Anthropic's AI Discovers Cryptographic Weaknesses in HAWK and AES
Some thoughts about Anthropic's new cryptanalysis results
Anthropic's unreleased Claude Mythos model recently uncovered significant vulnerabilities in the HAWK signature scheme and improved attacks on reduced-round AES. While the HAWK result threatens a proposed standard by halving its security, the AES finding remains theoretical. These breakthroughs highlight AI's growing ability to synthesize existing tools into new attacks, shifting the bottleneck from discovery to human verification.
What makes this genuinely interesting — and, frankly, a little embarrassing for the field — is that none of the ingredients are exotic.
- simonw
This is good:
> If you’re under the impression that these models are “glorified autocomplete” or that progress is slowing down, I need to urge you: stop thinking that. The models are very intelligent and capable, they are getting better at a fast clip. I can cite measurable and impressive progress over just the past five months on specific types of problem I’ve asked them to look at. [...]
> On the other hand: if you think that models are super-intelligent or that AGI is already here, you should also stop thinking that. Working with these tools is like swimming in a pond where the ground drops off sharply. One minute you’re wading comfortably and there’s support under your feet. Then suddenly you cross a specific line, and you’re back to swimming on your own.
- simonw
> both outputs of Claude Mythos, their (still) unreleased advanced model
That sentence gives the impression that Mythos might be released in the future. That's clearly not going to happen - it's already "released" in as much as selected, trusted partners can access it, and the rest of us get it in the form of Fable - which is Mythos but with filters that downgrade you if you try to use it for anything even remotely related to cybersecurity or biology.
(The other day Fable 5 downgraded me to Opus after I asked it to explain the difference between tusks and teeth.)
- john_strinlai
>They [anthropic] appear to have just told it to get some results and then strapped its nose to the grindstone until it found some.
it is fun how well this works.
i cant find the link immediately (will look and edit with it), but somewhere in the "hello there the jacobian conjecture is false thanx" thread, someone brought up a different conjecture breakthrough where the prompts were basically just repeated "no, keep going" until a result was found.
edit: https://chatgpt.com/share/6a60b2eb-0b64-83ee-9c76-7931ca1de0...
i especially like "you should do a breakthrough". each prompt is less than ~20 words. makes me really question the whole "prompt engineering" stuff.
- bawolff
The prompt used to get this result is pretty crazy.
- mkagenius
I also just finished writing a note - https://mkagenius.substack.com/p/notes-on-mythos-breaking-ae...
- iansmith_hn
Does anybody have a filter for cryptography posts of the form:
AES IS BROKEN: Making giant assumption XYZ and requiring a less capable AES in ABC way, we've reduce the amount of operations needed to break AES from 10^X to 10^X-1!
These are tedious for people who are interested in cryptography but are not researchers in the field. (For the researchers, this type of thing may be useful.). The fact that AI is now "generating crypto results", suggests that soon we will soon have crypto-post-slop as clickbait...
- throawayonthe
> I asked Claude for its thoughts, and it doesn’t mince words: “what makes this genuinely interesting — and, frankly, a little embarrassing for the field — is that none of the ingredients are exotic.” The TL;DR is that someone just did a much more thorough job applying all of our known tools. In short: the sort of things that attack AIs are wonderful at.
did i just read two summaries/TLDRs (in a row) of the already-two-sentence summary right above?