Mythos takes its first shot at post-quantum cryptography

Anthropic’s Claude Mythos Preview model has helped researchers discover ways to speed up attacks against two widely studied cryptographic algorithms.

One of the targets is Hawk, a candidate for post-quantum digital signature algorithms currently being evaluated by NIST, while the other improves the best previously known attack against a weakened version of the widely used Advanced Encryption Standard (AES).

Neither finding compromises production deployments nor weakens the security of real-world systems. Instead, Anthropic said, the findings improve the understanding of the security margins of modern cryptographic designs.

Security margin reduced

Hawk is among the post-quantum cryptographic (PQC) schemes under consideration by the US National Institute of Standards and Technology as it evaluates additional algorithms designed to withstand attacks from quantum computers, and like some previously evaluated submissions relies on lattice-based cryptography.

“Despite Hawk having survived two rounds of expert human review over a period of two years, Mythos was able to improve the best-known attack on it in just 60 hours of work,” Anthropic said in a blog post about its research.

Anthropic only studied the 256-bit version of Hawk, while the submission NIST is evaluating concerns the 512- and 1024-bit versions. However, said Anthropic, its findings are still relevant.

“The key sizes proposed in the HAWK submission are significantly weaker than originally suggested,” it said in its blog post, but for larger keys, Hawk “remains impractical to attack.”

On the other hand, the post said, Anthropic’s attack makes Hawk less practical to use because it effectively halves Hawk’s security level, meaning substantially larger key sizes will be required to restore its intended security. Such an increase would diminish many of the efficiency benefits that made Hawk an attractive post-quantum signature candidate, Anthropic wrote.

Anthropic’s new finding “is specific to Hawk and does not impact other NIST post-quantum signature candidates or lattice-based cryptography in general,” the company wrote.

The second attack is based on a new cryptanalytic technique, dubbed “Mobius Bridge,” which improves attacks against a weakened version of AES-128 using only seven “rounds” instead of the full-strength version’s 10. Rounds are the repeated series of mathematical transformations that AES and other encryption algorithms apply to protect data. Security researchers commonly study reduced-round variants to evaluate the security margins of block ciphers like AES.

Anthropic said the new technique improving the speed of the previous best attacks by 200-800 times previous attacks on the reduced-round construction while remaining well short of threatening the full versions of AES used in production.

No practical application

Anthropic explicitly stated that the research has no practical impact on the security of deployed AES implementations — and for good reason.

“The attack operates under a chosen plaintext threat model, which is the most common assumption used for studying ciphers like AES,” it explained in the blog post. This assumes that an attacker is able to request that the defender encrypt arbitrary inputs with a fixed, unknown key, and then gets to see the corresponding output. In this case, it assumes the attacker can request the encryption of 2^105 (about 4 billion billion billion) chosen plaintexts. “This attack is therefore completely impractical but quantifies the attack cost against AES under these assumptions,” it said.

Claude Mythos Preview discovered the attack almost entirely autonomously, Anthropic said, adding, “A researcher at Anthropic built a scaffold that enabled Claude to pose hypotheses, run experiments to experimentally validate or refute these hypotheses, and then asked Claude to design an attack that improves on the best cryptanalysis of AES.”

Even with AI accelerating some parts of the research, more time is spent verifying the correctness of results. The improved attack on AES was discovered in about a week, but took two researchers nearly a month to validate, Anthropic said.