Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LLMs won't break symmetric crypto

bfswa.blog

Post reply on HN
Print view View original

91–100 of 108 posts

Re: LLMs won't break symmetric crypto

#91

Post by teravor »

symmetric crypto typically wants the eat the cake and have it too, it wants to be both secure and efficient.

to that end, a so-called "security margin" is guessed at and the number of rounds of the cipher is determined accordingly.

it is certainly possible for an LLM to prove that the guess was wrong and everything that it implies.

having said that, the security of symmetric cryptography relies on the fact that you cannot unwind (find initial conditions) a sufficiently chaotic system in the discrete domain. for example, SHA256 with 512 rounds will almost certainly count as sufficiently chaotic by any definition but it wouldn't be as efficient as the current 64 rounds.

it is often said that it's difficult to come up with a secure symmetric cipher on your own, but assuming you know what you are doing it's quite easy. the hard part is to have enough confidence in it to make it efficient.

Re: LLMs won't break symmetric crypto

#92

Post by xoa »

adrian_b wrote: post #80
tptacek wrote: post #71

Earlier quoted context omitted.

AES doesn't reduce to a fundamental mathematical problem we're uncertain about, in the same way as discrete logs, factoring, the elliptic curve discrete log, or shortest vectors. It's a simpler idea, mathematically: rigorously understood linear operations to propagate key-driven changes quickly, disrupted by nonlinear operations to keep the cipher from being solvable with algebra, driven by a key schedule, and iterat…

For any kind of symmetric encryption method, if you are in the context of a "known-plaintext attack", i.e. where besides the cipher that was used you know both the non-encrypted text and its corresponding encrypted text, if you know a segment of text that is long enough, i.e. longer than the number of bits corresponding to the secret key and of some ancillary information that might be needed, like an initialization v…

>if you are in the context of a "known-plaintext attack", i.e. where besides the cipher that was used you know both the non-encrypted text and its corresponding encrypted text

I know with some pre-modern ciphers like Caesar that was an issue, and it famously came up due to implementation/operator issues with systems like Enigma. But is that actually still a relevant attack context at all with modern symmetric encryption? Outside of academic interest I'm struggling to think of any time where you would ever be in that situation. I thought input got scrambled pretty well so you can't really trivially predict things like text word count (putting aside that these days the vast super majority of bits aren't text). When used to protect your own data (ie, storage encryption etc) then the "end points" are you and future-you and by definition fully trusted, including operation of the encryption system bits. If someone hostile roots it and has access the device computation they'll also have access to device data. When symmetric encryption is used between end points controlled by two different parties keys forward secrecy should be pretty standard these days right? So attackers still would have to root one trusted side or the other and at that point it's game over regardless.

On the face of it seems like it'd have to be a pretty strange situation nowadays where the attacker somehow gets to reuse the same encryption key as the trusted parties without knowing it or being able to access the secrets they're trying to keep without touching the encryption at all? DRM sorts of use-cases maybe, one of the few situations where hostile attacker and trusted user are supposed to be the same person which has always been a tension with it.

Re: LLMs won't break symmetric crypto

#94

Post by danielmarkbruce »

insanitybit wrote: post #89
danielmarkbruce wrote: post #68

Earlier quoted context omitted.

Ouput: 128 logits. Input: maybe 10 samples of plaintext,ciphertext (using the same key), so maybe a 2560 length tensor. Loss function: binary cross entropy on the true key bits. Architecture: anyone's guess. If you were in a place to debate this, you would have known the above (or something similar) is what I was suggesting when i said train on plaintext, cipertext -> key, and you'd have some deep mathematical insigh…

I'm not debating you at all. I'm asking what the model looks like since you've stated (and I've agreed) that a language model wouldn't work. I think it would make sense to explain how a theoretical model could do better than SAT. Otherwise, is the idea here just "magic is possible"?

Yes, "magic is possible" if you defined "magic" as "very large models approximating functions in a way that people didn't think would work".

Current SOTA language and vision models, or models used to predict protein shapes are magic by the standards of 2016. As for why could it be better than a SAT? Why couldn't it be? Models are better than deterministic, logically written software for lots of situations. You can create infinite training data for this problem. The number of humans that work on encryption is tiny. The idea that because humans haven't figured out how to break some encryption schemes it can't be done is kind of absurd.

Re: LLMs won't break symmetric crypto

#95

Post by inigyou »

danielmarkbruce wrote: post #90
inigyou wrote: post #85

Earlier quoted context omitted.

I suggest you do this experiment yourself. You can try model architectures as big as your computer can fit. It won't work because these algorithms are designed to have no patterns at all. People have already tried. More classically, you can try feeding the problem into a SAT solver. People have tried that too. Doesn't work - it just grinds until you run out of memory or patience, finding no useful results. You can al…

>> It won't work because these algorithms are designed to have no patterns at all Every encryption algorithm proposal has this property of being designed to have no patterns....

And some of them still have no known patterns! Even the "broken" ones have only really subtle patterns. SHAttered was only 2^17 times faster than brute force. It took 2^63 attempts instead of 2^80 that bruteforce would take (which was arguably already too low).

Re: LLMs won't break symmetric crypto

#97

Post by danielmarkbruce »

inigyou wrote: post #95
danielmarkbruce wrote: post #90

Earlier quoted context omitted.

>> It won't work because these algorithms are designed to have no patterns at all Every encryption algorithm proposal has this property of being designed to have no patterns....

And some of them still have no known patterns! Even the "broken" ones have only really subtle patterns. SHAttered was only 2^17 times faster than brute force. It took 2^63 attempts instead of 2^80 that bruteforce would take (which was arguably already too low).

Yup, sure. But my claim is that I believe it's better than 20-1 against that a model can break it. The fact that many encryption schemes have later been shown to be fragile and that very very large models seem to be able to things we can't explain well, and that you can create enormous amounts of training data for this problem makes my claim not so far fetched.

Re: LLMs won't break symmetric crypto

#98

Post by inigyou »

danielmarkbruce wrote: post #97
inigyou wrote: post #95

Earlier quoted context omitted.

And some of them still have no known patterns! Even the "broken" ones have only really subtle patterns. SHAttered was only 2^17 times faster than brute force. It took 2^63 attempts instead of 2^80 that bruteforce would take (which was arguably already too low).

Yup, sure. But my claim is that I believe it's better than 20-1 against that a model can break it. The fact that many encryption schemes have later been shown to be fragile and that very very large models seem to be able to things we can't explain well, and that you can create enormous amounts of training data for this problem makes my claim not so far fetched.

Try it and see then. If you can reverse double-SHA256 with some constraints, you can print yourself infinite bitcoin. If you can reverse whatever they use for public keys (RIPEMD and some elliptic curve) you can steal yourself infinite bitcoin.

Re: LLMs won't break symmetric crypto

#99

Post by danielmarkbruce »

inigyou wrote: post #98
danielmarkbruce wrote: post #97

Earlier quoted context omitted.

Yup, sure. But my claim is that I believe it's better than 20-1 against that a model can break it. The fact that many encryption schemes have later been shown to be fragile and that very very large models seem to be able to things we can't explain well, and that you can create enormous amounts of training data for this problem makes my claim not so far fetched.

Try it and see then. If you can reverse double-SHA256 with some constraints, you can print yourself infinite bitcoin. If you can reverse whatever they use for public keys (RIPEMD and some elliptic curve) you can steal yourself infinite bitcoin.

Yes, indeed. And if I really had a good idea for an architecture, and millions to blow trying different ideas... I would be doing that and not on hacker news.

Re: LLMs won't break symmetric crypto

#100

Post by xboxnolifes »

inigyou wrote: post #83
xboxnolifes wrote: post #78

Earlier quoted context omitted.

> That's why algorithms got weakened by researchers regularly. That's the 3rd point. correctness of the algorithms.

There is no such thing. There is just more thorough and less thorough bit-blending. Have a look at any symmetric encryption algorithm or secure hash - there's no magic there, they just do a bunch of stuff to thoroughly mix up all the bits. In the case of symmetric encryption, they constrain it to reversible mixing primitives. And cryptographic experience has shown how much mixing is enough mixing. A few basic things…

If there is no such thing, how have people found weaknesses in various cryptographic algorithms over the years? The weaknesses are incorrect algorithms.
Post reply on HN