LLMs won't break symmetric crypto

Join the discussion

• Hacker News
• why break RSA or AES when you can just subpoena/hack Cloudflare?
  by biosboiii
• This is kind of a stupid argument. How about make a slightly stronger claim like "models won't break symmetric crypto" ? I mean, language models aren't even trained to break symmetric crypto. There is not good reason to think they will. It seems possible to train a large model to do it though.
  by danielmarkbruce
• Agreed that many of the articles claims are a bit weak. One point is reasonably strong though: symmetric crypto may not be breakable (battle tested).
  by catlifeonmars
• To train a large model to do what? Break AES? How would that work?
  by tptacek
• Microsoft uses formal verification of their encryption code in production using SymCrypt.
  by bahmboo
• > They’re time- and battle-tested

  All conjectures are until someone with the time and energy proves or disproves them.

  by amingilani
• What about checking crypto libraries for gaps like the coldcard situation of RNG code is correct but not in the release build somehow?
  by dsp_person
• That was such a stupid coding/code review/testing mistake. Finding it is not that impressive at all. It's nothing like finding a flaw in AES
  by krupan
• breaking some of these systems that humanity has been banging on for decades would be an elegant proof that the llms have outsampled us decisively. one word at a time, which is how we write too.
  by coderatlarge
• LLMs will accelerate math research, increasing understanding in areas like quantum which will eventually lead to breakthroughs that will break most standard asymmetric encryption algorithms with the side effect of breaking crypto
  by arberx
• Arvin Krishna says 4 years
  by tiahura
• There are plenty of algorithms that quantum algorithms give no benefit to. Quantum is NOT a free for all making everything faster. It’s only faster at two very,very restricted things: hidden subgroup problem (which is used for RSA, but most problems do not rely on HSP), and Grover search, which reduces a specific search problem from O(N) to O(sqrtN).
  by SideQuark
• What makes your prediction more likely than:

  "LLMs will accelerate math research, allowing us to prove that meaningfully sized quantum computers are impossible and crypto is secure. Modern cryptographic algorithms remains unbroken until the last human is turned into a paperclip in the year 2430"

  by TheDong
• Right, maybe, but Aumasson's whole point is that this prediction doesn't apply to AES, SHA2, BLAKE2, &c.
  by tptacek
• Breaking modern encryption comes down to being in control of key generation rather than brute force. Other than that you'll have a hard time bute forcing 2^256 possibilities.

  Comes down to a gut feeling but I lean that this stuff is already all figured out.

  by smalltorch
• symmetric crypto typically wants the eat the cake and have it too, it wants to be both secure and efficient.

  to that end, a so-called "security margin" is guessed at and the number of rounds of the cipher is determined accordingly.

  it is certainly possible for an LLM to prove that the guess was wrong and everything that it implies.

  having said that, the security of symmetric cryptography relies on the fact that you cannot unwind (find initial conditions) a sufficiently chaotic system in the discrete domain. for example, SHA256 with 512 rounds will almost certainly count as sufficiently chaotic by any definition but it wouldn't be as efficient as the current 64 rounds.

  it is often said that it's difficult to come up with a secure symmetric cipher on your own, but assuming you know what you are doing it's quite easy. the hard part is to have enough confidence in it to make it efficient.

  by teravor
• This is JP Aumasson, the co-author of BLAKE2 and BLAKE3. Aumasson is notorious in cryptography circles for his "too much crypto" argument, that modern symmetric cryptography is overly conservative, running more rounds than are necessary given the very low likelihood that advances in computer science are going make a real dent in them.

  A distinction a lot of comments in this thread aren't picking up on is the mechanisms that make most asymmetric cryptography work, versus those of symmetric cryptography. Asymmetric constructions like RSA and ECDH are simple mathematical objects, and their security depends on assumptions we make about advanced algebra, number theory, &c. It's plausible to imagine we could discover something about discrete logs that would destabilize DH. It's less plausible to imagine something like that happen to AES, which is deliberately designed not to have clean structure.

  by tptacek
• I don't really find the "because it's difficult" arguments convincing at all. Especially the one claiming it's hard because it requires designing and running a large number of tests and reasoning about the results of each one. That kind of tedious grinding is exactly where LLMs should shine vs humans!

  The only convincing argument here is that these things are battle tested (literally in most cases I would guess), with tons of research that never gets published because it's unsuccessful. A whole lot of human effort has gone into trying to break these things. A lot more than went into any of the math problems AI has solved so far. It's going to take a while before LLMs can equal and surpass that amount of human effort. And they might have to surpass it by many, many times to actually break these, if it is even possible, which is not certain.

  by modeless
• I read it as "because there are no viable attacks", which is...fightin' talk I suppose.

  What I have seen LLMs do recently is find what turned out to be very basic bugs in encryption and ZK libraries that for some reason humans never saw. In those cases it wasn't that the encryption algorithms were broken per se, but the the implementation was.

  This alone seems very worthwhile.

  by dboreham
• There are very few computer-era symmetric ciphers that were truly broken. RC4 is probably the worst example.

  There are no reasonable attacks even on the good old DES. And by "reasonable" I mean attacks that would bring down the complexity to a practical level if the DES key size were to be extended to something like 128 bits. We can brute-force DES keys trivially, but that's not a fault of the cipher per se.

  by cyberax
• Cryptographic systems are based on 1) mathematical impossibility of reversing some integer/mod calculation, 2) time required for a brute force attack, 3) correctness of algorithms and code used in implementations. The last part (algorithms and code) is where LLMs have a chance.

  The first one is not similar to the mathematical breakthroughs LLMs are making recently. There is a loss of information in mods and integer computations making them one-way. The second one requires simply increasing bit-length to match the increased computer power.

  by zkmon
• Yeah, I wouldn’t say with certainty that LLMs will never break any symmetrical crypto algorithm. It will certainly require a lot of effort, but so does solving some hard math challenges and it has been proven successful in that in the past.

  Most likely outcome will be that a security researcher is able to break one with assistance of / in collaboration with an LLM.

  by stingraycharles
• > mathematical impossibility of reversing some integer/mod calculation

  No, there's no proof that most crypto "calculations" are impossible to reverse. That's why algorithms got weakened by researchers regularly. As of now, it's totally possible someone finds an algorithm to break a next one tomorrow. They just haven't found it yet.

  by deepsun
• > 1) mathematical impossibility of reversing some integer/mod calculation

  You are describing asymmetric encryption. This article was talking about symmetric encryption.

  Symmetric encryption is generally considered much harder to break than asymmetric encryption

  by j16sdiz
• > mathematical impossibility of reversing some integer/mod calculation > There is a loss of information in mods and integer computations making them one-way

  That's not correct. Trapdoor functions aren't one way because they destroy information, and if they were they wouldn't be very useful because you wouldn't be able to go back the other way (i.e. decrypt the text). You'd end up with many possible inputs for a given output, like a hash.

  by mindwok