Mythos attack on 3rd-round PQC algorithm candidate puts it out of commission
Mythos attack on 3rd-round PQC algorithm candidate puts it out of commission
Mythos 对第三轮后量子密码学（PQC）候选算法的攻击使其被迫出局
A quantum-resistant cryptography algorithm that was under consideration as an official US standard has been taken out of the running after an Anthropic security model helped find a flaw that rendered it broken. The algorithm is known as HAWK. It’s a digital signature scheme designed to withstand future attacks from quantum computers. 一种曾被考虑作为美国官方标准的抗量子密码算法，在 Anthropic 的安全模型协助发现其漏洞并导致其失效后，已被排除在候选名单之外。该算法名为 HAWK，是一种旨在抵御未来量子计算机攻击的数字签名方案。
HAWK had survived two rounds of testing by NIST (the National Institute of Standards and Technology) for evaluating the security of PQC (post-quantum cryptographic) algorithms through widespread testing. HAWK was in a third round of testing designed to catch precisely the kinds of flaws Mythos helped uncover. Following Anthropic’s Monday announcement of the results, the developer of HAWK said Tuesday he was withdrawing it. HAWK 此前已通过了美国国家标准与技术研究院（NIST）的两轮测试，该测试旨在通过广泛的评估来验证后量子密码（PQC）算法的安全性。HAWK 当时正处于第三轮测试中，该轮测试正是为了发现 Mythos 所揭示的那类漏洞。在 Anthropic 周一公布结果后，HAWK 的开发者于周二宣布撤回该算法。
Even before the development, Anthropic was hailing the results of the two cryptographic problems it threw at its Mythos AI security model. The model found weaknesses in the mathematical problems underpinning HAWK and, separately, the widely used AES cipher. Despite the withdrawing of HAWK, it’s hard to know how much of the company’s reporting is marketing hype, but the findings are still worth paying attention to because they could signal important advances in breaking cryptography that’s crucial to privacy and security. 在此次进展之前，Anthropic 就已对其 Mythos AI 安全模型在两个密码学问题上的表现大加赞赏。该模型分别发现了 HAWK 算法底层数学问题以及广泛使用的 AES 加密算法的弱点。尽管 HAWK 已被撤回，但很难判断该公司报告中有多少是营销炒作，不过这些发现仍值得关注，因为它们可能标志着在破解对隐私和安全至关重要的密码学领域取得了重要进展。
Before digging into the results, a few caveats. First, the outcomes are incremental. They don’t break any of the cryptosystems anyone relies on today. Instead, they reveal methods for moderately reducing the work that would be required to defeat the systems. Second, the cryptosystems tested were weakened versions of the ones defined in their formal specifications. Such “challenge instances” are provided by the specification authors for use in adversarial peer review. It’s standard to use the weakened versions in testing, but the real ones are considerably more robust in production settings. Third, even with the improvement, the underlying “primitives”—meaning the underlying mathematical problems that form the basic building blocks of cryptosystems—remain safe, at least for now. Lastly, both of the attacks use methods that would likely be infeasible outside of testing environments. 在深入探讨结果之前，有几点需要说明。首先，这些成果是渐进式的。它们并没有破解当今人们所依赖的任何加密系统，而是揭示了可以适度降低破解这些系统所需工作量的方法。其次，所测试的加密系统是其正式规范中所定义版本的简化版。这些“挑战实例”由规范作者提供，用于对抗性同行评审。在测试中使用简化版本是标准做法，但实际生产环境中的版本要稳健得多。第三，即使有了这些改进，底层的“原语”（即构成加密系统基本构建块的底层数学问题）目前仍然是安全的。最后，这两种攻击所使用的方法在测试环境之外很可能是不可行的。
HAWK is dead
HAWK 已死
Anthropic said its Mythos model—which currently remains available only to a select group of trusted users—was able to advance attacks against two cryptosystems. The first system is HAWK, a digital signature scheme designed to withstand future attacks from quantum computers. With about 60 hours of work and about $100,000 of compute cost, an Anthropic researcher with no expertise in cryptography prompted Mythos to improve the best-known existing attack on the algorithm that effectively cut its key strength in half. Anthropic 表示，其 Mythos 模型（目前仅向少数受信任用户开放）能够推进针对两种加密系统的攻击。第一个系统是 HAWK，这是一种旨在抵御未来量子计算机攻击的数字签名方案。在约 60 小时的工作时间和约 10 万美元的计算成本下，一名没有密码学专业知识的 Anthropic 研究员引导 Mythos 改进了该算法目前已知的最佳攻击方法，有效地将其密钥强度降低了一半。
The math HAWK’s security relies on is the hardness of the Lattice Isomorphism Problem, which, unlike today’s most-used digital signature schemes, is believed to be safe from quantum computing attacks. The best-known classical computing attack to solve this problem works by finding what are known as automorphism symmetries. Mythos outputted a previously unknown method for finding such symmetries. The result cut the key length in half. The weakness can be mitigated by doubling the key size, but the added computation makes HAWK less desirable than available PQC signing algorithms. HAWK 的安全性依赖于格同构问题（Lattice Isomorphism Problem）的难度，与当今最常用的数字签名方案不同，该问题被认为可以抵御量子计算攻击。解决该问题的已知最佳经典计算攻击方法是通过寻找所谓的“自同构对称性”。Mythos 输出了一种此前未知的寻找此类对称性的方法，结果使密钥长度缩短了一半。虽然可以通过加倍密钥长度来缓解这一弱点，但增加的计算量使得 HAWK 的吸引力不如现有的其他 PQC 签名算法。
In academics, cryptographic algorithms are considered broken when weaknesses allow an adversary to derive a key faster than is possible using a brute-force attack. Matthew Green, a Johns Hopkins professor and expert in cryptography, said the impressive thing about the discovery was its reliance on several existing methods that no one previously thought to put together. “What’s particularly concerning (and so especially ripe for AI) is that the attack does not invent fundamentally new mathematics,” Green wrote. “It simply extends a bunch of tools that were lying around and well-known, and gets a good result.” 在学术界，当弱点允许攻击者推导出密钥的速度快于暴力破解时，密码算法即被视为已破解。约翰霍普金斯大学教授、密码学专家 Matthew Green 表示，这一发现令人印象深刻之处在于，它依赖于几种此前无人想到要结合在一起的现有方法。“特别令人担忧（也因此特别适合 AI 发挥）的是，这种攻击并没有发明根本性的新数学，”Green 写道，“它只是扩展了一堆现有的、众所周知的工具，并取得了很好的结果。”
Anthropic elaborated: To find the attack, Claude Mythos Preview worked semi-autonomously in an agentic harness, with occasional human guidance and nontechnical direction. Mythos found the attack after an extensive literature review to understand the state of the art, and substantial mathematical reasoning and computational experiments. After finding the attack, Mythos implemented an end-to-end verification pipeline to convince itself—and the human operator—of the attack’s correctness. To find the improved method, Mythos deployed two separate agents that worked largely independently. One initially rejected the method as unworkable. The second found a way to make it work. The agents eventually worked in unison until they produced an agreement that the improved attack was effective. Anthropic 详细说明道：为了找到这种攻击方法，Claude Mythos Preview 在代理框架中半自主地工作，并辅以偶尔的人工指导和非技术性方向引导。Mythos 在进行了广泛的文献综述以了解当前技术水平，并进行了大量的数学推理和计算实验后发现了该攻击。在发现攻击后，Mythos 实施了一个端到端的验证流程，以向自身及人类操作员证明该攻击的正确性。为了找到改进的方法，Mythos 部署了两个基本独立工作的代理。其中一个最初认为该方法不可行，但第二个代理找到了使其可行的方法。最终，这两个代理协同工作，达成了一致，确认了改进后的攻击是有效的。
Sophie Schmieg, an expert in PQC at Google, said HAWK was already suspected to have weaknesses that would eventually be found. Still, the method for halving the key strength found through Mythos made the candidate algorithm less competitive than existing PQC digital signature schemes such as ML-DSA and FN-DSA. “Basically with this paper, HAWK is dead,” she wrote. 谷歌的 PQC 专家 Sophie Schmieg 表示，HAWK 此前就被怀疑存在迟早会被发现的弱点。尽管如此，通过 Mythos 发现的这种将密钥强度减半的方法，使得该候选算法在与 ML-DSA 和 FN-DSA 等现有 PQC 数字签名方案竞争时处于劣势。“基本上，有了这篇论文，HAWK 就已经死了，”她写道。
Less drama, but still kind of neat
影响较小，但依然精妙
The attack against AES produced less dramatic results. It’s based on an improvement found through Mythos for performing a “meet-in-the-middle” attack, which is used to derive a key under a chosen plaintext threat model, the best-known existing attack against AES. The technique inputs large numbers of known plaintext into the crypto system and analyzes the encrypted output for clues that, with enough inputs, eventually reveal an unknown key. 针对 AES 的攻击结果则没那么剧烈。它基于 Mythos 发现的一种改进方法，用于执行“中间相遇攻击”（meet-in-the-middle attack）。这是针对 AES 的已知最佳攻击方法，用于在选择明文威胁模型下推导密钥。该技术将大量已知明文输入加密系统，并分析加密后的输出以寻找线索，当输入足够多时，最终会揭示出未知密钥。