If you haven’t seen the announcement, Anthropic was able to utilize Claude (Mythos Preview) to find cryptographic weaknesses in two algorithms. However, this doesn’t impact anything anyone has in production today. The research is interesting and something we should take note of, but nothing to panic about.
Here is the link to the Anthropic announcement: https://www.anthropic.com/research/discovering-cryptographic-weaknesses
The weaknesses were found in the following:
- HAWK: A post quantum cryptography (PQC) algorithm that is a candidate in the NIST contest for PQC algorithms that can withstand quantum computing advances.
- AES: AES but not at full strength. Specifically, an AES version which is much weaker, often used for research purposes.
That being said, here’s why the sky isn’t falling:
- HAWK:
- This isn’t in production. It’s a candidate algorithm.
- The attack roughly cuts the time to crack in half.
- Doubling the key size restores the status quo.
- Anthropic argues that doubling the key size makes the algorithm less attractive for selection in the long run.
- There are other candidate algorithms.
- AES
- AES uses a round function to encrypt.
- AES-128 executes that round function 10 times. AES-256 executes the round function 14 times.
- The success attack was against a form of AES that only executed 7 times.
- The attack sped up the ability to crack by 200-800 times.
- That sounds like a lot until you consider that the current estimate to crack AES-128 is around a billion years.
It’s impressive that Anthropic was able to turn AI loose to try and attack the algorithms. The logical outcome is for AI to be leveraged to try and find weaknesses in our crypto, potentially finding improvements, and making data more secure as a result. That being said, the findings from this recent research doesn’t indicate any cause to panic. The sky isn’t falling.