LLMs won’t break symmetric crypto

大语言模型（LLM）无法破解对称加密

On July 28th Anthropic announced new cryptanalytic attacks discovered using their LLM Claude Mythos: A key-recovery attack on HAWK, a post-quantum signature scheme candidate in NIST’s “Additional Digital Signatures” standardization project. Except for the toy version HAWK-256 whose 64-bit security is practically breakable, the new attack is not practical. But it’s a meaningful break of HAWK’s security, as it reduces the estimated security level of HAWK-512 from its 128-bit target to at most 108 bits and, speculatively, as little as 81 (see Appendix C of the paper.)

7月28日，Anthropic 宣布利用其大语言模型 Claude Mythos 发现了新的密码分析攻击：针对 HAWK 的密钥恢复攻击。HAWK 是 NIST“附加数字签名”标准化项目中的后量子签名方案候选者。除了 64 位安全性实际上可被破解的简化版 HAWK-256 外，这种新攻击在实践中并不具备可行性。但它对 HAWK 的安全性构成了实质性破坏，因为它将 HAWK-512 的估计安全级别从 128 位目标降低到了最高 108 位，甚至推测可能低至 81 位（详见论文附录 C）。

An improved key-recovery attack on 7-round AES-128, while the full version does 10 rounds. The attack is, and totally not a surprise, posing no threat to AES. But since new cryptanalytic results for AES are rare, this result is noteworthy regardless of the way it was found. The negative result is, perhaps, more significant: Mythos found no stronger attack, let alone against full-round AES.

针对 7 轮 AES-128 的改进型密钥恢复攻击（完整版为 10 轮）。这种攻击并不令人意外，也完全不会对 AES 构成威胁。但由于 AES 的新密码分析成果非常罕见，无论其发现方式如何，这一结果都值得关注。而其“负面结果”或许更为重要：Mythos 没有发现更强的攻击，更不用说针对完整轮次 AES 的攻击了。

In the AES attack paper, Anthropic writes “We believe that further exploring the direction of LLM-assisted cryptography research is interesting—particularly in cases where the attacks developed are computationally intractable to implement and require that the language model demonstrate its correctness through a combination of approaches. One direction we believe to be particularly important is to formalize the attack techniques used in the cryptographic community.”

在关于 AES 攻击的论文中，Anthropic 写道：“我们认为进一步探索 LLM 辅助密码学研究的方向很有趣——特别是在所开发的攻击在计算上难以实现，且需要语言模型通过多种方法组合来证明其正确性的情况下。我们认为一个特别重要的方向是，将密码学界使用的攻击技术形式化。”

I agree with that, notably the last statement: symmetric cryptanalysis needs more unified descriptive frameworks and abstraction; too many papers use ad hoc formalism and custom notations and terminology when they’re fundamentally doing the same thing as others. I also expect LLMs to find errors in cryptanalytic attacks’ complexity estimates and in security proofs. Earlier this year I asked LLMs to find bugs in security proofs of EUROCRYPT 2026 papers and they found issues in most of the proofs (showing that the proof, though not necessarily the result, was incorrect.) Anthropic also helped create CryptanalysisBench, an LLM benchmark comprising cryptanalysis tasks on full- and reduced-round versions of AES, ChaCha, and on algorithms submitted to NIST’s competitions—like BLAKE—including post-quantum schemes.

我对此表示赞同，尤其是最后一点：对称密码分析需要更统一的描述框架和抽象；太多的论文在本质上做着同样的事情，却使用了临时性的形式化方法以及自定义的符号和术语。我还期待 LLM 能发现密码分析攻击复杂度估计和安全证明中的错误。今年早些时候，我让 LLM 查找 EUROCRYPT 2026 论文安全证明中的漏洞，它们在大多数证明中都发现了问题（表明证明过程本身是不正确的，尽管结果未必错误）。Anthropic 还协助创建了 CryptanalysisBench，这是一个包含针对 AES、ChaCha 的完整和简化轮次版本，以及提交给 NIST 竞赛的算法（如 BLAKE，包括后量子方案）的密码分析任务的 LLM 基准测试。

If you’re unfamiliar with cryptanalysis, it’s not unreasonable to wonder whether LLMs could break AES, ChaCha, SHA-3, and other symmetric algorithms in use today—as a friend asked me, “aren’t you worried that Mythos could break BLAKE3?”. I’m not. More broadly, I’m confident that LLMs won’t break any of the established cryptographic schemes, and won’t disprove Too Much Crypto’s conjectures.

如果你不熟悉密码分析，怀疑 LLM 是否能破解当今使用的 AES、ChaCha、SHA-3 和其他对称算法是合理的——正如一位朋友问我的那样：“你不担心 Mythos 会破解 BLAKE3 吗？”我不担心。更广泛地说，我有信心 LLM 不会破解任何现有的成熟密码方案，也不会推翻“Too Much Crypto”的猜想。

In an excellent post, Matthew Green writes [with my notes] that “our symmetric ciphers [block/stream ciphers but also hash functions and MACs] are very messy [again, no “unified theory”] and robust [empirically so; more on this later]. Imagine a farmer who drags a tractor out into a patch of quicksand, and then buries it under cement. That’s what symmetric cipher design is like; it’s deliberately designed to come up with structures that are quick and easy to apply [typically, a round’s operations], but very messy and hard to untangle [as you iterate rounds]. The addition of many new raw intelligence-hours probably aren’t going to magically improve this.”

在一篇出色的文章中，Matthew Green 写道（附带我的笔记）：“我们的对称密码（分组/流密码，以及哈希函数和 MAC）非常混乱（再次强调，没有‘统一理论’）且稳健（经验上如此；稍后详述）。想象一个农民把拖拉机拖进流沙坑，然后用混凝土埋起来。对称密码的设计就是这样；它被刻意设计成一种易于应用（通常是单轮操作）但极其混乱且难以解开（随着轮次迭代）的结构。增加大量新的原始智能工时，恐怕并不能神奇地改善这一点。”

I’d like to elaborate on what Matt calls messiness and structure, and why these are key reasons why LLMs won’t find a practical collision attack on SHA-3 or BLAKE3. So, why LLMs won’t break symmetric crypto? In largely-but-not-totally-arbitrary order:

我想详细阐述 Matt 所说的“混乱”和“结构”，以及为什么这些是 LLM 无法找到针对 SHA-3 或 BLAKE3 的实用碰撞攻击的关键原因。那么，为什么 LLM 无法破解对称加密呢？按大致（但不完全）随机的顺序排列如下：

Their high-level structure is secure: Here I mean constructions such as the GCM and CTR modes of operation for block ciphers and hash-function modes such as the sponge construction. I also include the round-based construction of the keyed or unkeyed permutations at the core of most symmetric schemes—though not all of them; Poly1305, for example, isn’t round-based. They have no mathematical structure. Unlike actual math problems and unlike most public-key schemes, symmetric ciphers can’t generally be described as clean transforms within a mathematical structure—structure that allows reduction-based security proofs, but also what may be exploited for cryptanalysis.

其高层结构是安全的：这里我指的是诸如分组密码的 GCM 和 CTR 模式，以及哈希函数的海绵结构（sponge construction）等构造。我还包括大多数对称方案核心中基于轮次的有密钥或无密钥置换构造——尽管并非全部如此；例如，Poly1305 就不是基于轮次的。它们没有数学结构。与实际的数学问题和大多数公钥方案不同，对称密码通常无法被描述为数学结构内的简洁变换——这种结构既允许基于归约的安全证明，也可能被用于密码分析。

(An exception is arithmetization-oriented primitives and in particular so-called algebraic hash functions, such as Poseidon, as used in ZK proof systems and FHE; another exception is VSH, a hash function based on RSA-like operations, which was proved collision-resistant but turned out not to be preimage resistant, showing structure’s double edge.) When designing a hash function or block cipher, your goal is to eliminate any structure, symmetry, or pattern that would let an attacker describe the computation as something simpler than the apparently senseless sequence of elementary operations it performs.

（一个例外是面向算术化的原语，特别是所谓的代数哈希函数，如 ZK 证明系统和 FHE 中使用的 Poseidon；另一个例外是 VSH，这是一种基于 RSA 类操作的哈希函数，它被证明具有抗碰撞性，但后来发现不具备抗原像性，这显示了结构的双刃剑效应。）在设计哈希函数或分组密码时，你的目标是消除任何结构、对称性或模式，这些结构、对称性或模式会让攻击者将计算描述为比其执行的看似无意义的基本操作序列更简单的东西。

BLAKE3, for example, is essentially a long sequence of XORs, modular additions, and bit rotations. There’s no other way to describe it. There’s no obvious space to navigate or high-level structure to reason about: XOR destroys linearity with respect to modular addition, while modular addition destroys linearity with respect to XOR. Consider the n-bit permutation of a sponge construction as a bijection over GF(2)ⁿ: its representation as a system of multivariate equations over GF(2) is expected to have no remarkable structure: maximal degree, a high density of monomials, and so on. The same should hold for representations over other fields. That’s Matt’s idea of messiness.

例如，BLAKE3 本质上是一长串异或（XOR）、模加法和位旋转。没有其他方式可以描述它。没有明显的空间可以导航，也没有高层结构可以推理：异或破坏了模加法的线性，而模加法破坏了异或的线性。将海绵结构中的 n 位置换视为 GF(2)ⁿ 上的双射：它作为 GF(2) 上多元方程组的表示，预计不会有显著的结构：最大次数、单项式的高密度等等。在其他域上的表示也应如此。这就是 Matt 所说的“混乱”概念。

It’s mostly differential cryptanalysis. Whether it’s linear cryptanalysis, rectangle attacks, boomerang attacks, integrate attacks, cube attacks, as well as slide attacks and most cryptanalysis tricks, all are forms of differential cryptanalysis: they exploit input–output patterns of the form “if we apply this difference in the input [wrt some operator, typically XOR], then the output [of…

这主要是差分密码分析。无论是线性密码分析、矩形攻击、回旋镖攻击、积分攻击、立方攻击，还是滑动攻击以及大多数密码分析技巧，它们都是差分密码分析的形式：它们利用了如下形式的输入-输出模式：“如果我们对输入应用这种差异（相对于某种运算符，通常是异或），那么输出（……的）”