Researchers at Anthropic used the cutting-edge artificial intelligence (AI) model Claude Mythos Preview to analyze not-yet-standardized post-quantum cryptography (PQC) algorithms and uncovered a new attack method.
Anthropic said on the 28th (local time) that its researchers discovered a new vulnerability in HAWK, cited as a next-generation cryptographic scheme. HAWK is one of the candidate next-generation digital signature algorithms that the National Institute of Standards and Technology (NIST) is working to standardize for the quantum computing era.
Mythos found a new cryptanalysis technique in about 60 hours that can reduce HAWK's security strength. While it did not decrypt the cipher, it significantly shortens the time an attacker needs to break it, the researchers said.
According to the researchers, Mythos also found hacking vulnerabilities in tests targeting a round-reduced version of the Advanced Encryption Standard (AES). Since NIST adopted AES as a standard in 2001, it has been one of the most extensively vetted symmetric-key ciphers. It is a safety standard that blocks hacking across several areas, including actual internet banking and other financial transactions, messenger security, and protection of state secrets.
In cryptography research, round-reduced versions of AES are mainly analyzed to assess AES security, and Mythos used a new algorithm called "Möbius Bridge" to increase attack speed by 200 to 800 times compared with human experts.
Anthropic said, "The two research findings do not affect real computer systems currently in operation," and added, "HAWK is still a candidate algorithm not yet adopted as a standard, so it has not been applied to real services, and the second attack applies only to the reduced version, not the entirety of AES, meaning the AES currently in use is not exposed to threats."
However, with the revelation that Mythos can also attack AES and next-generation cryptographic standards, concerns are emerging that high-performance AI could, going forward, undermine internet standard cryptosystems.
The New York Times (NYT) reported, "Past research suggested large language models (LLMs) could not surpass humans in cryptography, but it has now become clear that this perception was wrong," adding, "Major controversy is expected in the mid to long term."