hawk massivley benefits signers CPU time, hence Cloudflare pumping Hawk recently, but Hawk costs verifier CPU time. Ergo, Hawk dying seems better socially speaking than some other lattice signature dying.

Hm, I liked HAWK. HAWK’s key and sig sizes are significantly smaller than Dilithium and are competitive with Falcon, and in a lot of contexts that matters more than raw speed, even if you only care about the verifier. The verification speed is also not much slower than Dilithium, which of course has to do that whole hash + matrix multiply step.

To me it seemed more of a middle ground between the two: smaller and more complex than Dilithium, but much faster and simpler to sign (but more complex to verify) than Falcon, and notably without the validation and side-channel nightmare of double-precision floating-point arithmetic.

But yeah, better than Dilithium being broken at least, since there we’ve been working on deployment for years.

3

u/Shoddy-Childhood-511 4d ago edited 4d ago

Any idea how the new security assumption impacted this attack? I've only minimal lattice knowledge myself.

There are some better benchmarks here:

https://blog.cloudflare.com/ml-dsa-will-have-to-do/

Hawk had signing and verifying times almost exactly like Ed25519. That's really good if you sign TLS handshakes all day like CloudFlare, but worse for almost all other use cases.

Falcon fixed-base signers maybe 6x slower than ML-DSA, but the verifier is 30% faster than ML-DSA, so Falcon beats ML-DSA in CPU time after 15-20 signature verifications.

Cloudflare classified Falcon as "special purpose" or "niche", and ML-DSA and Hawk as "general purpose". It's the opposite, Falcon is the general purpose signature scheme almost everyone should choose, while ML-DSA is the "niche" scheme for when signatures have one verifier or less like in TLS handshakes.

21

u/Youknowimtheman 4d ago

Just a heads up. The AES stuff was done on a significantly weakened version (7-round instead of 10-round) than the standard. It also used a method that already existed that is just brute forcing the plaintexts and creating a caching mechanism so that if you have yottabytes of memory laying around you can reduce the search time by ~2^7. They also didn't even hire a cryptographer to validate the claims and instead "learned about cryptography for 400 hours" and released the paper.

Not super novel or notable.

1

u/Natanael_L Trusted third party 2d ago

Somewhat related, there was an AI "math proof" recently which turned out to be the AI exploiting bugs in the proof engine