3 months ago
- Anthropic's Claude Mythos Preview discovered new attacks on cryptographic algorithms, including a significant weakening of the HAWK post-quantum digital signature scheme and an improved attack on reduced-round AES.
- The HAWK attack reduces its effective key strength by half, discovered in about 60 hours with minimal human guidance, while the AES attack improves the speed of previous best attacks by 200-800 times.
- Neither attack currently affects production systems: HAWK is only a candidate scheme, and the AES attack targets a weakened variant with fewer rounds.
- Claude operated mostly autonomously, with human researchers providing occasional guidance and spending weeks verifying results; each attack cost roughly $100,000 in API costs.
- Additional preliminary attacks were found on other ciphers like LEA (13 rounds) and Serpent-128 (6 rounds), with some achieving practical key recovery.
- The research highlights AI's potential to strengthen cryptographic review processes but also raises concerns about human capacity to validate AI-discovered findings at scale.
- Researchers followed responsible disclosure, shared results with NIST and algorithm authors, and released papers and a benchmark (CryptanalysisBench) to facilitate further LLM cryptanalysis studies.