Can AI Break Cryptography? What the Experts Actually Think

Bitcoin

Across the shows: 15 speakers in other episodes, 7 bullish and 9 bearish calls, past 30 days

• Dan Boneh · Stanford UniversityNeutral

  Bitcoin core developers want signatures that rely only on a hash function, dropping elliptic-curve assumptions.

  Dan hears that Bitcoin core developers are excited to drop elliptic-curve assumptions and depend only on one hash function. Hash-based signatures are seen as more agile, since a broken hash can be swapped out without collapsing the scheme, while a broken lattice assumption would leave no fallback. Blockchain hashing already relies on hashes, so this adds no new assumptions. The tradeoff is that hash-based signatures lack the algebraic properties and capabilities that lattice schemes offer, such as threshold signatures and non-hardened key derivation.

  “I get a sense that in the Bitcoin space, and particularly the core devs that I talk to, they're actually quite excited about getting rid of elliptic curve assumptions in Bitcoin and having Bitcoin only depend on the security of a particular hash function.”at 28:06

Ethereum

• Justin Thaler · a16z cryptoUncertain

  Ethereum's hash-only signature plan via SNARK recursion adds complexity, bug surface and unclear security.

  Ethereum plans to use only hash-based signatures and rely on SNARK recursion, where proofs verify proofs. That approach produces much bigger cryptography and very complicated systems, which expands the surface area for bugs. The security of SNARK recursion is also not well understood. Thaler argues that relying exclusively on hashes amplifies these risks, though he calls them hard to quantify.

  “I think relying exclusively on hashes amplifies that. And the other thing is that we don't understand the security of snark recursion very well.”at 29:59

Cybersecurity

• Dan Boneh · Stanford University

  AI models could speed up cryptographic assumption testing, giving faster confidence that schemes are sound.

  Historically, a new cryptographic system needed roughly ten years of public analysis before people trusted it. AI models can now be run against a new scheme for a month. If the model fails to break it, that is strong evidence the assumption is valid. Even a model that shaves a few bits of security off a scheme is useful, since it shows the assumption is still strong. Dan argues this is a positive development that would accelerate deployment of better cryptography.

  “Let's say I'm making a new assumption and build an amazing crypto system based on it. Now we can just let a model run for a month, try to break it, and if the model can't break it, boy, do we have a lot of confidence that the assumption is valid.”at 13:11

• Eddy Lazzarin · a16z crypto

  Labs' heavy AI red-teaming could give more confidence in schemes than a decade of conventional review.

  Labs can point an unrestricted, highly cyber-capable model at a scheme and spend very large compute budgets trying to break it. If it fails, the resulting conviction about the scheme's security can exceed what the conventional expert-review process gives over a decade. Lazzarin argues that this means we could have more confidence in our security than ever before. The gap is that this information is not being created and shared publicly.

  “And at the other end, we have more conviction about its confidence than you could probably get from the conventional process in a decade.”at 14:11

• Dan Boneh · Stanford University

  AI threat to encryption is not new; nothing changes until we learn something new about standard cryptography.

  All cryptography rests on unproven hardness assumptions, because the P versus NP problem is unresolved. Decades of failed attacks on problems like elliptic curve discrete log and lattice problems build confidence in them. A clever human could always have broken an assumption, so AI does not create a new category of risk. The OpenAI batch of roughly 700 math papers contained no cryptography results, and no lab has reported attacking deployed crypto. Until new information appears, the world is unchanged. Crypto agility and several alternative standardized schemes (NIST is standardizing them) provide backups if an assumption breaks.

  “The world today is the same as the world a week ago, the world a year ago. Nothing has changed. Until we learn something new about our standard cryptographic systems, nothing has changed.”at 14:59

• Justin Thaler · a16z crypto

  AI's strength at finding bugs should help defenders more than attackers in the medium to long term.

  AI models are good at finding bugs. Thaler is optimistic that the same tools raising alarm about cryptography will also remove bugs from complex systems, which are very hard to secure. He hopes the gains will favor defensive practices over offensive ones in the medium to long term, though he hedges this as a hope rather than a forecast.

  “The AIs are good at finding the bugs. I actually hope that's good for [AI's] defensive practices more in the medium to long term than offensive ones.”at 18:44

• Eddy Lazzarin · a16z crypto

  Bunker-mode steps are already standard practice, so the warning adds no new actionable guidance.

  Institutions such as Coinbase already do many of the measures outlined in the bunker-mode post. Crypto has already prepared for a shift to alternative cryptographic assumptions, and public-key exposure on-chain is already being addressed. The specific steps the post recommends are probably risky for ordinary users and are already done by the institutions responsible for these risks. What is really needed is more information so the industry knows how to adapt.

  “My understanding is that we are already preparing. As Dan said, we have already different types of assumptions that we can switch to in cryptography, and we've prepared the path a little bit.”at 19:38

• Justin Thaler · a16z crypto

  Fully migrating off elliptic curve cryptography within a couple of years is not realistic, so bunker mode is discordant.

  If the threat described in the tweet materialized on the stated timeline, it would be a catastrophic event for digital infrastructure worldwide. No one can fully move off elliptic curve cryptography in the next couple of years. Thaler therefore argues that the focus on blockchain hygiene is discordant with the scale of the risk being described. The hygiene steps are good practice regardless of AI or quantum.

  “it's a cataclysmic event for all digital infrastructure security throughout the entire world. There's no way we're fully moving off of elliptic curve cryptography in the next couple years.”at 22:17

• Eddy Lazzarin · a16z crypto

  AI agents and easy decompilation force software teams to rethink security boundaries and open-source assumptions.

  AI can decompile software easily, which Lazzarin argues has effectively ended the advantage of closed source. AI agents also pursue open-ended side quests to reach goals, so they need tight security boundaries, sandboxes, and capability-based permissions. Lazzarin says this is one more reason to reconsider how systems are designed, so products remain secure while empowering users.

  “we have to think very carefully about the security boundaries and sandboxes and capabilities based permissioning schemes we put around the AI agents.”at 34:58

• Dan Boneh · Stanford University

  AI lets startups and software shops audit cryptography and code for bugs before deployment, a new capability.

  Historically, cryptosystems came under serious attack only after deployment, when announced systems attracted cryptographers' attention. That is the wrong time to find flaws. Because AI models can now be run on code before release, any startup or software company can have them analyze its cryptography and general software for bugs. Dan calls this an incredibly powerful tool that did not exist before, and says these capabilities are a gift to startups and established software shops.

  “now, because we control these AI models, any startup or any software shop that's deploying a new crypto capability or actually even deploying any software at all can now have these models analyze its cryptography and analyze its general software for bugs.”at 35:53

• Dan Boneh · Stanford University

  AI code scanning will raise software and crypto quality as companies adopt it before shipping.

  Dan says companies are already spending heavily to scan their codebases with the latest models. They rescan the software whenever it is updated and whenever a new model is released. He expects that as more software shops adopt the technology, software quality and cryptographic quality will rise, because nothing will ship unless a model has judged it valid. He notes that making these scans more efficient is an active research question.

  “as more and more software shops adopt this technology, I I believe that software quality is gonna go up, crypto quality is gonna go up because nothing will ship unless the model said that it's valid.”at 36:15

• Eddy Lazzarin · a16z crypto

  AI making mitigation cheap means the world's security status improves rather than erodes.

  Eddy argues that software bugs are finite, so vulnerabilities can in principle be driven toward zero or designed away and mitigated. The primary resource spent on mitigation is intelligence, which is getting radically cheaper every few months. If that holds, AI makes defenders better and the security of the world improves. He rejects the framing of a system-versus-system battle in which a smarter AI always overpowers defenders, because vulnerabilities can be removed.

  “If that's the case, we are net improving the security status of the world instead of eroding it. This is not a battle of wits where you have a system, I have a system, your system is smarter than mine”at 37:25

• Dan Boneh · Stanford University

  Hybrid elliptic-curve and lattice encryption is already deployed, so breaking elliptic curves alone wouldn't expose traffic.

  Dan explains that many internet connections already use hybrid key exchange, encrypting with elliptic curves and lattices at the same time. If elliptic curves are broken, traffic remains protected by the lattice layer. He cites iMessage and Signal as systems that have already made this migration. If researchers later broke both, the fallback would be to standardise a third scheme, which would take longer but has a known path.

  “They're encrypted using elliptic curves and lattices at the same time. If you break elliptic curves, it doesn't matter because it's also encrypted under a lattice basis.”at 39:24