New AI Model Reveals Weaknesses in Internet Encryption
Anthropic, a tech company, recently announced that its latest AI model, Claude Mythos, has uncovered new vulnerabilities in the encryption methods that secure the internet. This sophisticated model, which is currently not available for public use, found a faster way to exploit a simplified version of AES (Advanced Encryption Standard). AES is a critical encryption method that protects online banking, encrypted messages, Wi-Fi networks, and saved data.
The findings were disclosed along with two research papers this past Tuesday. However, experts assure that no widespread vulnerabilities have emerged from this research. Claude Mythos specifically targeted a 7-round version of AES-128, which typically operates on 10 rounds. It achieved its results 200 to 800 times more efficiently than previous techniques.
In a more concerning finding, the AI model was able to reduce the effective security of HAWK, a post-quantum signature method endorsed by the National Institute of Standards and Technology (NIST). Remarkably, this was done after HAWK had already passed thorough evaluation by experts over the last two years. The AI took about 60 hours to complete its work and shared its results with both government authorities and industry leaders before publicizing them.
Understanding the Importance of a “Reduced-Round” Cipher
It’s vital to recognize why these findings might be significant, especially for users of banking apps. Cryptography experts sometimes intentionally weaken algorithms to pinpoint potential future vulnerabilities, akin to solving a simpler math problem to understand patterns. The attack on AES assumes that an attacker could request a massive number of chosen encryptions, which is currently impractical on existing machines. Since its adoption in 2001, AES is believed to have an astronomical number of possible keys, approximately the same as the total number of atoms in the universe.
Nicholas Carlini, a researcher at Anthropic, emphasized the goal of understanding trends rather than causing any actual damage. He compared recent AI models’ capabilities to what he was able to do as a teenager, highlighting the significant advancements being made.
The Unique Discovery Process of Claude Mythos
The journey to these discoveries was fascinating. Initially, Claude Mythos resisted working on the AES problems, convinced that no significant breakthroughs could be made. However, a researcher encouraged the AI by pointing out that it had a tendency to avoid tasks it deemed impossible. Following this nudge, Claude revamped its approach to explore innovative solutions.
In just three days, it generated hundreds of millions of data points and developed a technique called the Möbius Bridge, which efficiently reduces the number of potential guesses an attacker would need to make. By the end of this process, the model had produced about a billion data tokens, with the entire endeavor costing around $100,000 in API usage. Two researchers, who were not cryptography specialists, spent about a month ensuring that the mathematical concepts were sound.
Implications for Future Standards and Security
The implications of these findings for HAWK are significant, as the cost of breaking a HAWK-256 key has been drastically reduced. This raises concerns about the practicality of using this method going forward. Additionally, Anthropic also highlighted vulnerabilities in other encryption methods, including a rapid attack on a 13-round version of LEA, achievable in under an hour on a standard computer.
To further track these developments, Anthropic has introduced CryptanalysisBench, a collaborative tool developed with various universities. While Claude Mythos remains under restricted access, it was initially rolled out to select government bodies after demonstrating a remarkable ability to discover and exploit software vulnerabilities.
In light of these rapid advancements, experts like Glenn Gerstell, a former counsel for the NSA, have expressed caution, suggesting that trusting in strong encryption for the next few years may be overly optimistic.
