A distinction a lot of comments in this thread aren't picking up on is the mechanisms that make most asymmetric cryptography work, versus those of symmetric cryptography. Asymmetric constructions like RSA and ECDH are simple mathematical objects, and their security depends on assumptions we make about advanced algebra, number theory, &c. It's plausible to imagine we could discover something about discrete logs that would destabilize DH. It's less plausible to imagine something like that happen to AES, which is deliberately designed not to have clean structure.
Comes down to a gut feeling but I lean that this stuff is already all figured out.
The first one is not similar to the mathematical breakthroughs LLMs are making recently. There is a loss of information in mods and integer computations making them one-way. The second one requires simply increasing bit-length to match the increased computer power.
The only convincing argument here is that these things are battle tested (literally in most cases I would guess), with tons of research that never gets published because it's unsuccessful. A whole lot of human effort has gone into trying to break these things. A lot more than went into any of the math problems AI has solved so far. It's going to take a while before LLMs can equal and surpass that amount of human effort. And they might have to surpass it by many, many times to actually break these, if it is even possible, which is not certain.
All conjectures are until someone with the time and energy proves or disproves them.
"LLMs will accelerate math research, allowing us to prove that meaningfully sized quantum computers are impossible and crypto is secure. Modern cryptographic algorithms remains unbroken until the last human is turned into a paperclip in the year 2430"
LLMs are capable not just of calculating the most likely next word from a prompt according to a corpus of training text, but of doing so & feeding back into themselves, the most likely word now based not only on the corpus but on the basic prediction, a second (nth) stage of thought.
Yes it's all still token prediction, but it's predicting conversation between let's say not experts but capable speakers with all the information at hand. Undergraduates if you like. And such conversation can yield real results.
LLMs have not changed the calculus there.
to that end, a so-called "security margin" is guessed at and the number of rounds of the cipher is determined accordingly.
it is certainly possible for an LLM to prove that the guess was wrong and everything that it implies.
having said that, the security of symmetric cryptography relies on the fact that you cannot unwind (find initial conditions) a sufficiently chaotic system in the discrete domain. for example, SHA256 with 512 rounds will almost certainly count as sufficiently chaotic by any definition but it wouldn't be as efficient as the current 64 rounds.
it is often said that it's difficult to come up with a secure symmetric cipher on your own, but assuming you know what you are doing it's quite easy. the hard part is to have enough confidence in it to make it efficient.
More classically, you can try feeding the problem into a SAT solver. People have tried that too. Doesn't work - it just grinds until you run out of memory or patience, finding no useful results.
You can also try doing it by hand and see if you get anywhere (you won't). People have tried.
This is an adversarial problem. The problem is literally designed to be resistant to all kinds of analysis. That's the point. Even real attacks, like SHAttered (different kinds of attack on a different kind of algorithm) manage to find conditions where the probability of finding a solution is raised to 2^-70 or so, and then they let it grind on their biggest compute clusters until they find one. And that problem (finding a collision in a cryptographic hash function) is one that's especially amenable to grinding. If you're mounting a known plaintext attack it's unlikely your adversary will answer 2^70 encryption requests for you.
Most likely outcome will be that a security researcher is able to break one with assistance of / in collaboration with an LLM.
There are no reasonable attacks even on the good old DES. And by "reasonable" I mean attacks that would bring down the complexity to a practical level if the DES key size were to be extended to something like 128 bits. We can brute-force DES keys trivially, but that's not a fault of the cipher per se.
What I have seen LLMs do recently is find what turned out to be very basic bugs in encryption and ZK libraries that for some reason humans never saw. In those cases it wasn't that the encryption algorithms were broken per se, but the the implementation was.
This alone seems very worthwhile.
Every encryption algorithm proposal has this property of being designed to have no patterns....
No, there's no proof that most crypto "calculations" are impossible to reverse. That's why algorithms got weakened by researchers regularly. As of now, it's totally possible someone finds an algorithm to break a next one tomorrow. They just haven't found it yet.
That's not correct. Trapdoor functions aren't one way because they destroy information, and if they were they wouldn't be very useful because you wouldn't be able to go back the other way (i.e. decrypt the text). You'd end up with many possible inputs for a given output, like a hash.
If the key is a set of truly random numbers the same size as the ciphertext, then this is a one-time pad, and it is truly secure in the information theory sense. Nothing other than knowing the original randomly selected key values can decode the ciphertext.
But of course, it's hard to come up with terabytes of random numbers at the drop of a hat, and to share them securely with the other party. So symmetric ciphers use pseudo-random generation techniques, to iterate through many pseudo-random keys based on one original key. With PRNGs the "randomness" may have patterns and that is the opening for a break in the crypto.
And, just because what I'm saying isn't especially likely to work, it's not obvious that it cannot. Very large models are doing all manner of things that very smart people thought were not possible just 6 or 7 years ago.
So the solution is to find algos that let you use a smaller key, but the side effect is that by pigeonhole principle, your keyspace is smaller than the message space, so it MUST be insecure. The trick is to make it so that it's only insecure enough that it's infeasible to break.
I’ve even heard arguments that prediction is consciousness.
But using a Language-Model to break cryptography is still a stretch for me.
From the little I know, cryptography uses information theory to make sure that reversing the equation (aka finding the passowrd) is predictably impossible, given current compute standards for the foreseeable future (disregard quantum computer here though :) they’re not LLMs)
Two cases: 1) you have to find a route to the middle 2) someone gives you a route to the middle and you have to validate it
It’s not proven that case 2 is necessarily easier than case 1. But logic and every case in the history of computing suggest that it is.
I don’t see how LLMs could possibly change that fact
That's the 3rd point. correctness of the algorithms.
If you were in a place to debate this, you would have known the above (or something similar) is what I was suggesting when i said train on plaintext, cipertext -> key, and you'd have some deep mathematical insight as to why no architecture known is likely to work. And you would also know I wouldn't be here talking to you about it if I really had a solid idea of an architecture that is likely to work.
Most of the breakthroughs so far have been finding counter examples. They can just search tirelessly to find one. Finding a good algorithm (maybe even one faster than people assume is possible) seems the obvious next step for them (as opposed to more conceptual proofs e.g. existance or non-existence where they still aren't quite terrifyingly good).
The phrase "for all we know some undergrad might find a counter example" is the new "it works for n<100 so I don't see why it won't continue indefinitely".
This is how cryptography has been broken in the past: not just advances in the amount of compute we can do, but exponential speedups in the algorithms to break them. While I agree with the author of this post that modern cryptosystems are very secure and LLMs are not currently near breaking them, I don't think it's unreasonable to consider that if LLMs continue to get exponentially smarter they may make strides in cryptanalysis that we had never considered and break cryptography in unexpected ways. After all, many past cryptography breaks have come from previously unknown methods of cryptanalysis.
I think it would make sense to explain how a theoretical model could do better than SAT. Otherwise, is the idea here just "magic is possible"?
Moreover, together with RC2 it was approved for export from USA, during a time when this was prohibited, so it was included in browsers from the beginning.
When the export rules were relaxed, it was trivial to increase the key length of RC4, which could be chosen arbitrarily, so that appeared as a simple way to enhance the security of the existing Internet browsers.
This lead to its ubiquity in the early SSL.
There's a _lot_ hiding in that, all of the interesting stuff for security and potential breaks. So...yeah it is based on complicated math, it's just in that bit instead of the xor.
Even the xor is a bit of a fudge, but probably close enough.
I’m very much aware of the differences between symmetric and asymmetric encryption, and realize that symmetric encryption is much simpler, but I figure that if there are weaknesses to be found in algorithms such as md5, then surely there are also potential weaknesses in symmetric encryption algorithms?
Now I’m not saying that this would be the case for battle tested algorithms like AES. But is there any particular reason why this whole category could not possibly have weaknesses?
Current SOTA language and vision models, or models used to predict protein shapes are magic by the standards of 2016. As for why could it be better than a SAT? Why couldn't it be? Models are better than deterministic, logically written software for lots of situations. You can create infinite training data for this problem. The number of humans that work on encryption is tiny. The idea that because humans haven't figured out how to break some encryption schemes it can't be done is kind of absurd.
A few basic things are known - for example, you can't make a symmetric cipher with just bitshifts and XOR, because then linear algebra techniques can trivially reverse it.
I thought, that Information Theory could mathematically predict the computational challenge of factoring one massive number into its two original primes?
Is that not true? If you have just a random number (aka public key) can you just LLM your way to the private key??!?
Of course there isn't, nothing like that could be formally proven. But that is neither here nor there.
The important issues remain:
1. Whether some as yet unknown technique exists for efficiently breaking a code.
2. If the answer to (1) is yes, whether LLMs can find it at a reasonable cost.
TTBOMK we still don't know anything about (1). I think the answer to (2) is "probably yes".
The rest of them rely on more practical considerations. Asymmetric crypto is generally based on some mathematical problem that we don't know how to solve yet (and think we never will) while symmetric crypto is generally based on brute-force-style mixing up the bits so thoroughly they seem impossible to unmix.
And of course, many cryptosystems are reliant on primitives with much less algebraic structure.
But to be clear, LLMs would presumably break these cryptosystems by building new algorithms and writing code to break them, not by "intuiting" their way to a specific private key.
On July 28th Anthropic announced new cryptanalytic attacks discovered using their LLM Claude Mythos:
A key-recovery attack on HAWK, a post-quantum signature scheme candidate in NIST’s “Additional Digital Signatures” standardization project. Except for the toy version HAWK-256 whose 64-bit security is practically breakable, the new attack is not practical. But it's a meaningful break of HAWK’s security, as it reduces the estimated security level of HAWK-512 from its 128-bit target to at most 108 bits and, speculatively, as little as 81 (see Appendix C of the paper.)
An improved key-recovery attack on 7-round AES-128, while the full version does 10 rounds. The attack is , and totally not a surprise, posing no threat to AES. But since new cryptanalytic results for AES are rare, this result is noteworthy regardless of the way it was found. The negative result is, perhaps, more significant: Mythos found no stronger attack, let alone against full-round AES.
In the AES attack paper, Anthropic writes “We believe that further exploring the direction of LLM-assisted cryptography research is interesting—particularly in cases where the attacks developed are computationally intractable to implement and require that the language model demonstrate its correctness through a combination of approaches. One direction we believe to be particularly important is to formalize the attack techniques used in the cryptographic community.”
I agree with that, notably the last statement: symmetric cryptanalysis needs more unified descriptive frameworks and abstraction; too many papers use ad hoc formalism and custom notations and terminology when they’re fundamentally doing the same thing as others.
I also expect LLMs to find errors in cryptanalytic attacks’ complexity estimates and in security proofs. Earlier this year I asked LLMs to find bugs in security proofs of EUROCRYPT 2026 papers and they found issues in most of the proofs (showing that the proof, though not necessarily the result, was incorrect.)
Anthropic also helped create CryptanalysisBench, an LLM benchmark comprising cryptanalysis tasks on full- and reduced-round versions of AES, ChaCha, and on algorithms submitted to NIST’s competitions—like BLAKE—including post-quantum schemes.
If you’re unfamiliar with cryptanalysis, it’s not unreasonable to wonder whether LLMs could break AES, ChaCha, SHA-3, and other symmetric algorithms in use today—as a friend asked me, “aren’t you worried that Mythos could break BLAKE3?”. I’m not.
More broadly, I’m confident that LLMs won’t break any of the established cryptographic schemes, and won’t disprove Too Much Crypto’s conjectures.
In an excellent post, Matthew Green writes [with my notes] that “our symmetric ciphers [block/stream ciphers but also hash functions and MACs] are very messy [again, no “unified theory”] and robust [empirically so; more on this later]. Imagine a farmer who drags a tractor out into a patch of quicksand, and then buries it under cement. That’s what symmetric cipher design is like; it’s deliberately designed to come up with structures that are quick and easy to apply [typically, a round’s operations], but very messy and hard to untangle [as you iterate rounds]. The addition of many new raw intelligence-hours probably aren’t going to magically improve this.”
I'd like to elaborate on what Matt calls messiness and structure, and why these are key reasons why LLMs won’t find a practical collision attack on SHA-3 or BLAKE3.
So, why LLMs won’t break symmetric crypto? In largely-but-not-totally-arbitrary order:
Their high-level structure is secure: Here I mean constructions such as the GCM and CTR modes of operation for block ciphers and hash-function modes such as the sponge construction. I also include the round-based construction of the keyed or unkeyed permutations at the core of most symmetric schemes—though not all of them; Poly1305, for example, isn’t round-based.
They have no mathematical structure. Unlike actual math problems and unlike most public-key schemes, symmetric ciphers can’t generally be described as clean transforms within a mathematical structure—structure that allows reduction-based security proofs, but also what may be exploited for cryptanalysis (an exception is arithmetization-oriented primitives and in particular so-called algebraic hash functions, such as Poseidon, as used in ZK proof systems and FHE; another exception is VSH, a hash function based on RSA-like operations, which was proved collision-resistant but turned out not to be preimage resistant, showing structure’s double edge.) When designing a hash function or block cipher, your goal is to eliminate any structure, symmetry, or pattern that would let an attacker describe the computation as something simpler than the apparently senseless sequence of elementary operations it performs. BLAKE3, for example, is essentially a long sequence of XORs, modular additions, and bit rotations. There’s no other way to describe it. There’s no obvious space to navigate or high-level structure to reason about: XOR destroys linearity with respect to modular addition, while modular addition destroys linearity with respect to XOR. Consider the n-bit permutation of a sponge construction as a bijection over GF(2)ⁿ: its representation as a system of multivariate equations over GF(2) is expected to have no remarkable structure: maximal degree, a high density of monomials, and so on. The same should hold for representations over other fields. That’s Matt’s idea of messiness.
It’s mostly differential cryptanalysis. Whether it’s linear cryptanalysis, rectangle attacks, boomerang attacks, integrate attacks, cube attacks, as well as slide attacks and most cryptanalysis tricks, all are forms of differential cryptanalysis: they exploit input–output patterns of the form “if we apply this difference in the input [wrt some operator, typically XOR], then the output [of some component of the cipher] statistically deviates from the ideal/expected case.” For example, collision attacks on SHA-1 exploited that some differentials has exceptionally high probability, while impossible differential techniques exploit probability-zero differentials. If a symmetric primitive's mode is (proved) secure, then very little else to do than differential cryptanalysis. This territory has already been explored extensively; LLMs are therefore unlikely to discover entirely new classes of attack.
Differential cryptanalysis is empirical, at least partially. In many cases cryptanalysts find statistical biases by running experiments without understanding exactly why those biases exist. After observing comparatively large biases, like 2-10, they may infer the existence of smaller biases that would require too many samples to measure reliably but could nevertheless be exploited in an attack. I’m not claiming that an LLM cannot run such experiments, but the need to design, execute, and interpret them makes its task more difficult.
They’re time- and battle-tested: These designs have received thousands of hours of cryptanalytic scrutiny, most of it unsuccessful and therefore unpublished. Researchers have applied human ingenuity, creativity, and vast amounts of computation to search for biased statistics and to perform automated analysis and sometimes formal verification. And what have they found? Mostly the predictable result that reduced-round variants are easier to break, while the strength of the algorithms increases dramatically as rounds are added.
As a friend commented, "it's kind of a historical quirk that we had unsafe symmetric crypto." Symmetry cryptography is the strongest part of our security systems, thus LLM tokens are much better spent finding bugs elsewhere, including in underanalyzed post-quantum standardization candidates.
Featured image: Peter Bruebel, The Fall of the Rebel Angels (detail)
I think you're right if your point is that we're more likely to see big breaks in asymmetric crypto, but it's kind of based on vibes to me, it's not really clear that it's provable in any way with anything like our current understanding.
It's just radically different levels of exposure to mathematical theory.
I'm fond of pointing out that JP Aumasson, who is (unlike me) an academic cryptographer of some repute, believes SHA2 will never be broken.
However, for a well-designed cipher that system of equations is non-linear and exceedingly complex and it cannot be formulated in any mathematically simple form, therefore no methods of solution are known.
The more rounds are performed inside the encryption algorithm, the more complex that system of equations becomes, and the more unlikely is to find any method to solve it.
Even for the much simpler systems of non-linear equations that occur in physics, when they cannot be linearized even in the neighborhood of each point, then there typically are no better methods of solution than searching randomly through the solution space, which in cryptography corresponds to brute-force search, which is infeasible for big enough secret keys.
I know with some pre-modern ciphers like Caesar that was an issue, and it famously came up due to implementation/operator issues with systems like Enigma. But is that actually still a relevant attack context at all with modern symmetric encryption? Outside of academic interest I'm struggling to think of any time where you would ever be in that situation. I thought input got scrambled pretty well so you can't really trivially predict things like text word count (putting aside that these days the vast super majority of bits aren't text). When used to protect your own data (ie, storage encryption etc) then the "end points" are you and future-you and by definition fully trusted, including operation of the encryption system bits. If someone hostile roots it and has access the device computation they'll also have access to device data. When symmetric encryption is used between end points controlled by two different parties keys forward secrecy should be pretty standard these days right? So attackers still would have to root one trusted side or the other and at that point it's game over regardless.
On the face of it seems like it'd have to be a pretty strange situation nowadays where the attacker somehow gets to reuse the same encryption key as the trusted parties without knowing it or being able to access the secrets they're trying to keep without touching the encryption at all? DRM sorts of use-cases maybe, one of the few situations where hostile attacker and trusted user are supposed to be the same person which has always been a tension with it.