Every few months, headlines flare up claiming that “AI has broken encryption.” This time, the focal point is Claude Mythos: on July 28, Anthropic announced new cryptanalytic findings discovered using their large language model. As news spread, sensationalized titles like “AI Cracks Encryption” and “The End of Cryptography” flooded social feeds. On August 1, cryptographer JP Aumasson published a sobering blog post titled LLMs won’t break symmetric crypto. Shared on the developer community Lobsters, it received 8 points and zero comments—those in the know recognized there was nothing to debate.
Figure: Original article illustration, Pieter Bruegel the Elder’s “The Fall of the Rebel Angels” (detail). Source: bfswa.blog
Let’s examine what actually took place in the research. Anthropic reported two main findings. The first was a key recovery attack on HAWK, a digital signature scheme competing in NIST’s post-quantum standardization process designed for the upcoming quantum computing era. The attack reduced HAWK’s theoretical security level from 128 bits to 108 bits. However, apart from a toy parameter set deliberately constructed for testing, the attack holds no practical utility and remains far from breaking real-world systems. The second finding targeted AES-128 under a milder scenario: it reached only up to round 7 of a full 10-round cipher. AES is the most widely deployed encryption standard globally, securing bank cards, mobile devices, and web communications. The cryptographic community was entirely unfazed—reducing rounds is akin to removing several internal locking mechanisms before attempting a pick. Most tellingly was what wasn’t found: AI discovered no attack against full-round AES. The scariest part of the headline was precisely the part that didn’t happen.
What Is Encryption Actually Protecting Against?
Encryption locks information so that it cannot be read without a key. For AES-128, the lock’s key is a 128-bit number, yielding 2^128 possible combinations—approximately 3.4×10^38. To visualize this scale: Earth contains roughly 10^19 grains of sand. If every grain of sand became another Earth, and you counted every grain of sand on all those Earths, you would barely reach this order of magnitude. By comparison, the observable universe contains around 10^80 atoms, while AES-256 (2^256), also widely used today, operates on a scale that rivals even that. From an engineering standpoint, when the number of possible keys exceeds what the universe can physically contain, “brute force” ceases to be an attack vector and becomes a purely mathematical concept.
Brute-force cracking means testing keys one by one. Even if all computers on Earth joined forces to test one trillion keys per second, testing just half the key space would take 5×10^18 years—about 400 million times the age of the universe (13.8 billion years). This number underscores a fundamental reality: the bottleneck in breaking AES-128 is time itself—time is constant, and AI cannot alter physics.
Why AI’s Intelligence Is Useless Here
The core design goal of a sound cryptographic algorithm is to make ciphertexts appear completely random—leaving no exploitable patterns or correlations with the plaintext. In cryptography, this property is known as pseudorandomness: output that looks random, yet is deterministically computed such that no statistical test can detect a flaw. No matter how powerful AI becomes, it functions by recognizing patterns. When a system is engineered specifically to eliminate patterns, even the smartest model has nowhere to begin.
Consider an analogy: dropping a tractor into quicksand and pouring concrete over it. Symmetric encryption repeatedly substitutes, shifts, and mixes data across ten rounds, making each step progressively harder to reverse. In the words of cryptographer Matthew Green, such algorithms are designed to be “messy and strong.” Messy by design, because any structure, symmetry, or regular pattern acts as a clue for attackers; strong, because they have been battered by cryptanalysts using every known technique for decades, leaving no easy vulnerabilities. As Aumasson—author of Serious Cryptography—noted in his post, algorithms like BLAKE3 are essentially long sequences of XOR, addition, and bit rotation operations. There is no shortcut or simpler mathematical description available—which is exactly what cryptographers intended.
Figure: The four steps of a single AES round: SubBytes, ShiftRows, MixColumns, and AddRoundKey. Full version repeats this for 10 rounds. Source: Wikipedia
Anthropic shares this cautious perspective. In their paper, they carefully noted that “exploring AI-assisted cryptanalysis further is interesting.” They also introduced CryptanalysisBench, a benchmark designed to evaluate LLMs on cryptographic tasks. Going after reduced-round toy versions and breaking full-fledged production algorithms are separated by many orders of magnitude.
Real Security Threats: The Inverted Priority List
First, weak passwords. Combinations like 123456, birthdays, or phone numbers require no AI; a standard dictionary attack can crack them instantly. AI’s role here is merely helping scammers craft more convincing phishing text or automate rapid password guessing—the root issue remains that the key was left hanging on the door, not a flaw in the lock.
Second, phishing. Links and messages impersonating banks, customer service, or delivery services trick users into handing over credentials voluntarily. The vast majority of compromised accounts have nothing to do with broken cryptography—passwords are stolen, guessed, or leaked. AI makes social engineering scams far more persuasive, representing a genuine threat. However, it targets human psychology; cryptography never enters the equation.
Third, website database leaks. If you reuse your banking password on a commercial website, a breach at that site allows hackers to reuse the same key everywhere. Solving this doesn’t require more complex ciphers—it calls for unique passwords per site or using a password manager.
Fourth, distant future threats: quantum computers. Quantum algorithms target older public-key systems used during connection handshakes, such as RSA, which rely on the mathematical difficulty of prime factorization. Shor’s algorithm theoretically accelerates factorization on a quantum machine. Latest estimates indicate that breaking RSA-2048 would require hundreds of thousands of high-quality physical qubits—a milestone far beyond today’s quantum hardware. Furthermore, the industry has already initiated post-quantum migrations (candidates like HAWK were created precisely for this transition). For symmetric ciphers like AES, quantum computers provide only quadratic speedup via Grover’s algorithm, reducing 128-bit key security to an effective 64 bits—which remains astronomically secure for AES-256. Engineering verdict: quantum threats evolve on a decade-long timeline, not overnight.
Figure: Famous comic by a cryptographer: seemingly complex “Tr0ub4dor&3” has only 28 bits of entropy, while a four-random-word phrase has 44 bits. Source: xkcd
Returning to where we started, Aumasson concluded his post with a counterintuitive suggestion: rather than worrying about AI breaking encryption, we should harness AI to audit newly proposed post-quantum schemes for subtle flaws. When he had an LLM review security proofs in academic papers, it actually uncovered real errors. That insight is worth contemplating: AI’s true value in cryptography lies not in brute-forcing keys by luck, but in helping human experts fix locks before they are deployed. As for the quarter-century-old lock protecting our data today, testing every key would take 400 million times the age of the universe. No matter how smart AI becomes, it cannot outrun time.
Reference Links:
- bfswa.blog: LLMs won’t break symmetric crypto
- Lobsters discussion (s/tstkqk/llms_won_t_break_symmetric_crypto)
- Wikipedia: Advanced Encryption Standard
- xkcd: Password Strength
- Ubiq Security: 128 or 256 bit Encryption: Which Should I Use?
