LLMs won't break symmetric crypto - by JP Aumasson - bfSwA

bfSwA

SubscribeSign in

LLMs won't break symmetric crypto<br>And Anthropic's cryptanalysis work is great<br>Jul 31, 2026

Share

On July 28th Anthropic announced new cryptanalytic attacks discovered using their LLM Claude Mythos:<br>A key-recovery attack on HAWK, a post-quantum signature scheme candidate in NIST’s “Additional Digital Signatures” standardization project. Except for the toy version HAWK-256 whose 64-bit security is practically breakable, the new attack is not practical . But it's a meaningful break of HAWK’s security, as it reduces the estimated security level of HAWK-512 from its 128-bit target to at most 108 bits and, speculatively, as little as 81 (see Appendix C of the paper.)

An improved key-recovery attack on 7-round AES-128, while the full version does 10 rounds. The attack is , and totally not a surprise, posing no threat to AES . But since new cryptanalytic results for AES are rare, this result is noteworthy regardless of the way it was found. The negative result is, perhaps, more significant: Mythos found no stronger attack, let alone against full-round AES.

In the AES attack paper, Anthropic writes “We believe that further exploring the direction of LLM-assisted cryptography research is interesting—particularly in cases where the attacks developed are computationally intractable to implement and require that the language model demonstrate its correctness through a combination of approaches. One direction we believe to be particularly important is to formalize the attack techniques used in the cryptographic community.”<br>I agree with that, notably the last statement: symmetric cryptanalysis needs more unified descriptive frameworks and abstraction; too many papers use ad hoc formalism and custom notations and terminology when they’re fundamentally doing the same thing as others.<br>I also expect LLMs to find errors in cryptanalytic attacks’ complexity estimates and in security proofs. Earlier this year I asked LLMs to find bugs in security proofs of EUROCRYPT 2026 papers and they found issues in most of the proofs (showing that the proof, though not necessarily the result, was incorrect.)<br>Anthropic also helped create CryptanalysisBench, an LLM benchmark comprising cryptanalysis tasks on full- and reduced-round versions of AES, ChaCha, and on algorithms submitted to NIST’s competitions—like BLAKE—including post-quantum schemes.<br>If you’re unfamiliar with cryptanalysis, it’s not unreasonable to wonder whether LLMs could break AES, ChaCha, SHA-3, and other symmetric algorithms in use today—as a friend asked me, “aren’t you worried that Mythos could break BLAKE3?” . I’m not.<br>More broadly, I’m confident that LLMs won’t break any of the established cryptographic schemes , and won’t disprove Too Much Crypto’s conjectures.<br>In an excellent post, Matthew Green writes [with my notes] that “our symmetric ciphers [block/stream ciphers but also hash functions and MACs] are very messy [again, no “unified theory”] and robust [empirically so; more on this later]. Imagine a farmer who drags a tractor out into a patch of quicksand, and then buries it under cement. That’s what symmetric cipher design is like; it’s deliberately designed to come up with structures that are quick and easy to apply [typically, a round’s operations], but very messy and hard to untangle [as you iterate rounds]. The addition of many new raw intelligence-hours probably aren’t going to magically improve this.”<br>I'd like to elaborate on what Matt calls messiness and structure , and why these are key reasons why LLMs won’t find a practical collision attack on SHA-3 or BLAKE3.<br>So, why LLMs won’t break symmetric crypto? In largely-but-not-totally-arbitrary order:<br>Their high-level structure is secure : Here I mean constructions such as the GCM and CTR modes of operation for block ciphers and hash-function modes such as the sponge construction. I also include the round-based construction of the keyed or unkeyed permutations at the core of most symmetric schemes—though not all of them; Poly1305, for example, isn’t round-based.

They have no mathematical structure . Unlike actual math problems and unlike most public-key schemes, symmetric ciphers can’t generally be described as clean transforms within a mathematical structure—structure that allows reduction-based security proofs, but also what may be exploited for cryptanalysis (an exception is arithmetization-oriented primitives and in particular so-called algebraic hash functions, such as Poseidon, as used in ZK proof systems and FHE; another exception is VSH, a hash function based on RSA-like operations, which was proved collision-resistant but turned out not to be preimage resistant, showing structure’s double edge.) When designing a hash function or block cipher, your goal is to eliminate any structure, symmetry, or pattern that would let an attacker describe the computation as something simpler than the apparently senseless...