Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Discovering Cryptographic Weaknesses with Claude

anthropic.com

Post reply on HN
Print view View original

51–60 of 199 posts

Re: Discovering Cryptographic Weaknesses with Claude

#51

Post by estearum »

jstanley wrote: post #40
estearum wrote: post #32

Earlier quoted context omitted.

Have you tried using Wispr or Willow (or any one of a thousand alternatives?) A little odd at first but absolutely amazing for the purpose of piling context into an LLM.

It's so bizarre to me that people want to do this. Can't you type faster than you speak? Doesn't your speaking inhibit your thinking? Aren't you self-conscious talking out loud? How are our experiences so different?

These are all interrelated points and the sibling comment is correct: it's a skill.

The key thing with these voice systems is that you do not need to edit anything. You can literally just stream of consciousness into them, no editing, include the backtracking, the live-revisions, etc., and it will actually all produce vastly better context for the LLM than the written thing you took even 30 seconds to edit for clarity or brevity.

I had a very similar disposition towards this idea just 6 months ago. I highly recommend trying it out. The key thing is that you do not need to edit. Just keep talking. Try it for a few weeks!

Re: Discovering Cryptographic Weaknesses with Claude

#52

Post by estearum »

TeMPOraL wrote: post #34
estearum wrote: post #32

Earlier quoted context omitted.

Have you tried using Wispr or Willow (or any one of a thousand alternatives?) A little odd at first but absolutely amazing for the purpose of piling context into an LLM.

Voice dictation tools? Not really. Tried various dictation tools interacting on the phone, but the quality varies, and resulting prompts are very much not like I would write them. My limiting factor is that 99% of the day I'm around people - either at work, or at home with wife and kids. There's almost no point during the day I could feel comfortable talking at an AI, and even if I stay up late, then talking risks wa…

I highly recommend getting a boom mic that you can keep right up against your mouth and literally whisper into. Take a few weeks just doing stream-of-consciousness prompting into it like this. Don't worry about editing or backtracking or revisions. It's really amazing how well the AI voice recognition → coding agent workflow works.

Re: Discovering Cryptographic Weaknesses with Claude

#53

Post by kmoser »

mmaunder wrote: post #15

“Each of the results cost roughly $100,000 in API cost to develop.” And “Over the course of a week, one Anthropic researcher worked together with Claude to develop the HAWK attack, and another researcher built a scaffold4 that allowed Claude to fully autonomously discover the AES attack.” Spending $100k in tokens in a week is an impressive feat even with massive parallelization. I suspect the TPS their internal folks…

Today's state-of-the-art AI systems are the equivalent of late 1970s personal computers: bulky and expensive, but wildly more powerful than what came before. And look what happened: tech improved by orders of magnitude, and eventually computers were tiny and cheap.

I predict the same will happen with AI: certainly the latest and greatest will still command a steep price (yes, supercomputers are still a thing) but for most people who just need something reasonably fast and powerful, cheap (or free) AI will do the trick, especially when run locally.

So no, the aristocracy won't have a lock on the technology because tech is always being democratized. Until arbitrary computation itself is outlawed (and yes, I know, governments and industry are always inching us closer to that), we'll be ok.

Re: Discovering Cryptographic Weaknesses with Claude

#55

Post by recitedropper »

Diogenesian wrote: post #27

This seems like a bit of an overstatement: Despite HAWK having survived two rounds of expert human review over a period of two years, Mythos was able to improve the best-known attack on it in just 60 hours of work—effectively cutting its key strength in half. since, later: Mythos’s attack works by finding a specific, previously unexploited symmetry called a nontrivial automorphism in the lattice used by HAWK. Prior w…

Yes, this discovery is surprisingly similar to the recent counterexamples LLMs have been finding for mathematical conjectures: a semi-novel construction, built on previous work, that feels like it was found with enormous search and an okay heuristic.

I feel like there is a pattern emerging regarding the type of novel discoveries LLMs are good at finding, but it will take some more data points to see if the trend solidifies.

Re: Discovering Cryptographic Weaknesses with Claude

#56

Post by mwigdahl »

poidos wrote: post #49
heaney-555 wrote: post #42

Earlier quoted context omitted.

If a Chinese model can do it for $1-10K, then why hasn't one? Why have all the mathematical (and now cryptographic) breakthroughs come from OpenAI and Anthropic? Is it possibly because the Chinese models are so benchmaxxed they can't make novel discoveries?

Don't know if one has or not, but a lack of announcement is not a lack of success.

Do you really think that if a Chinese model had achieved a significant math breakthrough that it wouldn't be trumpeted to the global media? The "Deepseek moment" was great for China; this would be the same.

Re: Discovering Cryptographic Weaknesses with Claude

#57

Post by adrian_b »

Retr0id wrote: post #7

TL;DR: They marginally improved on the best known academic attack on 7-round AES-128 (which normally uses 10 rounds - you do not need to worry about AES being broken). The attack on HAWK is perhaps more interesting - they were able to halve the effective key length. HAWK is a candidate for NIST standardisation. It has been studied academically, but isn't really deployed anywhere (because it hasn't been standardised!)

It should be noted that the attack is not only an attack against a weakened AES, but it is also a chosen-plaintext attack.

It is standard in cryptography to analyze ciphers under this kind of attack, which is stronger than normal attacks, because a cipher that resists to a stronger attack will also resist to weaker attacks, so using the strongest possible attack increases the confidence in a cipher.

While using the strongest attack for testing a cipher remains the correct method, chosen-plaintext attacks are no longer realistic today, so even when a cipher appears somewhat vulnerable to such attacks that does not imply that it is vulnerable in normal use.

The reason is that the modes of operation for ciphers where the base cipher can be attacked with chosen plaintexts are obsolete. The most frequently used modes of operation are now modes like the counter mode (e.g. in AES GCM), where it is impossible to perform a chosen plaintext attack (i.e. where you must trick the victim to encrypt a text that you choose, but in counter mode the cipher only encrypts a sequence of numbers chosen by the intended victim, which cannot be influenced by the attacker).

Re: Discovering Cryptographic Weaknesses with Claude

#58

Post by rurban »

impulser_ wrote: post #43
_dwt wrote: post #22

I find that some of my friends and acquaintances have gotten obsessed with prompting style, "prompt engineering", which skills to use, which skills to build, "context engineering", and a billion other variations on "how to write smart things so the model does good". Friends, look at the prompts that Anthropic's own people are putting into the machine: > A few hours after the first message, we found that Claude was st…

Yeah, in fact you can actually make the model perform worst. You should allow the model to "think for itself" instead of pushing your reasoning into the prompt. You should give it simple prompt and steer it along the way. Skills, CLAUDE.md/AGENTS.md should only ever be used if the model struggle at something or doesn't know how to use something. Vast majority of project should never need a skill or CLAUDE.md. If you…

No, we still need CLAUDE.md to override bad system prompt goals. The system prompt goes for the simple fast solution, no error handling, no hardening, no abstractions, but overly verbose comments. Vast amount of people need to override this AI slop.

Re: Discovering Cryptographic Weaknesses with Claude

#59

Post by some_furry »

quotemstr wrote: post #14

One attack weakens HAWK, a post-quantum cryptography cipher candidate. I don't trust these PQC things one bit. I'll use them in combination with a strong clasically-resistant cipher (in so-called hybrid encryption modes), but not alone. There's a push to turn off the classical modes and rely entirely on PQC for both quantum and classical security. Uh... no, thank you? Why would we want to do that at this point? The c…

> One attack weakens HAWK, a post-quantum cryptography cipher candidate. I don't trust these PQC things one bit. I'll use them in combination with a strong clasically-resistant cipher (in so-called hybrid encryption modes), but not alone.

HAWK is a signature algorithm, not encryption.

Re: Discovering Cryptographic Weaknesses with Claude

#60

Post by dboreham »

rurban wrote: post #58
impulser_ wrote: post #43

Earlier quoted context omitted.

Yeah, in fact you can actually make the model perform worst. You should allow the model to "think for itself" instead of pushing your reasoning into the prompt. You should give it simple prompt and steer it along the way. Skills, CLAUDE.md/AGENTS.md should only ever be used if the model struggle at something or doesn't know how to use something. Vast majority of project should never need a skill or CLAUDE.md. If you…

No, we still need CLAUDE.md to override bad system prompt goals. The system prompt goes for the simple fast solution, no error handling, no hardening, no abstractions, but overly verbose comments. Vast amount of people need to override this AI slop.

Never once had to do that, fwiw.
Post reply on HN