Can AI Actually Break Cryptography? Experts Weigh In On the FUD

Transcript

All of a sudden, a new threat emerged in the world of cryptography, which is whether our AI friends can actually attack crypto systems that we thought were secure. >> The fear here is that the AI labs could break them if they are breakable. >> The fact that people try to break them and fail gives us more confidence. NIST is already standardizing many other types of public key systems that we can switch to. So, if it turns out one of our assumptions broken, we have backups. We just need to know, >> are there startup opportunities here and where a new company might be able to come in and help?

>> Hey, welcome to our our show today. I'm Liz. I'm joined here with Tan Bonet, a professor at Stanford. Um, and Eddie Lazarin and Justin Thaylor, two members of our team here at E16Z. Um, we're here to talk about a a pretty big discussion that's going on right now that's been kicked off yesterday by a tweet that a security researcher Justin Drake put out warning the crypto industry to start preparing for what he's calling bunker mode. Um, specifically around this worry that the advances in AI are going to cause a breakthrough or breaking of cryptography faster even than of a quantum computer might which is normally the basis of the discussion that we have when we think about modern day cryptography and and what the state-of-the-art looks like. Um and so he called on you know big institutions to start thinking about moving funds and

start thinking about this. Um and a lot of that has been kicked off by some papers that OpenAI put out and different kind of innov uh breakthroughs they had in mathematical problems that were previously unsolved and how that relates back to cryptography. And so Dan I don't know if you want to kind of summarize what those breakthroughs were or what those papers put out and how that kind of kicked this off. >> So let's see. I guess the first thing I should say is uh you know everybody calm down don't panic calm down the world today is the same as it was a year a year year ago two years ago um that's the first message now I guess before we get started I just want to make sure people are on the same page in that there are kind of two stories that are

getting entangled and let's I think we should first disentangle them there is this long uh going long going conversation on the threat of quantum computing through cryptography this is not what this is about Here there's all of a sudden a new threat that's kind of emerged uh in the world of cryptography which is whether our uh you know AI friends can actually uh attack crypto systems that we thought were secure um using you know their super intelligence and so on. So I guess the backdrop to all this is that uh 700 around 700 papers were put up online presenting enormous progress in mathematics and computer science. I can't say enough about how impressed I am with the

results that have been put on online. It's really quite remarkable uh to see all the progress. I remember u my kind of inbox blew up when uh when this came online. Everybody was asking uh for opinions and so on. So I started going through the list of problems that uh progress was made on. And as I finished the list, the thing that kind of stuck in my mind is that wow this is incredible progress in mathematics in computer science. But there are no questions here on cryptography. Yeah. Not even on theoretical cryptography, right? I mean, in principle, you could uh there are lots of really interesting open problems in constructing, you know, positive development in cryptography, constructing uh new crypto systems, maybe even in a theory, things that

wouldn't directly be relevant to the real world. None of those questions were in the list of 700 problems there were uh posted. So, you might wonder, well, does that mean the models are really bad at cryptography? We don't know. Um and so I think one of the things that I would maybe like to start with is a call to the frontier labs to please tell us what have you done with uh trying to use these models to an answer basic questions in cryptography. I guess the the real question is what is the status for example on actually attacking standardized and deployed crypto? Have the frontier labs tried any of their >> Sorry. So just just to clarify what you're saying, this this tweet was not kicked off because there was something in the papers specific to cryptography,

but rather that just the fact that they had massive breakthroughs in any sort of mathematics means there was likely a breakthrough in cryptography. >> It was it was the OpenAI drop had a variety of papers across hundreds of different topics. Hundreds of different topics. And many of those topics, although weren't specifically about cryptography, were adjacent to cryptography. I'd say in the loose sense that they involve progress using similar techniques and mathematical reasoning that one would use to make progress in cryptography. So their absence is a little bit conspicuous right is what is what Dan is saying and it's something that you know you have to consider the explanations for. On the one hand, if

the reason for the omission is that AI models are notably bad and couldn't find anything and that cryptography is particularly robust for some reason, that in itself would be very interesting, right? If in other words, if the if the labs attempted to make progress in theoretical or applied cryptography and didn't really find anything worth discovering, that would be in itself very interesting. If on the other hand they did make progress and there could have been a lot to share but there were reasons that what they wanted to what they could have shared would be concerning then that would be very interesting to know as well.

>> And so I just I want to go go back to what you kind of kicked off with here which is um we kind of breezed over this is we are not it is not a given that the current kind of like cryptographic standards we use are human breakable. we just don't know if they are or not um today. And so the fear here is that the AI labs could break them if they are breakable. >> Yeah, I think this is actually a really important point in that all of cryptography is based on complexity assumptions. Yeah, it's based on assumptions. We have to assume that certain problems are hard. The reason we can't prove that those problems are hard is because that's related to a famous open problem in computer science called the P versus NP problem.

in some sense we first have to resolve that problem before we can actually argue that cryptography uh the certain cryptographic problems really really are are hard. Um and so since that we are very far away from that none of the problems that uh were posted uh this week come even close to resolving the P versus NP problem. We still have to keep making assumptions in cryptography. Right? So the assumptions are that certain problems are hard. Let's say elliptic curve discrete log. Let's say short of vector and latises. uh you know we have a whole list of problems that we know and love and we build uh crypto systems from. Um we a lot of people have worked over the years on trying to break those assumptions and in fact there's a huge body of literature on uh failed

attempts on partial attempts partially successful attempts. Uh so this is a very active area and so far all these problems remain secure and our crypto systems are based on those uh on those problems. But now there's a new player in town, right? Somebody else could try to come up with uh other ways to solve these problems and maybe they'll see something that us humans have not seen. That's certainly a possibility. But I again I need to stress this is not a new possibility. 2 years ago, 5 years ago, 10 years ago, you know, a clever human could have come up with a new attack that nobody has seen before and break some cryptographic assumptions.

Cryptography is sort of built on assumptions. we realize things are built on assumptions that could end up not being as strong as we expect. Um, and so it's wonderful that people try. This is actually how we gain confidence in our assumptions. The fact that people try to break them and fail gives us more confidence. So in fact, I would say this would be an extremely positive development if the labs try their best models at some of our basic cryptographic assumptions. The models fail to break them. The labs say that they fail to break them. that will give us tremendous confidence that our assumptions are valid. And even if they shave off a little a little bit of security, let's say they shave off 10 bits of security from one of the problems that we use in practice, that's

great. That's wonderful for us to know. The fact that all they could do is shave off 10 bits of security is actually already very strong evidence that the assumptions are actually worthwhile using. Another thing that would be nice for the the labs to try is I think we can hope to use these models to give much stronger evidence than we than we currently have that these problems are hard. Uh by which I mean for a lot of these problems are evidence right now while we have things like you know we know they're just as hard in the worst case as the average case which you know for some of them these lattice problems uh which is helpful. Um but uh there are complexity theoretic results you could hope to show uh that would give more evidence more more confidence in the

interactability of these problems that they have no efficient algorithms. Uh I' I'd say that you know Dan is totally right like mo most of the reason for you know today's cryptography uh that we have confidence you know these these problems actually are intractable is you know people have just tried for decades and decades um and and haven't come up with any good algorithms but we we can hope for other kinds of evidence um and those are like pure math questions that these frontier labs could be turning their models on. the specific tweet that we're referencing was about crypto wallets and how the impact of this on on crypto, but there is a much broader implication of breaking like ECDSA. Um, and so I don't know if maybe one of you is willing to kind of elaborate a little bit more on the larger implications of

what that would look like and why it exists outside of that bubble. >> Please. >> Oh yeah, of course. So the implication of uh let's just pick on one of the one of the assumptions that are being used in the real world. Let's say what's called elliptic elliptic curve discrete log. If it turns out this assumption is not as strong as we thought and there's actually a realistic attack on it, that would not be good. Yeah. So, not only for the blockchain space, this would affect the entire internet. It affects the actually to be honest, it affects the entire digital world. So, home banking healthcare government communications, everything is impacted by such a break. I should say that we already NIST is already standardizing many other types of public key systems that we can switch to. So if it turns

out one of our assumptions is broken, we have backups that we can move to. Um in fact we have uh several backups that we that we can move to. And so we just need to know is this like a high priority? Is this something that we don't need to do right away um and so uh the lack of knowledge right now is creating a vacuum I think in the you know tweet sphere and uh that vacuum really needs to be filled. Well, so maybe maybe to to simplify just a little bit, it's that the process in the absence of the ability to prove that these problems are hard, the problems on which cryptography is built. In the absence of that ability, we specifically rely in some sense on time. Right? That is that's

kind of what we are doing. I know I'm oversimplifying a little bit, but we put these schemes out and we wait. And we wait because what we believe is happening is that experts like cryptographers and mathematicians are testing and trying to break these things. And if they're around for long enough and many enough people have talked about them and tested and talked with each other about they're trying to break these schemes and they don't, we emerge with confidence that they're hard to break. And because of the pace of progress on AI's mathematical abilities, there is a conspicuous absence of time.

Right? There is kind of a gap between the rate of progress and the information we're getting from the people who seem to have most of the effort, most of the cognitive ability to even scrutinize these things. A whole new well of cognitive ability to scrutinize has appeared. And we're not hearing from them about what they are discovering through their work in the normal way that we would from the academic and you know computer science and cryptography research mechanism. >> You're totally right. In the past when one someone would make an assumption and build a system based on it, we'd have to wait like 10 years before that system could be deployed >> to gain confidence to give people enough time to analyze the >> and now all of a sudden we can

accelerate this process tremendously using these models. This is an remarkable tool. Somebody makes an let's say I make an a new assumption and build an amazing crypto system based on it. Now we can just let a model run for a for a month try to break it and if the model can't break it boy do we have we have a lot of confidence that the assumption is valid system. Yeah it's it's funny because it's a change in how we normally do it right. Normally we have this to the public or to an informed person in the public. We have a background rate of attention that is paid by our cryptographers to these systems and we just sort of sit back and we wait long enough that we assume and we assume make some assumptions about their prioritization that they're paying attention to the important things and

then after long enough we say this has got to be good. This is probably good. But now we have a completely new thing where the labs can say we took our tip-top totally unrestricted most cyber capable model and we told it to go absolutely insane and we spent $20 million $50 million trying to break this scheme and out the other end we have more conviction about its confidence than you could probably get from the conventional process in a decade.

So we actually have the prospect to have more confidence in our security than ever before. It's just there's a little bit of a gap in how that information is being created and shared >> and we can accelerate the deployment of better uh cryptography. And the gap I have to say is also the fact that um obviously some of the models >> uh are accessible to the labs but not to the rest of the public. in the the absence of that information, um what would you recommend or how do you kind of think about this as just like an everyday user of technology? Like is this how does this impact how you interact with technology if at all?

>> So nothing has changed. >> The world today is the same as the world a week ago, the world a year ago. Nothing has changed until we learn something new about our standard cryptographic systems. Nothing has changed. keep using the systems as they are. When we learn something new, either we'll have more confidence or we'll have to react. But until we have more information, nothing has changed. So, please don't panic. You know, keep calm. >> Yeah. To put it another way, you know, the the the reaction yesterday and continuing today is not a reaction to new information.

what the reaction is maybe an indirect reaction to the dump of mathematical results from open AI of very indirect kind of information about AI's progress which I again is is amazing but I don't think is a surprise it's like all Silicon Valley has been talking about for years now uh but but it's but it's not a specific reaction to a specific piece of information about cryptography we didn't learn that uh elliptic curves are vulnerable in a way that they weren't before we didn't learn that any specific cryptographic assumptions had have less security than they did before.

Maybe to give people a little bit more uh confidence also we have a lot of different types of assumptions that we use to build public key cryptography. It's not just elliptic curves or lises. We have isogynes and codebased systems and and multivaried polinomial based systems. There are many the hashbased signatures. There are many other types of uh assumptions that we can build public cryptography from. So if we need to react, we can react. Of course, everything takes time, but we sort of know where to go. And and so um uh even if the worst of the worst happens, there are still plenty of ways for us to recover. So what one thing um I guess worth mentioning is like we we generally

believe there is no efficient algorithm for these problems. Um, and if you know it's not that we think there might be and humans just aren't smart enough to fight it. We think there is not one. And so if there is not one, it doesn't matter how smart the AI is, it cannot find the non-existent algorithm, right? And so, you know, the worry is, you know, we're that just our our our belief is totally wrong. But to be clear what the belief is, right? It's not the algorithm's there and we're we're too dumb to find it. Uh, it's that it's just not there at all. Right? So, uh, that's that's one thing to clarify. Um the the first tweet was one by by Justin Drake of the Ethereum Foundation um warning of a possible complete break of elliptic

curve cryptography in the coming months. Um and suggesting that um at least like large cold wallets on uh the Ethereum blockchain enter what do you call bunker mode or at least not have exposed public keys on chain. Um and then uh Vitalik uh Buterin followed up with um a uh slightly more toned down uh tweet but still speculating about um you know better attacks that AI might find on on on crypto systems. So um yeah and like in Vitalik's tweet even mentioned that like he himself has lost more you know personal funds in botched migrations than in all hacks right so uh you know I think we as humans tend to uh you know

struggle with uh tail risks that are very scary um and sort of psychologically you know uh prone to dominate our thoughts when there are sort of clear and present risks that are actually um more dire uh even though less less scary and less cataclysmic. Um and so uh yeah, I just want to emphasize that you know bugs remain everywhere. Um the AIs are good at finding the bugs. Uh I actually hope that's good for you know uh a aids defensive uh practices more uh in the medium to long term than than offensive ones. Um, and yeah, if uh basically the the worst thing you can probably do right now um is something you should you should do nothing. Um and

and actually the the recommendations in in Justin Drake's post uh were were really just good practice, good hygiene that all of these institutions should already be following independent of AI or quantum or or anything. >> To to Justin's point regarding institutions following all of these practices, you know, Coinbase already came out and said they already do this, right? that they already do a lot of the specific measures outlined in bunker mode and I think that they they will continue to do that. It's true. A funny thing about it is that the further down this rabbit hole you go, I think we are already preparing.

My understanding is that we are already preparing. As Dan said, we have already different types of assumptions that we can switch to in cryptography and we've prepared the path a little bit. we already require uh you know from the the market I mean institutions to take some of these best best practices like making sure you know public keys aren't revealed on the blockchains where that's relevant right we already do a lot of these things uh and as we learn more accelerated by AI research and their skills in math we will probably add more and more methods of preparation to our kit so the the the the the frustrating thing about the uh the take we need to go into bunker mode we to prepare is that it the the the specific things that

it advises us to do are probably not good and risky for normal people to do and are already things that the hardcore institutions who should take responsibility for these risks are doing. So there is not a specific set of recommendations that come out of this specific new practices. The the the if we're calling for anything here, what we're calling for is more information. So we can know how to how to adapt. >> And correct me if I'm wrong, but the types of crypto cryptography that this tweet, the Justin Drake tweet, is referring to possibly being broken by advanced in AI are the same types of cryptography that are under threat from a quantum computer as well. So this is

like a threat we have already been thinking about for a while, a threat we've already been preparing for for a while. And if it comes from AI before it comes from the quantum computer, >> it doesn't make it new. And Dan opened with a couple remarks on this about the conflation of the quantum issue from the AI math skills issue, right? And the reason those part of the reason why those things get conflated is that what Justin Drake was talking about was a lot of his fears about elliptic curve cryptography. And what's funny is because of fears of the quantum threat, people have already begun to treat elliptic curve cryptography as something that may be vulnerable soon. So we have already actually engaged in and prepared and deployed

many of the mitigations you'd need for those exact concerns for a different threat. Right? So that's why it's a little bit of a funny thing for him to say because it didn't come with specific concrete recommendations about how institutions ought to prepare in a way they are not preparing today. I I I would I would also add that if um what Justin was warning about happens in the timelines he mentioned um it's a cataclysmic event for all digital infrastructure security throughout the entire world. Right there there's no way we're you know fully moving off of elliptic curve cryptography in the next couple years. Um, and so the focus on blockchain hygiene is just very

discordant with this cataclysmic event he was discussing. >> You know, I will I will add to that though that uh the quantum threat is really only about these elliptic curve type systems and and RSA and such. the AI threat in some sense is broader in that it could actually also look at our postquantum systems and potentially um weaken them in some way um maybe break them altogether. Um and so it is quite important to know that the latest models could not break our postquantum candidates because those are the ones we're moving to. Uh so that would be uh would be quite helpful. Now, in terms of what to do, people I mean, I guess the

the question is kind of what what do we do about this? I totally agree with Eddie. The the answer is we should be doing what we are already preaching to do. And one of the main things that we always preach is what's called crypto agility. Yeah. That we deploy systems that can quickly switch from one type of design to another if the design is being used turns out to be insecure. Crypto agility is in some sense our our friend for defending against the unexpected. Yeah. And we should keep on doing that. Yeah. We're already crypto agility is a term that's over a decade old. Uh yeah, so we should keep on doing that and if our AI friends come up with things that uh we didn't expect, well, you know, the crypto agility will kick in and we'll move to something that is that remains

secure. This debate also surfaced another opportunity to relitigate something that comes up all the time which is elliptic curves versus hashes versus lattice cryptography as the fundamental basis for specific constructions and specific applications. And of course uh you then of course it's totally correct that the AI thread is broader because the just to reiterate it slightly is you know if cryptography relies on the difficulty of specific problems it could find flaws in the in these problems on any of the schemes right not not just elliptic curve cryptography but to get a little bit into the details what Drake was saying

was that there may structure in lattice cryptography and elliptic curve cryptography that perhaps makes it more vulnerable to the ideations of a very well-resourced AI model. Again, we didn't learn anything specific about that per se from the OpenAI drop, but uh but you know, I think it's a little it's a little bit less clear to And I'd love to hear from from Dan and from from Justin about uh what is it specifically maybe about hashes or about lattice cryptography in addition to elliptic curve cryptography that maybe makes g gives someone might give someone reasons

to believe some are more secure than others to an AI threat. >> And the point there is that we think of hash functions as postquantum but they might not be post AI. That's the >> Yeah, that's right. That's right. And we think of lattice as postquantum but not necessarily post AI right and so how do you think of the yeah >> how do you think of them >> right good so the migration to postquantum cryptography I guess uh in the blockchain space there's actually quite a bit of debate on whether we should be using lattice based signatures or hashbased signatures on the internet at large there is no debate on the internet at the at large everybody's using lattis based uh crypto systems for key exchange for signatures that's a done deal in the blockchain space. There

is still a debate as to whether we're going to use hashbased uh signatures or lattice based signatures. Generally, the attitude in the community is that hashbased signatures are more secure. And there is multiple reasons to say that. Um one reason is that if it turns out that one hash function turns out to be not as secure as we thought, we simply switch it out for another hash function and everything works as before. The framework is guaranteed to be correct. Yeah. Uh so there's like more agility when we use hashbased signatures. If for some reason it turns out that the core lattice problems are not as hard as we thought the whole mechanism collapses and we have no recovery. We can just not use latticees period. So in some sense hashbased

signatures are far more agile than um lattisbased signatures. >> Yeah. Because a hashbased scheme although it may vary in the specific hash function being used the entire construct of a hashbased scheme >> the framework is sound. >> The framework is sound. So in other words the choice of hash function which would be the thing that would break >> right is uh is less important so to speak in the in the in the grand construction whereas in lattice space based cryptography maybe like elliptic curve cryptography all those different schemes rely on maybe a specific shared problem or shared set of assumptions.

>> Yeah. Uh the the other argument that I hear a lot in the in the blockchain space is that specifically in Bitcoin and Ethereum is that uh the hash assumptions that we make are necessary for other parts of the blockchain to operate. Merkel trees and such we already make lot of hash assumptions for the core functioning of the blockchain. So in some sense if our signatures were also purely hashbased we are not adding any new assumptions to the security of the blockchain. Whereas if uh for one part of the blockchain we use hashes and for signatures we use lattises all of a sudden now we have two different types of assumptions that if either one of them breaks we have a problem. Yeah. And so reducing the number of assumptions in

the blockchain is also something that uh people are are kind of excited about. I get a sense that in the Bitcoin space, in particularly the the core devs that I talked to, they're actually quite excited about getting rid of elliptic curve assumptions in Bitcoin and having Bitcoin only depend on the security of a particular hash function without any additional assumptions. Uh and in some sense, the same thing is also playing out in the uh in the Ethereum Foundation space. Um yeah, so I think I'd say those are kind of the comparisons between the two. >> This is this is a complicated question, much more so than it appears on the surface. um sort of you know uh should blockchains rely exclusively on on hashes um or or should they uh use lattises? Um so I mean one thing to say

is like the whole world's digital infrastructure is going to be very challenged if um uh we only use hashbased cryptography because you just can't do uh you know good encryption key exchange from that. Um but also like especially in the Ethereum community um the way uh they plan to use only hashes which comes with downsides like um you know just bigger cryptography um is is to uh use what's called snark recursion. So basically you have these proofs that you know you know a bunch of signatures or something and then you prove you know those proofs and prove you know those proofs and so on and so forth. And so there there are two issues there. Uh the more prosaic issue is this is just very

complicated, right? To like prove you ran a snark verifier that it's self-verified a proof that verified a proof. Um and so the surface area for bugs just gets very large. And yes, I'm very optimistic that the same AI tools that are scaring people about cryptography will also help us get all the bugs out. Uh that's a very hard problem. So, you know, we have to speculate just as much on I know the bugs is like a really really really hard problem. So the AI is going to have to be really good if we're going to get all of those bugs out from a system that complicated. Um, and I think relying exclusively on hashes amplifies that.

And the other thing is that we don't understand the security of snark recursion very well. So that's another, you know, you tell me latises might be attackable. I say, well, I don't know about snark recurs. You know, uh, again, it's there's a lot of non-quantifiable risks and, you know, um, I'll just leave it at that. We have to do our best to to weigh these things and the public discussion weighing them can be pretty frustrating sometimes. H yeah that's right I I do want to make one more one more point on the hashbased versus lattisbased uh it is quite important to understand that lattisbased systems have much better properties than hashbased which is actually why many in the crypto community are pushing towards lisbased systems. So things like threshold uh signatures, things like uh non-h harden

key derivation, there are many properties of hashbased of lattisbased systems that we simply don't have with hashbased systems. Also hashbased systems are harder to use in principle like Justin was saying they're much larger um and they're they're stateful versus stateless. There are many technical issues with getting hashbased signatures uh to work. So um many of us cryptographers are actually a little sad that uh some of the blockchain community will move to hashbased signatures that really have no algebraic properties for us to leverage for more advanced applications. Um so in some sense there's um a trade-off that we're making in perhaps we are removing assumptions from the blockchain space but we're also

removing capability in that now we are going to be using uh pro uh um signature schemes that have far fewer properties than what we would have if we were using lises. So as a cryptographer to be honest I would be quite happy if we ended up using lattice based schemes because that gives us much more room to play in and build interesting uh structures with the hashbased schemes who are much much more constrained. But perhaps that constraint is also where this extra sense of security comes from. So maybe to give a a quick summary of what what we've kind of discussed so far, what it's what it sounds like is, you know, and I think Justin laid this out very nicely. Um it is not a given that there is an efficient algorithm that could be found to break this type

of cryptography. If there is an efficient algorithm out there, then the time frame at which to find it will have is likely very very sped up given our advances in AI. And that's where the kind of panic and confusion is coming from is the the possibility that that efficient algorithm both exists and now the timeline is much shorter than it would be without these advances in AI. And the easiest way to minimize that panic is for more information from the labs to come out on how much work they've done to try to find that algorithm. And if if the labs came out and said, you know, we threw a bunch of compute and time and money at this and we couldn't crack it, that would give you confidence at least until the next a big upgrade in the model that we have a

reasonable safe security assessment. >> In the extreme case, it should give you more confidence than the history until today, right? If you really do believe like many do like many of the people posting yesterday believe that these uh you know these models are now basically at at or better than the vast majority of people who are trying to to to you know who who are studying these systems or they will be soon or whatever then you should get great confidence from knowing that uh the equivalent of you know 100,000 expert uh mathematicians or cryptographers took a look at a scheme.

It should actually make you more confident than you could have ever been about one before that. I I can't help but emphasize like we need to reconsider just how we even decide what we feel confident about. So, we've talked a little bit about, you know, if you're an institution, there's a lot of these security best practices that you probably are already doing or should have been doing already. If you're an everyday user, nothing to do at the moment. Don't panic. Continue on. If you're a startup that, you know, wants to take advantage of this really interesting kind of like piece of um technology unfolding in this way, are there startup opportunities here and where a new company might be able to come in and help?

>> I think the most obvious note that I take out is that well startups will have to need to heav you know seriously consider what types of security assumptions they make in their in their software today. You know, however they design their systems. that's already kind of happening on multiple fronts, right? How people think about open source is changing, right? Uh didn't close source basically everyone recognized closed source died last week, right? Because of our ability to decompile things. Um it's also the case that because of the agentic properties of AI systems, by agentic properties, I mean they can go on unbounded side quests, right, and do all kinds of random things in pursuit of a goal for

you. Because of this, we have to think very carefully about the security boundaries and sandboxes and capabilities based permissioning schemes we put around AI agents. So, we're already thinking about rethinking security from that lens. Well, this is just yet another way we need to reconsider what systems are capable of and how to design software and products that remain secure and that protect users as much as they empower them. >> I I would go even a step further. I think that um these new capabilities are a gift to startups and to even more established software shops. So I can tell you in the past when the time when a crypto system becomes really

interesting to attack is once it's announced that it's about to be deployed or is already deployed like like this is when after it's deployed it gets a lot of attention um from cryptographers and that's kind of the wrong time to attack a crypto system. Whereas now, because we control these AI models, any startup or any software shop that's deploying a a new crypto capability or actually even deploying any software at all can now have these models analyze its cryptography and analyze it general software for bugs. >> This is an incredibly powerful tool that didn't exist before. Over time, as more and more software shops adopt this technology, I I believe that software quality is going to go up, crypto

quality is going to go up because nothing will ship. Yes. Unless the model said that it's it's it's valid. >> I I I saw someone recently because of the release of like 5.5 Hiku and they were comparing with 4.5, right? And uh making many comparisons between models from a year ago versus today. And it's always hard to do an applesto apples comparison when the the capabilities per token have increased so much, but some people were coming up with estimates like it's 90 some plus 95% cheaper, right? 99% cheaper for uh you know uh intellectual capability per dollar, right? Uh if if that's the case and you

pair that with a frame we've said before, we talked about before which is that the number of bugs in software is finite, right? Then we're asmtoically approaching zero bugs. Maybe and maybe we actually just hit zero at some point. Maybe we have the ability to create zero with some assumptions right? If that's the case, we are net improving the security status of the world instead of eroding it. Right? It's that this is not a battle of wits where you have a system, I have a system, your system is smarter than mine. Therefore, I am vulnerable to you. Like no matter what, no matter how I configure myself, you can overpower my computer and destroy my computer. Right?

it that relies on there being vulnerabilities and vulnerabilities can be removed. They can be designed away. They can be mitigated. And the primary resource we dedicate to mitigating it is the thing is a thing that's getting radically cheaper every couple months. Uh and that's, you know, AI capabilities, intellectual capabilities, you know, intelligence, machine intelligence, whatever you want to call it. >> Companies actually are already doing this. companies are actually spending a lot of money >> on exactly scanning their their codebase with the latest models >> and it's actually really quite interesting. Every time there's a software update, they scan the model the software again. Every time a new model comes out, they scan the model again.

They scan the software again. And so um um I have to say one of the interesting research questions in the space, this is something actually we are quite interested in is how do we do software scanning at uh more efficiently. Yeah. So we don't have to maybe rescan everything every time a new model comes out. Yeah. Or every time a change is introduced. So there's even lots of interesting areas for thought and research here. >> Yep. >> Let's say the the labs take up your plea. They throw a bunch of compute at it and they come out and they say like you're right. We did break elliptic curve cryptography actually. What what happens next? Like you know we record this podcast today and tomorrow what does the world look like? What is the next step? Then then basically we have to move to postquantum cryptography

which we're already doing. Uh we have to move to these lattice based systems which are already deployed. Uh if you look by the way if you can literally look at um uh many internet connections today they are actually using agile cryptography they're encrypted using elliptic curves and lattises at the same time. If you break elliptic curves it doesn't matter because it's also encrypted under a lattice basis. >> Yeah. Didn't like iMessage make that migration last year and and and and many other such systems have done that. >> Exactly. Signal and so on. Yes. Yes. In fact, but I was actually referring to one of the TLS uh exchange >> I guess it's called X25519 MLM 768 the jumble of letters but what it means is you're protected by both elliptic curves

and and lises. >> Now maybe the labs come forward and say oh we broke both right. Well fine then we introduce a third one. Um we'd have to standardize. that would be a longer process, but that would be what would come next. So, we kind of know where to go. It's just going to be more work and um perhaps more more of a rush. >> Yeah. And and maybe at the risk of stating the obvious, like I I have no doubt they would be prudent enough to do this the right way. I It's goes without saying, but the labs shouldn't go and share this just like throw out, you know, a scheme to break uh break elliptic curves. they should responsibly disclose it to to the to the industry to the government to the industry develop a

plan and everybody needs to update their software as quickly as possible and hopefully we could move quickly and and and and adapt but uh but again that is a known process that a lot of people take for granted like I'm it's almost like silly I'm saying it because all security experts know this very very well and so there is there is a way to do such a thing should it happen. >> Great. Well, thank you for that. I feel calmer, so hopefully everyone else does as well. Um, thanks so much. >> This was fun. Thank you, Liz.