Some thoughts about Anthropic's new cryptanalysis results

Some thoughts about Anthropic's new cryptanalysis results

• ID: 5b942aaf
• 原文链接: https://blog.cryptographyengineering.com/2026/07/29/some-notes-about-anthropics-new-results/
• 作者: Matthew Green
• 发布时间: 2026-07-29
• 抓取时间: 2026-07-30

中文导读

Matthew Green 拆解 Claude Mythos 的两条密码学结果：HAWK（module-LIP 签名提案）安全比特约被腰料，是真有 standardization 影响的结果；AES 七轮加速则远没破实装，需约 2^89 运算与海量选择明文。关键判断：AI 密码分析已能把散落工具拼成可跑攻击，瓶颈变成人类可验证性。

为什么值得关注

HAWK 被腰料有实际意义，AES 加速远未破实装；瓶颈已从「能不能」转到「人能不能验」

原文摘录

Some thoughts about Anthropic’s new cryptanalysis results

发布时间: 2026-07-29T14:23:30+00:00

原文链接: https://blog.cryptographyengineering.com/2026/07/29/some-notes-about-anthropics-new-results/

Yesterday Anthropic published two new cryptanalysis results, both outputs of Claude Mythos, their (still) unreleased advanced model. The first of these results attacks a signature scheme called HAWK, while the second is an improved attack against reduced-round AES. Anthropic also released a blog post describing the research process that produced these results. A few people online have asked me what this all means. While I’m not sure I have all the answers, I figured it wouldn’t hurt to write a bit about my current understanding. These are _only my thoughts_ and other folks will probably differ (including domain experts in the two areas at issue) so take them for what they are.

The two new results cover two very different areas, and are overall just very different in quality. Before we get to broad statements about the world, and whether you should sell all your cryptocurrency, let’s take a minute to talk about the substance.

Hawk. The first is a new key recovery algorithm against the non-standard signature scheme HAWK. HAWK is a proposed post-quantum-safe signature scheme that’s based on the module Lattice Isomorphism Problem (module-LIP). For a brief Claude-written summary of the result itself, see here. There are five things you need to know about this result:

1. HAWK is not a deployed or standards-adopted algorithm, it’s a _proposed algorithm_. It is related to the Falcon signature scheme, which is being standardized, but the attack does not transfer to that setting (which is based on a different hard problem.) 2. However, HAWK was somewhat far along in the process of being evaluated for a future standard. 3. The attack does not break “real deployed” HAWK in the sci-fi sense. The resulting attack is still exponential time, but roughly halves the number of “bits” of security in the algorithm. That means it could theoretically be fixed by doubling key sizes. The downside is that this makes the scheme less efficient, and, since HAWK is entirely motivated by being more efficient than alternatives, that makes the existence of the scheme much harder to justify. 4. The attack produced real code that runs in a few hours of wall-clock time _against a weakened “challenge instance” of HAWK that the authors provided for this purpose_. While this instance doesn’t use the parameters that were proposed for real deployment, it does demonstrate the cryptanalytic weakness well enough. 5. What’s particularly concerning (and so especially ripe for AI) is that the attack does not invent fundamentally new mathematics. It simply extends a bunch of tools that were lying around and well-known, and gets a good result.

This last part is important. I asked Claude for its thoughts, and it doesn’t mince words: “what makes this genuinely interesting — and, frankly, a little embarrassing for the field — is that none of the ingredients are exotic.” The TL;DR is that someone just did a much more thorough job applying all of our known tools. This is the sort of things that attack AIs excel at.

AES. The second result is a new attack on reduced-round AES. This result initially sounds more exciting, since most people hear “attack on AES” and panic. However, this is also the result that’s _much, much_ less interesting.

Most folks reading this blog will know that AES is a standard block cipher that’s used just about everywhere. It’s been a standard since 2001, and the deployed version has so far withstood everything significant that’s been thrown at it: that includes a substantial amount of non-public testing performed by the NSA. Since attacking full ciphers is very difficult, it’s standard for cryptanalysts to do their work against weakened, or “reduced-round” versions of a cipher. The full AES cipher runs for either 10, 12 or 14 rounds depending on key size. The new Anthropic result attacks a weaker 7-round variant of the cipher.

Critically, attacks against 7-round AES are not new: there have been several of these. In fact, this new Anthropic result is a modest constant-factor improvement on previous work from back in 2013. To give you a sense of how far these attacks are from really “breaking” AES, I’d note the headline results: the new attack requires 289 cipher operations and, even worse, this work is only possible after you’ve somehow convinced a real encryptor to produce 2105 encryptions of chosen plaintexts under their secret key! Neither of these things is remotely practical in the real world. And while the new result modestly speeds up this attack over the previous result, it’s not even clear how “real” the speedup in this result is: since the actual attack requires 289 operations and can’t really be “run”, what we have is an on-paper analysis that may or may not yield an actual runtime improvement if all details are actually worked out.

This does not make the result bad! In fact it’s still interesting from a techniques point of view. But it is very much a small increment in our knowledge, not a practical new attack like the HAWK work. So TL;DR: no wildly new mathematical results here. But still, real cryptanalytic progress of the sort that make scientists excited. And certainly the HAWK result is very meaningful, since

[... 原文已截断，完整内容见链接 ...]