Mythos uncovers crypto weaknesses that went unknown for

What happened

Anthropic is hailing the results of two cryptographic problems it threw at its Mythos AI security model that found weaknesses in the mathematical problems underpinning the robustness of two algorithms. At the moment, it’s hard to know how much of the company’s reporting is marketing hype, but the findings are still worth paying attention to because they could signal important advances in breaking cryptography that’s crucial to privacy and security.

Matthew Green, a Johns Hopkins professor and expert in cryptography, said the impressive thing about the discovery was its reliance on several existing methods that no one previously thought to put together. “What’s particularly concerning (and so especially ripe for AI) is that the attack does not invent fundamentally new mathematics,” Green wrote. ” To find the improved method, Mythos deployed two separate agents that worked largely independently.

One initially rejected the method as unworkable. The second found a way to make it work. The agents eventually worked in unison until they produced an agreement that the improved attack was effective. (As with the description of the attack against AES later in this article, the HAWK attack methodology has been simplified.

It’s based on an improvement found through Mythos for performing a “meet-in-the-middle” attack, which is used to derive a key under a chosen plaintext threat model, the best-known existing attack against AES. The technique inputs large numbers of known plaintext into the crypto system and analyzes the encrypted output for clues that, with enough inputs, eventually reveal an unknown key.

Why it matters

Before digging into the results, a few caveats. First, the outcomes are incremental. They don’t break any of the cryptosystems anyone relies on today. Instead, they reveal methods for moderately reducing the work that would be required to defeat the systems. Second, the cryptosystems tested were weakened versions of the ones defined in their formal specifications.

Such “challenge instances” are provided by the specification authors for use in adversarial peer review. It’s standard to use the weakened versions in testing, but the real ones are considerably more robust in production settings. Third, even with the improvement, the underlying “primitives”—meaning the underlying mathematical problems that form the basic building blocks of cryptosystems—remain safe, at least for now.

Lastly, both of the attacks use methods that would likely be infeasible outside of testing environments. Anthropic said its Mythos model—which currently remains available only to a select group of trusted users—was able to advance attacks against two cryptosystems. The first system is HAWK, a digital signature scheme designed to withstand future attacks from quantum computers.

HAWK has so far survived two rounds of testing by NIST (the National Institute of Standards and Technology) for evaluating the security of PQC (post-quantum cryptographic) algorithms through widespread testing. HAWK is currently in a third round of testing and remains far from being finalized as a formal standard. The results against HAWK are nonetheless important.

With about 60 hours of work and about $100,000 of compute cost, an Anthropic researcher with no expertise in cryptography prompted Mythos to improve the best-known existing attack on the algorithm that effectively cut its key strength in half. The math HAWK’s security relies on is the hardness of the Lattice Isomorphism Problem, which, unlike today’s most used digital signature schemes, is believed to be safe from quantum computing attacks.

The best-known classical computing attack to solve this problem works by finding what are known as automorphism symmetries. Mythos outputted a previously unknown method for finding such symmetries that cut the HAWK key strength in half. The weakness can be mitigated by doubling the key size, but the added computation makes HAWK less desirable and may take it out of the running altogether.

What to watch

Previously, the best-known meet-in-the-middle attack against AES required roughly 2105 plaintext inputs, a number large enough to make the method infeasible. Mythos helped to find a new meet-in-the-middle technique that relies on a Möbius Bridge, a more sophisticated fingerprinting algorithm used in meet-in-the-middle attacks. Using it, Green said, the code Mythos produced was able to reduce the number of required inputs to 289.

Anthropic said that savings can reduce the time required for such attacks by 200- to 800-fold. The ability to produce that many inputs makes the attack beyond reach outside of the laboratory. Further, the actual speed-up is unknown, since the weakened AES algorithm tested used only 7 rounds. Specification-compliant AES, Green said, uses 10, 12, or 14 rounds, depending on key size.