Notes ·
Claude Discovered Weaknesses in Cryptographic Algorithms
Anthropic reports that Claude discovered improved attacks against two cryptographic algorithms, moving beyond finding programming mistakes to identifying weaknesses in the underlying mathematics.
The most significant result affects HAWK, a post-quantum digital-signature candidate currently being evaluated by NIST. After two years of expert review, Claude found an attack that reduced the estimated security of its smallest proposed key from 2^64 operations to 2^38. The model also developed an attack against a seven-round research version of AES that was between 200 and 800 times faster than the previous best approach.
Neither discovery compromises software in use today. HAWK has not been deployed, and full AES-128 uses ten rounds rather than the seven-round version Claude attacked. This is cryptographic review working as intended: find weaknesses before algorithms protect real systems.
What I find most notable is that Claude produced the AES result in about a week, but human researchers needed nearly a month to become confident that it was correct. We may be approaching a point where AI can generate research faster than qualified humans can validate it.
That is both useful and concerning. These models could help us examine cryptographic systems that have never received enough attention. They could also discover practical weaknesses in deployed systems before maintainers are prepared to understand, disclose and repair them.
The question is no longer whether AI can assist security researchers. It is how we handle a world where the research itself is produced faster than we can responsibly verify and act on it.