a16z Talks with Stanford Professor: Can AI Really Break Cryptography? Unpacking the Truth Behind the Panic

Author: a16z crypto

Compiled by: Deep Tide TechFlow

Deep Tide Introduction: OpenAI's latest mathematical model results have sparked panic in the industry, with concerns that AI could destroy the cryptographic systems we rely on. This article invites a Stanford cryptography professor and the a16z crypto research team to clarify what is fact and what is speculation, and to point out the opportunities that AI may truly bring, making it a worthwhile read for anyone relying on cryptographic infrastructure.

After OpenAI's mathematical results prompted warnings from industry insiders about the potential for AI to break the cryptography we depend on, we invited a cryptographer from Stanford University and experts from a16z crypto to discuss what is fact, what is speculation, what is worth worrying about, and what does not require anxiety.

Dan Boneh, Professor at Stanford University, leads the Applied Cryptography Group and co-directs the Computer Security Laboratory; he also serves as a special research advisor to a16z crypto.

Eddy Lazzarin, General Partner at a16z crypto.

Justin Thaler, Research Partner at a16z crypto and Associate Professor of Computer Science at Georgetown University.

Liz Harkavy, Investment Partner at a16z crypto.

Sonal Chokshi, Editor-in-Chief at a16z crypto.

Additionally, here are six core conclusions:

1. AI's Mathematical Advances Have Not Touched the Core Issues of Cryptography

The recently released results showcase remarkable progress in mathematics and computer science, but do not include achievements in cryptography.

"This is a remarkable advancement in mathematics and computer science, but there is nothing here about cryptographic issues. ... So you might wonder, does this mean these models are really bad for cryptography? We don’t know," Dan Boneh, 03:00.

"We have not learned that elliptic curves are weaker than before. We have not learned that the security of any specific cryptographic assumptions is worse than it was before," Eddy Lazzarin, 15:19.

2. Even if AI Becomes Smarter, It Cannot Find Nonexistent Algorithms

A significant portion of modern cryptography is based on the assumption that certain mathematical problems do not have efficient solutions. This may also hold true for increasingly capable AI.

"We generally believe these problems do not have efficient algorithms. It’s not that we think there might be one, but humans are just not smart enough to find it. We believe it does not exist at all. If it does not exist, it does not matter how smart AI is. It cannot find that nonexistent algorithm," Justin Thaler, 16:12.

"We must assume that certain problems are hard. We cannot prove that these problems are hard because it relates to a famous unsolved problem in computer science, the P vs NP problem. In a sense, we must solve this problem first to truly argue that certain cryptographic problems are indeed very hard. ... Any problem released this week is far from solving the P vs NP problem. We still need to keep making assumptions in cryptography, right?" Dan Boneh, 06:00.

3. AI Can Compress Years of Cryptographic Review Time

Attempting to break cryptography itself is one way researchers build confidence. A design that withstands continuous, serious attacks earns trust. AI may change the speed at which this review occurs.

"In the past, when someone proposed a hypothesis and built a system based on it, we often had to wait about 10 years to deploy that system, to build confidence and give people enough time to analyze that hypothesis. ... And now, suddenly, we can greatly accelerate this process with these models. ... We can now run the model for a month, trying to break it, and if the model cannot break it, our confidence in the validity of that hypothesis will be greatly enhanced," Dan Boneh, 12:10.

4. Quantum Preparedness Provides an Early Advantage Against Certain AI Risks

While recent concerns have revolved around AI, some of these systems have already become subjects of migration work due to the threat of quantum computing. This overlap has its limitations.

"Due to concerns about quantum threats, people have already begun to view elliptic curve cryptography as something that may soon become weak. Therefore, in response to these very same concerns, we have actually engaged, prepared, and deployed many of the mitigations you need, originally aimed at another threat," Eddy Lazzarin, 20:52.

"The threat of AI is broader in some sense because it may actually examine our post-quantum systems and weaken them in some way, or even completely break them," Dan Boneh, 22:08.

5. Cryptographic Agility Allows Systems to Adapt When Weaknesses Arise

Cryptographic agility refers to the ability of systems to change their cryptographic methods when evidence or needs change. It empowers engineers to respond to unforeseen discoveries.

"The systems we deploy can quickly switch from one design to another when the design being used is proven to be insecure. Cryptographic agility is, in a sense, our friend in defending against unexpected situations," Dan Boneh, 22:47.

Dan points out that internet connections are already combining different cryptographic methods:

"They are actually using agile cryptography. They are encrypting using both elliptic curves and lattices. If you break the elliptic curve, it doesn’t matter because it is still encrypted under a lattice-based system," Dan Boneh, 38:40.

6. The Immediate Opportunity: Discovering More Flaws Before Software Release

For builders, one of the clearest opportunities is to introduce more security testing during the development process.

When discussing complex cryptographic systems, Justin points out:

"The attack surface for vulnerabilities has become very large, and yes, I am very optimistic that these AI tools that are causing panic in cryptography will also help us clear all vulnerabilities. This is a very difficult problem," Justin Thaler, 28:56.

"Once a system is deployed, it attracts a lot of attention from cryptographers, but by then, it is actually too late to attack the cryptographic system. And now, because we have control over these AI models, any startup deploying new cryptographic capabilities, or even any company deploying any software, can have these models analyze its cryptography and vulnerabilities in the overall software," Dan Boneh, 35:05.

"Vulnerabilities can be eliminated. They can be avoided by design, they can be mitigated, and the main resource we use to mitigate them, AI capabilities, is drastically decreasing in price every few months," Eddy Lazzarin, 37:10.

The quoted content has been slightly edited for clarity. Ellipses indicate omitted paragraphs.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.