AI Meets Cryptography 1: What AI Found in Cloudflare's Circl • Hacker News Board

Re: AI Meets Cryptography 1: What AI Found in Cloudflare's Circl

#11

Post by wbl » Tue, Jul 07, 2026, 10:28 PM UTC

dboreham wrote: post #3

If the author is here: thanks for that, interesting read, and also nice to note the absence of a marketing name for the bugs. If you have time, couple (edit: three) questions: 1. Could you expand on this? "That human-in-the-loop step still matters a lot, because AI candidate findings are cheap while trustworthy reports are not." Roughly how many candidate reports did the LLMs create vs the eventual 7 true vulnerabili…

The ability to decrypt depends on figuring out that the sharing scheme has your pieces covered, and knowing that you have in fact covered the right thing because of a bug like this is hard to do. There are some ways to test the sharing scheme that might have caught this, and looking at example shares carefully should have, but it's a bit more subtle to make generic tests.

Re: AI Meets Cryptography 1: What AI Found in Cloudflare's Circl

#12

Post by dboreham » Wed, Jul 08, 2026, 3:40 AM UTC

wbl wrote: post #11

dboreham wrote: post #3

If the author is here: thanks for that, interesting read, and also nice to note the absence of a marketing name for the bugs. If you have time, couple (edit: three) questions: 1. Could you expand on this? "That human-in-the-loop step still matters a lot, because AI candidate findings are cheap while trustworthy reports are not." Roughly how many candidate reports did the LLMs create vs the eventual 7 true vulnerabili…

The ability to decrypt depends on figuring out that the sharing scheme has your pieces covered, and knowing that you have in fact covered the right thing because of a bug like this is hard to do. There are some ways to test the sharing scheme that might have caught this, and looking at example shares carefully should have, but it's a bit more subtle to make generic tests.

Ok but my understanding from the article was that the bug is "it always allows what shouldn't be allowed", therefore any negative outcome test should have failed (or at least a very very simple one). Again I'm sure I'm misunderstanding something about the context here.

Re: AI Meets Cryptography 1: What AI Found in Cloudflare's Circl

#13

Post by AlotOfReading » Wed, Jul 08, 2026, 3:47 AM UTC

AlotOfReading wrote: post #9

mcpherrinm wrote: post #6

Earlier quoted context omitted.

So, in this case it wasn't correct to do so, but there is actually a current algorithm which uses floating point: Falcon (aka FN-DSA). https://keymaterial.net/2026/05/13/so-you-want-to-deploy-fn-... talks about FN-DSA and has a section about how it's require to hand-implement floats to get constant-time operations.

It really should have been defined in terms of fixed point like HAWK was. Supposedly you'd need a large number of bits for it, but I'm not sure I find that argument particularly convincing given that floats are a kind of fixed point in log space, with a bunch of asterisks that don't help falcon much.

As a follow-up to this comment, I sat down and implemented a better method myself, then looked at the specification code to discover they did exactly the same thing.

Re: AI Meets Cryptography 1: What AI Found in Cloudflare's Circl

#14

Post by xarope » Wed, Jul 08, 2026, 5:48 AM UTC

ur-whale wrote: post #2

People do crypto using floats these days? Wow. I mean I know djb managed at some point to coax an x86 CPU floating point unit to perform weird integer operations to speed up some of his algorithms, but I would never have expected people to use floats the "intended way" to implement crypto algorithms.

Yes, this was a bit of a surprise to read when dealing with crypto: "This one lives in CIRCL's threshold RSA implementation... float64 has a 53-bit mantissa... the result is silently rounded before it is ever cast back to an integer. "

this is numerical methods 101, i.e. why 1+1 != 2

I'm a bit surprised that this is from cloudflare. Anybody from CF care to comment? Is this like prototype/super skunkworks code that somehow made it through?