[TLS] Re: [Ssh] A new AI-discovered attack on 7-round AE S (commentaries by Orr Dunkelman and D. J. Bernstein)
Soatok Dreamseeker <[email protected]> Wed, 29 Jul 2026 19:10:48 -0400
| Newsgroups | gmane.ietf.tls |
|---|---|
| Message-ID | <CAOvwWh0E-YR0AKBP9bp8nVkU948HGJTMmLexkSGjqu4m434RFA@mail.gmail.com> |
--===============9180979265837392236== Content-Type: multipart/alternative; boundary="000000000000a0f9790657c8118e" --000000000000a0f9790657c8118e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable > > With Grover's algorithm in quantum computing that in the future might > halve the effective security, theoretically symmetric key lengths of 512 > bits could be necessary. I do not think Grover's is a meaningful risk to any system in the foreseeable future. See https://words.filippo.io/128-bits/ for a longer treatment on the topic. On Wed, Jul 29, 2026 at 2:10=E2=80=AFPM Ken Kubota <[email protected]> wrot= e: > The catastrophic failure of NIST PQC finalists is not a new phenomenon. > The situation is basically a mess. > Consequently, hybrid solutions remain the only viable option, while any > non-hybrid (or "solo") approach represents a significant security risk. > > What is new here is the emergence of a paradigm in which numerous new > cryptographic researchers appear via AI models that also generate novel > attacks, as evidenced in first-rate research papers. > > Perhaps the accelerated pace of cryptographic research enabled by AI > (e.g., where the scientific progress of next year might correspond to a > decade's worth of past advancements) will mitigate the quantum threat, > either by having AI identify weak PQC algorithms or by creating new, > stronger ones. > > Kind regards, > > Ken Kubota > > ____________________________________________________ > > Ken Kubota > https://doi.org/10.4444/100 > > > > > Am 29.07.2026 um 15:08 schrieb Jan Schermer <[email protected]>: > > > > Isn't this a red herring? You completely missed the part where they > attacked HAWK (PQC finalist), _THAT_ is what illustrates the point. Nobod= y > cares about 7-round AES. > > > > Jan > > > > > >> On 29. 7. 2026, at 14:58, Ken Kubota <[email protected]> wrote: > >> > >> On both Orr Dunkelman's [1] (TLS list) and D. J. Bernstein's commentar= y > [2] (SSH list) regarding the new AI-generated attack on 7-round AES [3, 4= , > 5]: > >> > >> > >> "While this is the first improvement in attacking 7-round AES in the > last > >> decade, if you were not worried by the series of papers that reduced t= he > >> security of 5-round AES from 2^32 to 2^16, or the somewhat improved > attacks > >> on 6-round AES, then you should not really worry now [t]o start a > procedure > >> for changing 10-round AES (for 128-bit key) for something else, when > there > >> are no attacks on 8-round AES-128." [1] > >> > >> This overlooks the very point that Anthropic researchers emphasize > themselves: > >> > >> "And in the case of AES, our attack extends a long line of work that > had previously succeeded at attacking reduced-round variants. But we shou= ld > not assume that language model capabilities will plateau at this level. I= n > just one year, language models have gone from being unable to perform > cryptanalysis of even the most basic ciphers to being capable of finding > flaws in cryptographic designs that have escaped discovery despite years = of > human expert review." [3] > >> "But as we develop increasingly powerful cryptanalytic results, it > would be prudent to consider how researchers should react if a language > model were to discover vulnerabilities in cryptosystems where attacks do > have an immediate real-world impact." [3] > >> > >> The point is not the new attack on 7-round AES, but the very fact that > the new attack was AI-generated, and the speed of such developments might > increase. > >> While this is probably the first such groundbreaking research result > created by AI, in half a year there might be 10 such papers, and in anoth= er > half a year 100 papers, etc., in other words, a qualitatively _new > paradigm_ of scientific progress, which is not addressed by focusing on t= he > number of rounds. > >> > >> Brian Berletic predicted AI development with _exponentially_ growing > speed already about half a year ago: > >> > >> "There are people that don't even want to acknowledge that AI is a rea= l > thing that exists and is speeding forward. And it's not just speeding > forward in a linear way. It is exponentially increasing. You can see it. > Before it was leaps and bounds year to year. Now it is leaps and bounds > month to month even sometimes week to week." [6] > >> > >> > >> "Given this risk, it's particularly dangerous if we allow the pursuit = of > >> every last bit of performance to strip cryptography down to the bare > >> minimum that resists attack demos. It's much safer to include defense = in > >> depth: for example, 256-bit cipher keys, many more cipher rounds than = we > >> know how to break (the classic recommendation from Anderson, Biham, an= d > >> Knudsen is twice as many rounds), and continuing to sign with ECC when > >> we add PQ signatures." [2] > >> > >> While > >> - twice as many rounds > >> - hybrid approach (e.g., double encryption) > >> are obvious conclusions, > >> "256-bit cipher keys" should be replaced by "256 bits of security" for > long-term security. > >> > >> With Grover's algorithm in quantum computing that in the future might > halve the effective security, theoretically symmetric key lengths of 512 > bits could be necessary. > >> > >> For long-term security, a security margin should be added that takes > into account scientific progress (e.g., new attacks), technological > progress (e.g., quantum computing, artificial intelligence), the > interaction between both (possibly exponentially increasing scientific > progress due to AI) as well as potential weaknesses in the original > algorithm. > >> > >> Considering that secret (nation-state) quantum attacks may already > happen in 2029 [7, 8], for a pragmatic ad-hoc hybrid solution focusing on > asymmetric methods might be sufficient (German BSI: "it is advisable to u= se > a key length of 256 bits for the symmetric encryption methods" [9]). > >> > >> For developing new algorithms, however, 512-bit keys should be > envisioned for the symmetric encryption methods. > >> > >> The historical analogy lies in the NSA and Curve 25519. > >> The NSA in 2005 decided to internally use 256 bits of security for > long-term security [10] (e.g., Curve P-521 [11]). > >> In my opinion, this was the correct decision, and a wise decision. > >> > >> While Curve 25519 has done a good job, I always regretted it only > offered 128 bits of security. > >> This level of 128 bits of security was deprecated by the NSA more than > a decade ago [12]. > >> > >> One should keep in mind that long-term security means more than holdin= g > a few decades. > >> The pediatric records of a seven-year-old child shouldn't be available > on the internet if the person is 37, 47, or 57 years old, with full name, > birthday, maybe even place of birth (which would allow identity theft), b= ut > also diagnoses that may still be relevant then. > >> > >> > >> Kind regards, > >> > >> Ken Kubota > >> > >> ____________________________________________________ > >> > >> Ken Kubota > >> https://doi.org/10.4444/100 > >> > >> > >> > >> [1] > https://mailarchive.ietf.org/arch/msg/tls/QusthRp6zRAxCvImiLLQ0SQLtME/ > >> > >> [2] > https://mailarchive.ietf.org/arch/msg/ssh/HGT2mTKC7vi9lHPdpBtQEwt57SQ/ > >> > >> [3] > https://www.anthropic.com/research/discovering-cryptographic-weaknesses > >> > >> [4] https://anthropic.com/document/aes_mobius_bridge.pdf > >> > >> [5] https://anthropic.com/document/aes_mobius_bridge_cot.pdf > >> > >> [6] https://youtu.be/tbjsagsiWls?t=3D2582 > >> > >> [7] > https://cr.yp.to/talks/2023.06.15/slides-djb-20230615-pqrisk-4x3.pdf, p. = 6 > >> > >> [8] https://youtu.be/qPhoJQtvgUo?t=3D740 > >> > >> [9] > https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuid= elines/TG02102/BSI-TR-02102-1.pdf?__blob=3DpublicationFile&v=3D14, > p. 40 > >> "The development of fault-tolerant quantum computers has a much less > severe impact on the > >> security of symmetric mechanisms than on the security of asymmetric > mechanisms. The use of > >> Grover=E2=80=99s algorithm [61] could theoretically accelerate the sea= rch of > the key space of symmetric > >> mechanisms quadratically. Whether an acceleration compared to a classi= c > exhaustive search of the > >> key space can also be achieved in practice is the subject of current > research, see e.g. [76]. Never- > >> theless, especially for applications with high or long-term protection > requirements or long-living > >> systems it is advisable to use a key length of 256 bits for the > symmetric encryption methods > >> recommended below." > >> > >> [10] > https://mailarchive.ietf.org/arch/msg/tls/lnSPh3Wr6vgdjivHGj1mxCun3Rs/ > >> > >> [11] > https://mailarchive.ietf.org/arch/msg/ssh/ONXLAO9CR9w6tUhwE3ag9CB14tE/ > >> > >> [12] > https://mailarchive.ietf.org/arch/msg/ssh/47mIx2MIjUYpn45EBysgmCHy5_4/ > >> > >> _______________________________________________ > >> Ssh mailing list -- [email protected] > >> To unsubscribe send an email to [email protected] > > > > _______________________________________________ > > Ssh mailing list -- [email protected] > > To unsubscribe send an email to [email protected] > > _______________________________________________ > TLS mailing list -- [email protected] > To unsubscribe send an email to [email protected] > --000000000000a0f9790657c8118e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px = 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">With Gro= ver's algorithm in quantum computing that in the future might halve the= effective security, theoretically symmetric key lengths of 512 bits could = be necessary.</blockquote><div><br></div>I do not think Grover's is a m= eaningful risk to any system in the foreseeable future. See=C2=A0<a href=3D= "https://words.filippo.io/128-bits/">https://words.filippo.io/128-bits/</a>= for a longer treatment on the topic.<div><br></div></div><br><div class=3D= "gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">O= n Wed, Jul 29, 2026 at 2:10=E2=80=AFPM Ken Kubota <<a href=3D"mailto:iet= [email protected]">[email protected]</a>> wrote:<br></div><blockquote class= =3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg= b(204,204,204);padding-left:1ex">The catastrophic failure of NIST PQC final= ists is not a new phenomenon. <br> The situation is basically a mess.<br> Consequently, hybrid solutions remain the only viable option, while any non= -hybrid (or "solo") approach represents a significant security ri= sk.<br> <br> What is new here is the emergence of a paradigm in which numerous new crypt= ographic researchers appear via AI models that also generate novel attacks,= as evidenced in first-rate research papers.<br> <br> Perhaps the accelerated pace of cryptographic research enabled by AI (e.g.,= where the scientific progress of next year might correspond to a decade= 9;s worth of past advancements) will mitigate the quantum threat, either by= having AI identify weak PQC algorithms or by creating new, stronger ones.<= br> <br> Kind regards,<br> <br> Ken Kubota<br> <br> ____________________________________________________<br> <br> Ken Kubota<br> <a href=3D"https://doi.org/10.4444/100" rel=3D"noreferrer" target=3D"_blank= ">https://doi.org/10.4444/100</a><br> <br> <br> <br> > Am 29.07.2026 um 15:08 schrieb Jan Schermer <<a href=3D"mailto:jan@= schermer.cz" target=3D"_blank">[email protected]</a>>:<br> > <br> > Isn't this a red herring? You completely missed the part where the= y attacked HAWK (PQC finalist), _THAT_ is what illustrates the point. Nobod= y cares about 7-round AES.<br> > <br> > Jan<br> > <br> > <br> >> On 29. 7. 2026, at 14:58, Ken Kubota <<a href=3D"mailto:ietf@ke= nkubota.de" target=3D"_blank">[email protected]</a>> wrote:<br> >> <br> >> On both Orr Dunkelman's [1] (TLS list) and D. J. Bernstein'= ;s commentary [2] (SSH list) regarding the new AI-generated attack on 7-rou= nd AES [3, 4, 5]:<br> >> <br> >> <br> >> "While this is the first improvement in attacking 7-round AES= in the last<br> >> decade, if you were not worried by the series of papers that reduc= ed the<br> >> security of 5-round AES from 2^32 to 2^16, or the somewhat improve= d attacks<br> >> on 6-round AES, then you should not really worry now [t]o start a = procedure<br> >> for changing 10-round AES (for 128-bit key) for something else, wh= en there<br> >> are no attacks on 8-round AES-128." [1]<br> >> <br> >> This overlooks the very point that Anthropic researchers emphasize= themselves:<br> >> <br> >> "And in the case of AES, our attack extends a long line of wo= rk that had previously succeeded at attacking reduced-round variants. But w= e should not assume that language model capabilities will plateau at this l= evel. In just one year, language models have gone from being unable to perf= orm cryptanalysis of even the most basic ciphers to being capable of findin= g flaws in cryptographic designs that have escaped discovery despite years = of human expert review." [3]<br> >> "But as we develop increasingly powerful cryptanalytic result= s, it would be prudent to consider how researchers should react if a langua= ge model were to discover vulnerabilities in cryptosystems where attacks do= have an immediate real-world impact." [3]<br> >> <br> >> The point is not the new attack on 7-round AES, but the very fact = that the new attack was AI-generated, and the speed of such developments mi= ght increase.<br> >> While this is probably the first such groundbreaking research resu= lt created by AI, in half a year there might be 10 such papers, and in anot= her half a year 100 papers, etc., in other words, a qualitatively _new para= digm_ of scientific progress, which is not addressed by focusing on the num= ber of rounds.<br> >> <br> >> Brian Berletic predicted AI development with _exponentially_ growi= ng speed already about half a year ago:<br> >> <br> >> "There are people that don't even want to acknowledge tha= t AI is a real thing that exists and is speeding forward. And it's not = just speeding forward in a linear way. It is exponentially increasing. You = can see it. Before it was leaps and bounds year to year. Now it is leaps an= d bounds month to month even sometimes week to week." [6]<br> >> <br> >> <br> >> "Given this risk, it's particularly dangerous if we allow= the pursuit of<br> >> every last bit of performance to strip cryptography down to the ba= re<br> >> minimum that resists attack demos. It's much safer to include = defense in<br> >> depth: for example, 256-bit cipher keys, many more cipher rounds t= han we<br> >> know how to break (the classic recommendation from Anderson, Biham= , and<br> >> Knudsen is twice as many rounds), and continuing to sign with ECC = when<br> >> we add PQ signatures." [2]<br> >> <br> >> While<br> >> - twice as many rounds<br> >> - hybrid approach (e.g., double encryption)<br> >> are obvious conclusions,<br> >> "256-bit cipher keys" should be replaced by "256 bi= ts of security" for long-term security.<br> >> <br> >> With Grover's algorithm in quantum computing that in the futur= e might halve the effective security, theoretically symmetric key lengths o= f 512 bits could be necessary.<br> >> <br> >> For long-term security, a security margin should be added that tak= es into account scientific progress (e.g., new attacks), technological prog= ress (e.g., quantum computing, artificial intelligence), the interaction be= tween both (possibly exponentially increasing scientific progress due to AI= ) as well as potential weaknesses in the original algorithm.<br> >> <br> >> Considering that secret (nation-state) quantum attacks may already= happen in 2029 [7, 8], for a pragmatic ad-hoc hybrid solution focusing on = asymmetric methods might be sufficient (German BSI: "it is advisable t= o use a key length of 256 bits for the symmetric encryption methods" [= 9]).<br> >> <br> >> For developing new algorithms, however, 512-bit keys should be env= isioned for the symmetric encryption methods.<br> >> <br> >> The historical analogy lies in the NSA and Curve 25519.<br> >> The NSA in 2005 decided to internally use 256 bits of security for= long-term security [10] (e.g., Curve P-521 [11]).<br> >> In my opinion, this was the correct decision, and a wise decision.= <br> >> <br> >> While Curve 25519 has done a good job, I always regretted it only = offered 128 bits of security.<br> >> This level of 128 bits of security was deprecated by the NSA more = than a decade ago [12].<br> >> <br> >> One should keep in mind that long-term security means more than ho= lding a few decades.<br> >> The pediatric records of a seven-year-old child shouldn't be a= vailable on the internet if the person is 37, 47, or 57 years old, with ful= l name, birthday, maybe even place of birth (which would allow identity the= ft), but also diagnoses that may still be relevant then.<br> >> <br> >> <br> >> Kind regards,<br> >> <br> >> Ken Kubota<br> >> <br> >> ____________________________________________________<br> >> <br> >> Ken Kubota<br> >> <a href=3D"https://doi.org/10.4444/100" rel=3D"noreferrer" target= =3D"_blank">https://doi.org/10.4444/100</a><br> >> <br> >> <br> >> <br> >> [1] <a href=3D"https://mailarchive.ietf.org/arch/msg/tls/QusthRp6z= RAxCvImiLLQ0SQLtME/" rel=3D"noreferrer" target=3D"_blank">https://mailarchi= ve.ietf.org/arch/msg/tls/QusthRp6zRAxCvImiLLQ0SQLtME/</a><br> >> <br> >> [2] <a href=3D"https://mailarchive.ietf.org/arch/msg/ssh/HGT2mTKC7= vi9lHPdpBtQEwt57SQ/" rel=3D"noreferrer" target=3D"_blank">https://mailarchi= ve.ietf.org/arch/msg/ssh/HGT2mTKC7vi9lHPdpBtQEwt57SQ/</a><br> >> <br> >> [3] <a href=3D"https://www.anthropic.com/research/discovering-cryp= tographic-weaknesses" rel=3D"noreferrer" target=3D"_blank">https://www.anth= ropic.com/research/discovering-cryptographic-weaknesses</a><br> >> <br> >> [4] <a href=3D"https://anthropic.com/document/aes_mobius_bridge.pd= f" rel=3D"noreferrer" target=3D"_blank">https://anthropic.com/document/aes_= mobius_bridge.pdf</a><br> >> <br> >> [5] <a href=3D"https://anthropic.com/document/aes_mobius_bridge_co= t.pdf" rel=3D"noreferrer" target=3D"_blank">https://anthropic.com/document/= aes_mobius_bridge_cot.pdf</a><br> >> <br> >> [6] <a href=3D"https://youtu.be/tbjsagsiWls?t=3D2582" rel=3D"noref= errer" target=3D"_blank">https://youtu.be/tbjsagsiWls?t=3D2582</a><br> >> <br> >> [7] <a href=3D"https://cr.yp.to/talks/2023.06.15/slides-djb-202306= 15-pqrisk-4x3.pdf" rel=3D"noreferrer" target=3D"_blank">https://cr.yp.to/ta= lks/2023.06.15/slides-djb-20230615-pqrisk-4x3.pdf</a>, p. 6<br> >> <br> >> [8] <a href=3D"https://youtu.be/qPhoJQtvgUo?t=3D740" rel=3D"norefe= rrer" target=3D"_blank">https://youtu.be/qPhoJQtvgUo?t=3D740</a><br> >> <br> >> [9] <a href=3D"https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI= /Publications/TechGuidelines/TG02102/BSI-TR-02102-1.pdf?__blob=3Dpublicatio= nFile&v=3D14" rel=3D"noreferrer" target=3D"_blank">https://www.bsi.bund= .de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TG02102/BSI-TR-= 02102-1.pdf?__blob=3DpublicationFile&v=3D14</a>, p. 40<br> >> "The development of fault-tolerant quantum computers has a mu= ch less severe impact on the<br> >> security of symmetric mechanisms than on the security of asymmetri= c mechanisms. The use of<br> >> Grover=E2=80=99s algorithm [61] could theoretically accelerate the= search of the key space of symmetric<br> >> mechanisms quadratically. Whether an acceleration compared to a cl= assic exhaustive search of the<br> >> key space can also be achieved in practice is the subject of curre= nt research, see e.g. [76]. Never-<br> >> theless, especially for applications with high or long-term protec= tion requirements or long-living<br> >> systems it is advisable to use a key length of 256 bits for the sy= mmetric encryption methods<br> >> recommended below."<br> >> <br> >> [10] <a href=3D"https://mailarchive.ietf.org/arch/msg/tls/lnSPh3Wr= 6vgdjivHGj1mxCun3Rs/" rel=3D"noreferrer" target=3D"_blank">https://mailarch= ive.ietf.org/arch/msg/tls/lnSPh3Wr6vgdjivHGj1mxCun3Rs/</a><br> >> <br> >> [11] <a href=3D"https://mailarchive.ietf.org/arch/msg/ssh/ONXLAO9C= R9w6tUhwE3ag9CB14tE/" rel=3D"noreferrer" target=3D"_blank">https://mailarch= ive.ietf.org/arch/msg/ssh/ONXLAO9CR9w6tUhwE3ag9CB14tE/</a><br> >> <br> >> [12] <a href=3D"https://mailarchive.ietf.org/arch/msg/ssh/47mIx2MI= jUYpn45EBysgmCHy5_4/" rel=3D"noreferrer" target=3D"_blank">https://mailarch= ive.ietf.org/arch/msg/ssh/47mIx2MIjUYpn45EBysgmCHy5_4/</a><br> >> <br> >> _______________________________________________<br> >> Ssh mailing list -- <a href=3D"mailto:[email protected]" target=3D"_bla= nk">[email protected]</a><br> >> To unsubscribe send an email to <a href=3D"mailto:[email protected]= rg" target=3D"_blank">[email protected]</a><br> > <br> > _______________________________________________<br> > Ssh mailing list -- <a href=3D"mailto:[email protected]" target=3D"_blank">= [email protected]</a><br> > To unsubscribe send an email to <a href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a><br> <br> _______________________________________________<br> TLS mailing list -- <a href=3D"mailto:[email protected]" target=3D"_blank">tls@i= etf.org</a><br> To unsubscribe send an email to <a href=3D"mailto:[email protected]" targe= t=3D"_blank">[email protected]</a><br> </blockquote></div> --000000000000a0f9790657c8118e-- --===============9180979265837392236== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KVExTIG1haWxp bmcgbGlzdCAtLSB0bHNAaWV0Zi5vcmcKVG8gdW5zdWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byB0 bHMtbGVhdmVAaWV0Zi5vcmcK --===============9180979265837392236==--