Microsoft uses formal verification of their encryption code in production using SymCrypt.
LLMs won't break symmetric crypto
31–40 of 108 posts
Re: LLMs won't break symmetric crypto
#32This is kind of a stupid argument. How about make a slightly stronger claim like "models won't break symmetric crypto" ? I mean, language models aren't even trained to break symmetric crypto. There is not good reason to think they will. It seems possible to train a large model to do it though.
[dead]
Re: LLMs won't break symmetric crypto
#33Earlier quoted context omitted.
The oversight in your thinking is that we have no proofs about how much computation is needed to break cryptography. For all we know, it could be possible to break all modern cryptosystems in under a second on a computer from a decade ago with the right algorithms. This is how cryptography has been broken in the past: not just advances in the amount of compute we can do, but exponential speedups in the algorithms to…
Can someone more knowledgeable than me comment on this. I thought, that Information Theory could mathematically predict the computational challenge of factoring one massive number into its two original primes? Is that not true? If you have just a random number (aka public key) can you just LLM your way to the private key??!?
It's indeed thought to be really hard to factor multiples of two massive primes, but we don't know that for certain. See https://en.wikipedia.org/wiki/Integer_factorization -- "Unsolved problem in computer science: Can integer factorization be solved in polynomial time on a classical computer?". In fact, we don't even have a proof that this is more complex than multiplying the component primes.
And of course, many cryptosystems are reliant on primitives with much less algebraic structure.
But to be clear, LLMs would presumably break these cryptosystems by building new algorithms and writing code to break them, not by "intuiting" their way to a specific private key.
Re: LLMs won't break symmetric crypto
#34What about checking crypto libraries for gaps like the coldcard situation of RNG code is correct but not in the release build somehow?
That was such a stupid coding/code review/testing mistake. Finding it is not that impressive at all. It's nothing like finding a flaw in AES
Re: LLMs won't break symmetric crypto
#35LLMs will accelerate math research, increasing understanding in areas like quantum which will eventually lead to breakthroughs that will break most standard asymmetric encryption algorithms with the side effect of breaking crypto
Arvin Krishna says 4 years
Re: LLMs won't break symmetric crypto
#36This is kind of a stupid argument. How about make a slightly stronger claim like "models won't break symmetric crypto" ? I mean, language models aren't even trained to break symmetric crypto. There is not good reason to think they will. It seems possible to train a large model to do it though.
To train a large model to do what? Break AES? How would that work?
Re: LLMs won't break symmetric crypto
#37I don't really find the "because it's difficult" arguments convincing at all. Especially the one claiming it's hard because it requires designing and running a large number of tests and reasoning about the results of each one. That kind of tedious grinding is exactly where LLMs should shine vs humans! The only convincing argument here is that these things are battle tested (literally in most cases I would guess), wit…
There are very few computer-era symmetric ciphers that were truly broken. RC4 is probably the worst example.
There are no reasonable attacks even on the good old DES. And by "reasonable" I mean attacks that would bring down the complexity to a practical level if the DES key size were to be extended to something like 128 bits. We can brute-force DES keys trivially, but that's not a fault of the cipher per se.
Re: LLMs won't break symmetric crypto
#38Earlier quoted context omitted.
I’m with ya I’ve even heard arguments that prediction is consciousness. But using a Language-Model to break cryptography is still a stretch for me. From the little I know, cryptography uses information theory to make sure that reversing the equation (aka finding the passowrd) is predictably impossible, given current compute standards for the foreseeable future (disregard quantum computer here though :) they’re not LL…
I think you misunderstand. The idea is not that one feeds a cryptographic text to LLMs and they crack it. The idea is that one feeds a cryptographic algorithm to an LLM and they break it somehow. Bear in mind that cryptographers consider a "break" anything that reduces the strength of an algorithm, but that doesn't mean that it is practical to use the given "break" to obtain even one plaintext, let alone obtain them…
Many crypto algorithms have formal proofs that they are reductions of hard problems like factorization. Those problems may not be solvable, only brute forcible. Some could be eventually solved, but the likelihood of every single one being solvable is unlikely.
Re: LLMs won't break symmetric crypto
#39Breaking modern encryption comes down to being in control of key generation rather than brute force. Other than that you'll have a hard time bute forcing 2^256 possibilities.
Comes down to a gut feeling but I lean that this stuff is already all figured out.
Re: LLMs won't break symmetric crypto
#40This is JP Aumasson, the co-author of BLAKE2 and BLAKE3. Aumasson is notorious in cryptography circles for his "too much crypto" argument, that modern symmetric cryptography is overly conservative, running more rounds than are necessary given the very low likelihood that advances in computer science are going make a real dent in them.
A distinction a lot of comments in this thread aren't picking up on is the mechanisms that make most asymmetric cryptography work, versus those of symmetric cryptography. Asymmetric constructions like RSA and ECDH are simple mathematical objects, and their security depends on assumptions we make about advanced algebra, number theory, &c. It's plausible to imagine we could discover something about discrete logs that would destabilize DH. It's less plausible to imagine something like that happen to AES, which is deliberately designed not to have clean structure.