Notes on Mythos breaking AES - Manish’s Newsletter
Manish’s Newsletter
SubscribeSign in
Notes on Mythos breaking AES<br>Just some interesting tidbits from Claude's attack on cryptography
Manish<br>Jul 29, 2026
Share
Recently Mythos was able to make the 7 round AES easier to break by 200-800x.
In short the crux was, during the attack Mythos realized one of its attack byte only permutes the output. So proceeded with a fingerprint accounting for that invariant, reducing the computation by 256x.
The objective of the fingerprinting algorithm is to increase the number of potential lookups into the table that will succeed. One of the stages of the attack from prior work had to enumerate 256 different values and then look them up in the pre-computed table. Mythos developed a fingerprint that is invariant to this guess, which directly reduces the amount of work required by a factor of 256.
The speed up is simply because one of the ‘byte’ - “a character/alphabet” if you will, no longer needs iteration for every other bytes. — that’s the basic insight mythos found.<br>for k1 in 256:<br>for k2 in 256:<br>for k3 in 256:<br>check()
That’s 2563 checks.<br>After noticing the invariant, you no longer iterate over that.<br>for k1 in 256:<br>for k3 in 256:<br>check_fingerprint()
That’s 2562 checks.
After the attack figures our k1 and k3. You just need one additional 256 checks to run AES (or verify a stage).<br>I was wondering, it is bizarre that such an old algorithm and we still didn’t spot this invariant in the algorithm!<br>See in AES,<br>XOR with a constant is a permutation
The AES S-box is a permutation
ShiftRows is a permutation
None of that was new.<br>What was not known until someone (Mythos) analyzed this specific attack, was this:<br>That after several pages of attack-specific derivation, the dependence on one guessed key byte simplifies to:<br>Table[index xor guessed_key_byte]<br>Once you derive that expression, it’s clear that the guessed byte is just changing where to look!
Why didn’t we find it earlier?
That is not obvious from AES specification.<br>Think of it like this:<br>We all know this algebraic property,<br>A(x + y) = Ax + Ay<br>Now suppose a research paper has an algorithm (like our Mythos’s attack on AES) like:<br>Result = A((x + y) - y)<br>At first glance it looks like both x and y are important. But if we simplify:<br>(x + y) - y = x<br>so,<br>Result = Ax<br>If you would have blindly just brute forced x and y, you would end up with O(n2).. but if you just see that its only x that needs resolving then its O(n).
So, that’s how the 256x speedup is coming.<br>It’s important to reiterate that this was only possible while attacking the 7 round version of AES, it doesn’t work (or haven’t been checked if it does) on the 10 round version!<br>Fun facts from the blog post, they spent around $100k in API token cost over a course of a week. The verification if the attack is genuinely correct took two researchers 1 month.<br>Some real prompts used are also shared - I really liked how the researchers are prompting it just like us. Trying to steer, convince like it’s a human - https://www.anthropic.com/research/discovering-cryptographic-weaknesses
Share
Discussion about this post<br>CommentsRestacks
TopLatestDiscussions
No posts
Ready for more?
Subscribe
© 2026 Manish · Privacy ∙ Terms ∙ Collection notice<br>Start your SubstackGet the app<br>Substack is the home for great culture
This site requires JavaScript to run correctly. Please turn on JavaScript or unblock scripts