Can AI Break Cryptography? What the Experts Actually Think

Could AI break the cryptography protecting everything from crypto wallets and banking to private messages? Recent advances in AI-driven mathematical research have sparked new warnings about the security of today's encryption systems, but how much of the concern is supported by evidence? a16z crypto's Liz Harkavy is joined by Stanford cryptographer Dan Boneh, a16z crypto General Partner Eddy Lazzarin, and Research Partner Justin Thaler to separate what we know from what remains speculation. They explain why modern cryptography relies on mathematical assumptions, what OpenAI's recent results do and don't demonstrate, and how the potential threat from AI differs from quantum computing. They also discuss why existing security practices and cryptographic alternatives offer reasons for confidence, the importance of building systems that can adapt if an assumption fails, and how AI could ultimately help researchers and developers make software more secure.

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Dan Boneh?

  All of a sudden, a new threat emerged in the world of cryptography, which is whether our AI friends can actually attack crypto systems that we thought were secure.

• 0:10Speaker 01

  The fear here is that the AI labs could break them if they are breakable.

• 0:16Dan Boneh?

  The fact that people try to break them and fail gives us more confidence. NIST is already standardizing many other types of public key systems that we can switch to. So if it turns out one of our assumptions is broken, we have backups. We just need to know.

• 0:30Speaker 01

  Are there startup opportunities here and where a new company might be able to come in and help?

• 0:35Erik Torenberg?

  AI is getting better at solving difficult math problems. Could it eventually break the cryptography, protecting our banking systems, private messages, and crypto wallets? Recent results from OpenAI have sparked new concerns about the security of modern cryptography. In this episode, A16Z Crypto's Liz Harkavy is joined by Stanford professor Dan Boneh, general partner Eddie Lazarin, and research partner Justin Thaler to separate fact from speculation. They discuss what the recent breakthroughs actually tell us, how AI threats differ from quantum computing, and why there's no reason to panic today. They also explained how AI could ultimately help make cryptography and software more secure.

• 1:17Speaker 01

  Hey, welcome to our show today. I'm Liz. I'm joined here with Dan Boneh, a professor at Stanford, and Eddie Lazarin and Justin Thaler, two members of our team here at A16Z. We're here to talk about a pretty big discussion that's going on right now that's been kicked off yesterday by a tweet that a security researcher, Justin Drake, put out, warning the crypto industry to start preparing for what he's calling bunker mode, specifically around this worry that the advances in AI are going to cause a breakthrough or breaking of cryptography faster even than of a quantum computer might, which is normally the basis of the discussion that we have when we think about modern day cryptography and what the state of the art looks like. And so he called on, you know, big institutions to start thinking about moving funds and start thinking about this.

• 2:02Speaker 01

  And a lot of that has been kicked off by some papers that OpenAI put out and different kind of breakthroughs they had in mathematical problems that were previously unsolved and how that relates back to cryptography. And so, Dan, I don't know if you want to kind of summarize what those breakthroughs were or what those papers put out and how that kind of kicked this off.

• 2:21Dan Boneh?

  So let's see, I guess the first thing I should say is, you know, everybody calm down. Don't panic. Calm down. The world today is the same as it was a year, a year ago, two years ago. That's the first message. Now, I guess before we get started, I just want to make sure people are on the same page in that there are kind of two stories that are getting entangled. And I think we should first disentangle them. There is this long-going conversation on the threat of quantum computing to cryptography. This is not what this is about. Here, there's all of a sudden a new threat that's kind of emerged in the world of cryptography, which is whether our, you know, AI friends can actually attack crypto systems

• 3:02Dan Boneh?

  that we thought were secure using, you know, their superintelligence and so on. So I guess the backdrop to all of this is that 700, around 700 papers were put up online, presenting enormous progress in mathematics and computer science. I can't say enough about how impressed I am with the results that have been put on online. It's really quite remarkable to see all the progress. I remember my kind of inbox blew up when this came online. Everybody was asking for opinions and so on. So I started going through the list of problems that progress was made on. And as I finished the list, the thing that kind of stuck in my mind is that, wow, this is incredible progress in mathematics, in computer science,

• 3:46Dan Boneh?

  but there are no questions here on cryptography. Yeah, not even on theoretical cryptography, right? I mean, in principle, you could, there are lots of really interesting open problems in constructing, you know, positive development in cryptography, constructing new crypto systems, maybe even in a theory, things that wouldn't directly be relevant to the real world. None of those questions were in the list of 700 problems that were posted. So you might wonder, well, does that mean the models are really bad at cryptography? We don't know. And so I think one of the things that I would maybe like to start with is a call to the Frontier Labs to please tell us, what have you done with trying to use these models to answer basic questions in cryptography?

• 4:30Dan Boneh?

  I guess the real question is, what is the status, for example, on actually attacking standardized and deployed crypto? Have the Frontier Labs tried any of their models?

• 4:40Speaker 01

  Sorry, so just to clarify what you're saying, this tweet was not kicked off because there was something in the paper specific to cryptography, but rather that just the fact that they had massive breakthroughs in any sort of mathematics means there is likely a breakthrough in cryptography?

• 4:54Speaker 03

  It was, the OpenAI drop had a variety of papers across hundreds of different topics, hundreds of different topics. And many of those topics, although weren't specifically about cryptography, were adjacent to cryptography. I'd say in the loose sense that they involve progress using similar techniques and mathematical reasoning that one would use to make progress in cryptography. So their absence is a little bit conspicuous, right, is what Dan is saying. And it's something that, you know, you have to consider the explanations for. On the one hand, if the reason for the omission is that AI models are notably bad

• 5:34Speaker 03

  and couldn't find anything and that cryptography is particularly robust for some reason, that in itself would be very interesting, right? If, in other words, if the labs attempted to make progress in theoretical or applied cryptography and didn't really find anything worth discovering, that would be in itself very interesting. If, on the other hand, they did make progress and there could have been a lot to share, but there are reasons that what they wanted, what they could have shared would be concerning, then that would be very interesting to know as well.

• 6:09Speaker 01

  And so I just, I want to go back to what you kind of kicked off with here, which is, we kind of breezed over this, is we are not, it is not a given that the current kind of like cryptographic standards we use are human breakable. We just don't know if they are or not today. And so the fear here is that the AI labs could break them if they are breakable.

• 6:33Dan Boneh?

  Yeah, I think this is actually a really important point in that all of cryptography is based on complexity assumptions. Yeah, it's based on assumptions. We have to assume that certain problems are hard. The reason we can't prove that those problems are hard is because that's related to a famous open problem in computer science called the P versus NP problem. In some sense, we first have to resolve that problem before we can actually argue that cryptography, the certain cryptographic problems really, really are hard. And so since that, we're very far away from that. None of the problems that were posted this week come even close to resolving the P versus NP problem. We still have to keep making assumptions in cryptography, right? So the assumptions are that certain problems are hard. Let's say elliptic curve discrete log.

• 7:18Dan Boneh?

  Let's say short of vector and lattices. You know, we have a whole list of problems that we know and love and we build crypto systems from. A lot of people have worked over the years and trying to break those assumptions. And in fact, there's a huge body of literature on failed attempts, on partial attempts, partially successful attempts. So this is a very active area. And so far, all these problems remain secure and our crypto systems are based on those, on those problems. But now there's a new player in town, right? Somebody else could try to come up with other ways to solve these problems. And maybe they'll see something that us humans have not seen. That's certainly a possibility. But again, I need to stress, this is not a new possibility.

• 8:03Dan Boneh?

  Two years ago, five years ago, 10 years ago, you know, a clever human could have come up with a new attack that nobody has seen before and break some cryptographic assumptions. Cryptography is sort of built on assumptions. We realize things are built on assumptions that could end up not being as strong as we expect. And so it's wonderful that people try. This is actually how we gain confidence in our assumptions. The fact that people try to break them and fail gives us more confidence. So in fact, I would say this would be an extremely positive development if the labs tried their best models at some of our basic cryptographic assumptions. The models failed to break them. The labs say that they failed to break them. That will give us tremendous confidence that our assumptions are valid.

• 8:46Dan Boneh?

  And even if they shave off a little bit of security, let's say they shave off 10 bits of security from one of the problems that we use in practice, that's great. That's wonderful for us to know. The fact that all they could do is shave off 10 bits of security is actually already very strong evidence that the assumptions are actually worthwhile using.

• 9:04Speaker 04

  Another thing that would be nice for the labs to try is I think we can hope to use these models to give much stronger evidence than we currently have that these problems are hard. By which I mean, for a lot of these problems, our evidence right now, well, we have things like, you know, we know they're just as hard in the worst case as the average case, which, you know, for some of them, these lattice problems, which is helpful. But there are complexity theoretic results you could hope to show that would give more evidence, more confidence in the intractability of these problems that they have no efficient algorithms. I'd say that, you know, Dan is totally right. Like, most of the reason for, you know, today's cryptography,

• 9:47Speaker 04

  that we have confidence, you know, these problems actually are intractable is, you know, people have just tried for decades and decades and haven't come up with any good algorithms. But we can hope for other kinds of evidence. And those are like pure math questions that these Frontier Labs could be turning their models on.

• 10:04Speaker 01

  The specific tweet that we're referencing was about crypto wallets and how the impact of this on crypto. But there is a much broader implication of breaking like ECDSA. And so I don't know if maybe one of you is willing to kind of elaborate a little bit more on the larger implications of what that would look like and why it exists outside of that bubble.

• 10:21Dan Boneh?

  Oh yeah, of course. So the implication of, uh, let's just pick on one of the, one of the assumptions that are being used in the real world. Let's say what's called elliptic curve discrete log. If it turns out this assumption is not as strong as we thought, and there's actually a realistic attack on it, that would not be good. Yeah. So not only for the blockchain space, this would affect the entire internet. It affects the, actually, to be honest, it affects the entire digital world. So home banking, healthcare, government communications, everything is impacted by such a break. I should say that we already, NIST is already standardizing many other types of public key systems that we can switch to. So if it turns out one of our assumptions is broken, we have backups that we can move to. In fact, we have several

• 11:06Dan Boneh?

  backups that we, that we can move to. And so we just need to know, is this like a high priority? Is this something that we don't need to do right away? And so the lack of knowledge right now is creating a vacuum, I think, in the, you know, tweetosphere. And that vacuum really needs to be filled.

• 11:23Speaker 03

  So maybe, maybe to, to simplify just a little bit, it's that the process, in the absence of the ability to prove that these problems are hard, the problems on which cryptography is built, in the absence of that ability, we specifically rely in some sense on time. Right? That is, that's kind of what we are doing. I know I'm oversimplifying a little bit, but we put these schemes out and we wait. And we wait because what we believe is happening is that experts like cryptographers and mathematicians are testing and trying to break these things. And if they're around for long enough and many enough people have talked about them and tested and talked with each other about they're trying to break

• 12:08Speaker 03

  these schemes and they don't, we emerge with confidence that they're hard to break. And because of the pace of progress on AI's mathematical abilities, there is a conspicuous absence of time. Right? There is kind of a gap between the rate of progress and the information we're getting from the people who seem to have most of the effort, most of the cognitive ability to even scrutinize these things. A whole new well of cognitive ability to scrutinize has appeared. And we're not hearing from them about what they're discovering through their work in the normal way that we would from the academic and, you know, computer science and cryptography research mechanism.

• 12:51Dan Boneh?

  You're totally right. In the past, when one, someone would make an assumption and build a system based on it, we'd have to wait like 10 years before that system could be deployed.

• 13:00Speaker 03

  Yeah.

• 13:00Dan Boneh?

  To gain confidence, to give people enough time to analyze.

• 13:03Speaker 03

  I couldn't agree more.

• 13:04Dan Boneh?

  And now, all of a sudden, we can accelerate this process tremendously using these models. This is a remarkable tool.

• 13:10Speaker 03

  Yeah.

• 13:10Dan Boneh?

  Somebody makes, let's say I'm making a new assumption and build an amazing crypto system based on it. Now we can just let a model run for, for a month, try to break it. And if the model can't break it, boy, do we have, we have a lot of confidence that the assumption is valid.

• 13:23Speaker 03

  Yeah. Yeah. It's, it's funny because it's a change in how we normally do it, right? Normally we have this, to the public, or to an informed person in the public, we have a background rate of attention that is paid by our cryptographers to these systems. And we just sort of sit back and we wait long enough that we assume, and we assume, make some assumptions about their prioritization, that they're paying attention to the important things. And then after long enough, we say, this has got to be good. This is probably good. But now we have a completely new thing where the labs can say, we took our tip top, totally unrestricted, most cyber capable model, and we told it to go absolutely insane.

• 14:05Speaker 03

  And we spent $20 million, $50 million trying to break this scheme. And at the other end, we have more conviction about its confidence than you could probably get from the conventional process in a decade. So we actually have the prospect to have more confidence in our security than ever before. It's just, there's a little bit of a gap in how that information is being created and shared.

• 14:31Dan Boneh?

  And we can accelerate the deployment of better cryptography. And the gap, I have to say, is also the fact that, um, obviously some of the models are accessible to the labs, but not to the rest of the public.

• 14:44Speaker 01

  In the, the absence of that information, um, what would you recommend or how do you kind of think about this as just like an everyday user of technology? Like, is this, how does this impact how you interact with technology, if at all?

• 14:58Dan Boneh?

  So nothing has changed. The world today is the same as the world a week ago, the world a year ago. Nothing has changed. Until we learn something new about our standard cryptographic systems, nothing has changed. Keep using the systems as they are. When we learn something new, either we'll have more confidence or we'll have to react. But until we have more information, nothing has changed. So please, don't panic. You know, keep calm.

• 15:25Speaker 03

  Yeah. To put it another way, you know, the, the, the reaction yesterday and continuing today is not a reaction to new information. What the reaction is maybe an indirect reaction to the dump of mathematical results from OpenAI, a very indirect kind of information about AI's progress, which I, again, is, was amazing, but I don't think is a surprise. It's like all Silicon Valley's been talking about for years now. Uh, but, but it's, but it's not a specific reaction to a specific piece of information about cryptography. We didn't learn that elliptic curves are vulnerable in a way that they weren't before. We didn't learn that any specific cryptographic assumptions had, have less security than they did before.

• 16:09Dan Boneh?

  Maybe to give people a little bit more confidence also, we have a lot of different types of assumptions that we use to build public key cryptography. It's not just elliptic curves or lattices. We have hysogenies and code based systems and, and multivariate polynomial based systems. There are many, the hash based signatures. There are many other types of assumptions that we can build public key cryptography from. So if we need to react, we can react. Of course, everything takes time, but we sort of know where to go. And, and so, um, uh, even if the worst of the worst happens, there are still plenty of ways for us to recover.

• 16:47Speaker 04

  So one thing, um, I guess worth mentioning is like, we, we generally believe there is no efficient algorithm for these problems. Um, and if, you know, it's not that we think there might be and humans just aren't smart enough to find it. We think there is not one. And so if there is not one, it doesn't matter how smart the AI is, it cannot find a non-existent algorithm, right? And so, you know, the worry is, you know, we're, that just our, our, our belief is totally wrong. But to be clear what the belief is, right? It's not the algorithm's there and we're, we're too dumb to find it. Uh, it's that it's just not there at all. Right? So, uh, that's, that's one thing to clarify. Um, the,

• 17:28Speaker 04

  the first tweet was one by, by Justin Drake of the Ethereum Foundation, um, warning of a possible complete break of elliptic curve cryptography in the coming months, um, and suggesting that, um, at least like, uh, large cold wallets on, uh, the Ethereum blockchain enter, what do you call it, bunker mode, or at least not have exposed public keys on chain. Um, and then Vitalik Buterin followed up with, um, a slightly more toned down tweet, but still speculating about, um, you know, better attacks that AI might find on, on, on crypto systems. So, um, yeah, in like, in Vitalik's tweet, even mentioned that like

• 18:07Speaker 04

  he himself has lost more, you know, personal funds in botched migrations than in all hacks, right? So, uh, you know, I think we as humans tend to, uh, you know, struggle with, uh, tail risks that are very scary, um, and sort of psychologically, you know, uh, prone to dominate our thoughts, when there are sort of clear and present risks that are actually, um, more dire, uh, even though less, less scary and less cataclysmic. Um, and so, uh, yeah, I just want to emphasize that, you know, bugs remain everywhere. Um, the AIs are good at finding the bugs. Uh, I actually hope that's good for, you know, uh, AIDS

• 18:49Speaker 04

  defensive, uh, practices more, uh, in the medium to long term than, than offensive ones. Um, and yeah, it's, uh, basically the, the worst thing you can probably do right now, um, is something. You should, you should do nothing. Um, and, and actually the, the recommendations in, in Justin Drake's posts, uh, were, were really just good practice, good hygiene, that all of these institutions should already be following independent of AI or quantum or, or anything.

• 19:16Speaker 03

  To, to Justin's point regarding institutions following all of these practices, you know, Coinbase already came out and said, they already do this. Right? They already do a lot of the specific measures outlined in bunker mode. And I think that they, they will continue to do that. It's true. A funny thing about it is that the further down this rabbit hole you go, I think we are already preparing. My understanding is that we are already preparing. As Dan said, we have already different types of assumptions that we can switch to in cryptography, and we've prepared the path a little bit. We already require, uh, you know, from the, the market, I mean, institutions to take some of these best, best practices, like making sure, you know, public keys aren't revealed on the blockchains where

• 19:58Speaker 03

  that's relevant. Right? We already do a lot of these things. Uh, and as we learn more, accelerated by AI research and their skills in math, we will probably add more and more methods of preparation to our kit. So the, the, the frustrating thing about the, uh, the take, we need to go into bunker mode, we need to prepare, is that it, the, the specific things that it advises us to do are probably not good and risky for normal people to do, and are already things that hardcore institutions who should take responsibility for these risks are doing. So there is not a specific set of recommendations that come

• 20:39Speaker 03

  out of this, specific new practices. The, the, if we're calling for anything here, what we're calling for is more information so we can know how to, how to adapt.

• 20:49Speaker 01

  And correct me if I'm wrong, but the types of cryptography that this tweet, the Justin Drake tweet, is referring to possibly being broken by advanced AI are the same types of cryptography that are under threat from a quantum computer as well. So this is like a threat we've already been thinking about for a while, a threat we've already been preparing for, for a while. And if it comes from AI before it comes from the quantum computer, it doesn't make it new.

• 21:15Speaker 03

  Dan opened with a couple of remarks on this about the conflation of the quantum issue from the AI math skills issue. Right? And the reason those, part of the reason why those things get conflated is that what Justin Drake was talking about was a lot of his fears about elliptic curve cryptography. And what's funny is because of fears of the quantum threat, people have already begun to treat elliptic curve cryptography as something that may be vulnerable soon. So we have already actually. Engaged in and prepared and deployed many of the mitigations you'd need for those exact concerns for a different threat. Right. So that's why it's a little bit of a funny thing for him to say,

• 21:58Speaker 03

  because it didn't come with specific, concrete recommendations about how institutions ought to prepare in a way they are not preparing today.

• 22:07Speaker 04

  I would also add that if what Justin was warning about happens in the timelines you mentioned, it's a cataclysmic event for all digital infrastructure security throughout the entire world, right? There's no way we're, you know, fully moving off of elliptic curve cryptography in the next couple of years. And so the focus on blockchain hygiene is just very discordant with this cataclysmic event he was discussing.

• 22:38Dan Boneh?

  You know, I will add to that, though, that the quantum threat is really only about these elliptic curve type systems and RSA and such. The AI threat in some sense is broader in that it could actually also look at our post quantum system and potentially weaken them in some way, maybe break them altogether. And so it is quite important to know that the latest models could not break our post quantum candidates, because those are the ones we're moving to. So that would be quite helpful. Now, in terms of what to do, people, I mean, I guess the question is kind of, what do we do about this? I totally agree with Eddie. The answer is, we should be doing what we are already preaching to do.

• 23:23Dan Boneh?

  And one of the main things that we always preach is what's called crypto agility. Yeah, that we deploy systems that can quickly switch from one type of design to another if the design is being used turns out to be insecure. Crypto agility is, in some sense, our friend for defending against the unexpected. Yeah, and we should keep on doing that. Yeah, we're already crypto agility is a term that's over a decade old. Yeah, so we should keep on doing that. And if our AI friends come up with things that we didn't expect, well, you know, the crypto agility will kick in and we'll move to something that is that remains secure.

• 23:58Speaker 03

  This debate also surfaced another opportunity to relitigate something that comes up all the time, which is elliptic curves versus hashes versus lattice cryptography as the fundamental basis for specific constructions and specific applications. And of course, Dan, of course, is totally correct that the AI threat is broader, because the, just to reiterate it slightly is, you know, if cryptography relies on the difficulty of specific problems, it could find flaws in the, in these problems on any of the schemes, right? Not just elliptic curve cryptography. But to get a little bit into the details,

• 24:40Speaker 03

  what Drake was saying was that there may be structure in lattice cryptography and elliptic curve cryptography that perhaps makes it more vulnerable to the ideations of a very well-resourced AI model. Again, we didn't learn anything specific about that per se from the OpenAI drop. But, but, you know, I think it's a little, it's a little bit less clear to me, and I'd love to hear from, from Dan and from, from Justin about, what is it specifically maybe about hashes or about lattice cryptography, in addition to elliptic curve cryptography, that maybe makes, gives someone, might give someone reasons to believe

• 25:25Speaker 03

  some are more secure than others to an AI threat?

• 25:28Speaker 01

  And the point there is that we think of hash functions as post quantum, but they might not be post AI. That's the.

• 25:34Speaker 03

  Yeah, that's right. That's right. And we think of lattice as post quantum, but not necessarily post AI. Right. And so how do you think of the, how do you think of them?

• 25:43Dan Boneh?

  Right. Good. So the migration to post quantum cryptography, I guess, in the blockchain space, there is actually quite a bit of debate on whether we should be using lattice based signatures or hash based signatures. On the internet at large, there is no debate. On the internet at large, everybody's using lattice based crypto systems. For key exchange, for signatures, that's a done deal. In the blockchain space, there is still a debate as to whether we're going to use hash based signatures or lattice based signatures. Generally, the attitude in the community is that hash based signatures are more secure. And there is multiple reasons to say that. One reason is that if it turns out that one hash function turns out to be not as secure as we thought,

• 26:26Dan Boneh?

  we simply switch it out for another hash function and everything works as before. The framework is guaranteed to be correct. Yeah. So there's like more agility when we use hash based signatures. If for some reason it turns out that the core lattice problems are not as hard as we thought, the whole mechanism collapses and we have no recovery. We can just not use lattices, period. So in some sense, hash based signatures are far more agile than lattice based.

• 26:52Speaker 03

  Because a hash based scheme, although it may vary in the specific hash function being used, the entire construct of a hash based scheme.

• 27:01Dan Boneh?

  The framework is sound.

• 27:01Speaker 03

  The framework is sound. So in other words, the choice of hash function, which would be the thing that would break, right, is, is less important, so to speak, in the, in the grand construction. Whereas in lattice based cryptography, maybe like elliptic curve cryptography, all those different schemes rely on maybe a specific shared problem or shared set of assumptions.

• 27:22Dan Boneh?

  Yeah, the other argument that I hear a lot in the, in the blockchain space is that specifically in Bitcoin and Ethereum, is that the hash assumptions that we make are necessary for other parts of the blockchain to operate, merkle trees and such. We already make lattice hash assumptions for the core functioning of the blockchain. So in some sense, if our signatures were also purely hash based, we are not adding any new assumptions to the security of the blockchain. Whereas if for one part of the blockchain, we use hashes and for signatures, we use lattices, all of a sudden now we have two different types of assumptions that if either one of them breaks, we have a problem. Yeah. And so reducing the number of assumptions in the blockchain

• 28:04Dan Boneh?

  is also something that people are kind of excited about. I get a sense that in the Bitcoin space, in particularly the, the core devs that I talk to, they're actually quite excited about getting rid of elliptic curve assumptions in Bitcoin and having Bitcoin only depend on the security of a particular hash function without any additional assumptions. And in some sense, the same thing is also playing out in the, in the Ethereum Foundation space. Yeah. So I think, I'd say those are kind of the comparisons between the two.

• 28:32Speaker 04

  This is, this is a complicated question, much more so than it appears on the surface. Sort of, you know, should blockchains rely exclusively on, on hashes? Or should they use lattices? So I mean, one thing to say is like, the whole world digital infrastructure is going to be very challenged if we only use hash based cryptography, because you just can't do, you know, good encryption key exchange from that. But also, like, especially in the Ethereum community, the way they plan to use only hashes, which comes with downsides, like, you know, just bigger cryptography, is, is to use what's called snark recursion.

• 29:17Speaker 04

  So basically, you have these proofs that, you know, you know, a bunch of signatures or something, and then you prove you know those proofs and prove you know those proofs and so on and so forth. And so there are two issues there. The more prosaic issue is this is just very complicated, right? To like prove you ran a snark verifier that it's self verified a proof that verified a proof. And so the surface area for bugs just gets very large. And yes, I'm very optimistic that the same AI tools that are scaring people about cryptography will also help us get all the bugs out. That's a very hard problem. So, you know, we have to speculate just as much on, I know the bugs is like a really, really, really hard problem. So the AI is going to have to be really good if we're going to get all of those bugs out from a system that complicated. And I think relying exclusively on hashes amplifies that.

• 30:02Speaker 04

  And the other thing is that we don't understand the security of snark recursion very well. So that's another, you know, you tell me lattices might be attackable. I say, well, I don't know about snark. You know, again, it's, there are a lot of non-quantifiable risks and, you know, I'll just leave it at that. We have to do our best to weigh these things. And the public discussion weighing them can be pretty frustrating sometimes.

• 30:25Speaker 03

  Yeah, that's right.

• 30:26Dan Boneh?

  I do want to make one more, one more point on the hash-based versus lattice-based. It is quite important to understand that lattice-based systems have much better properties than hash-based, which is actually why many in the crypto community are pushing towards lattice-based systems. So things like threshold signatures, things like non-hardened key derivation. There are many properties of hash-based, of lattice-based systems that we simply don't have with hash-based systems. Also, hash-based systems are harder to use in principle. Like Justin was saying, they're much larger and they're stateful versus stateless. There are many technical issues with getting hash-based signatures to work. So many of us cryptographers are actually a little sad

• 31:10Dan Boneh?

  that some of the blockchain community will move to hash-based signatures that really have no algebraic properties for us to leverage for more advanced applications. So in some sense, there's a trade-off that we're making. And perhaps we are removing assumptions from the blockchain space, but we're also removing capability in that now we are going to be using signature schemes that have far fewer properties than what we would have if we were using lattices. So as a cryptographer, to be honest, I would be quite happy if we ended up using lattice-based schemes, because that gives us much more room to play in and build interesting structures. But the hash-based schemes who are much, much more constrained,

• 31:52Dan Boneh?

  but perhaps that constraint is also where this extra sense of security comes from.

• 31:58Speaker 01

  So maybe to give a quick summary of what, what we've kind of discussed so far, what it's, what it sounds like is, you know, and I think Justin led this out very nicely. It is not a given that there is an efficient algorithm that could be found to break this type of cryptography. If there is an efficient algorithm out there, then the timeframe at which to find it will have, is likely very, very sped up, given our advances in AI. And that's where the kind of panic and confusion is coming from, is the possibility that that efficient algorithm both exists and now the timeline is much shorter than it would be without these advances in AI. And the easiest way to minimize that panic

• 32:38Speaker 01

  is for more information from the labs to come out on how much work they've done to try to find that algorithm. And if, if the labs came out and said, you know, we threw a bunch of compute and time and money at this and we couldn't crack it, that would give you confidence at least until the next a big upgrade in the model that we have a reasonable, safe security assumption.

• 32:57Speaker 03

  In the extreme case, it should give you more confidence than the history until today. Right? If you really do believe, like many do, like many of the people posting yesterday believe, that these, you know, these models are now basically at, at or better than the vast majority of people who are trying to, you know, who are studying these systems, or they will be soon, or whatever, then you should get great confidence from knowing that the equivalent of, you know, 100,000 expert mathematicians or cryptographers took a look at a scheme. It should actually make you more confident than you could have ever been about one before that.

• 33:39Speaker 03

  I can't help but emphasize, like, we need to reconsider just how we even decide what we feel confident about.

• 33:47Speaker 01

  So we've talked a little bit about, you know, if you're an institution, there's a lot of these security best practices that you probably are already doing or should have been doing already. If you're an everyday user, nothing to do at the moment, don't panic, continue on. If you're a startup that, you know, wants to take advantage of this really interesting kind of like piece of technology unfolding in this way, are there startup opportunities here and where a new company might be able to come in and help?

• 34:14Speaker 03

  I think the most obvious note that I take out is that, well, startups will have to need to have, you know, seriously consider what types of security assumptions they make in their, in their software today. You know, however they design their systems. That's already kind of happening on multiple fronts, right? How people think about open source is changing, right? Didn't closed source, basically, everyone recognized closed source died last week, right? Because of our ability to decompile things. It's also the case that because of the agentic properties of AI systems, by agentic properties, I mean, they can go on unbounded side quests, right? And do all kinds of random things in pursuit of a goal for you.

• 34:57Speaker 03

  Because of this, we have to think very carefully about the security boundaries and sandboxes and capabilities-based permissioning schemes we put around AI agents. So we're already thinking about rethinking security from that lens. Well, this is just yet another way we need to reconsider what systems are capable of and how to design software and products that remain secure and that protect users as much as they empower them.

• 35:23Dan Boneh?

  I would go even a step further. I think that these new capabilities are a gift to startups and to even more established software shops. So I can tell you in the past, when, the time when a crypto system becomes really interesting to attack is once it's announced that it's about to be deployed or is already deployed. Like, like this is when, after it's deployed, it gets a lot of attention from cryptographers. And that's kind of the wrong time to attack a crypto system. Whereas now, because we control these AI models, any startup or any software shop that's deploying a, a new crypto capability or actually even deploying any software at all can now have these models analyze its cryptography

• 36:07Dan Boneh?

  and analyze its general software for bugs. This is an incredibly powerful tool that didn't exist before. Over time, as more and more software shops adopt this technology, I believe that software quality is going to go up. Crypto quality is going to go up because nothing will ship.

• 36:25Speaker 03

  Yes.

• 36:25Dan Boneh?

  Unless the model said that it's, it's, it's valid.

• 36:28Speaker 03

  I, I saw someone recently because of the release of like 5.5 Haiku. They were comparing with 4.5, right? And making many comparisons between models from a year ago versus today. And it's always hard to do an apples-to-apples comparison when the, the capabilities per token have increased so much. But some people were coming up with estimates like it's 90 some plus, 95% cheaper, right? 99% cheaper for, you know, intellectual capability per dollar, right? If that's the case, and you pair that with a frame we've said before, we talked about before,

• 37:09Speaker 03

  which is that the number of bugs in software is finite, right? Then we're asymptotically approaching zero bugs. Maybe, and maybe we actually just hit zero at some point. Maybe we have the ability to create zero with some assumptions, right? If that's the case, we are net improving the security status of the world instead of eroding it, right? It's, this is not a battle of wits where you have a system, I have a system, your system is smarter than mine, therefore I am vulnerable to you. Like, no matter what, no matter how I configure myself, you can overpower my computer and destroy my computer, right? If that relies on there being vulnerabilities and vulnerabilities can be removed,

• 37:54Speaker 03

  they can be designed away, they can be mitigated. And the primary resource we dedicate to mitigating it is the thing, is a thing that's getting radically cheaper every couple of months. And that's, you know, AI capabilities, intellectual capabilities, you know, intelligence, machine intelligence, whatever you want to call it.

• 38:14Dan Boneh?

  Companies actually are already doing this. Companies are actually spending a lot of money on exactly scanning their, their codebase with the latest models. And it's actually really quite interesting. Every time there's a software update, they scan the model, the software again. Every time a new model comes out, they scan the model again, they scan the software again. And so I have to say, one of the interesting research questions in the space is something actually we are quite interested in is how do we do software scanning at, more efficiently? Yeah. So we don't have to maybe re-scan everything every time a new model comes out.

• 38:46Speaker 03

  Yeah.

• 38:46Dan Boneh?

  Or every time a change is introduced. So there's even lots of interesting areas for thought and research here.

• 38:53Speaker 03

  Yep.

• 38:54Speaker 01

  Let's say the, the labs take up your plea. They throw a bunch of compute at it and they come out and they say, you're right, we did break elliptic curve cryptography, actually. What, what happens next? Like, you know, we recorded this podcast today and tomorrow, what does the world look like? What is the step?

• 39:10Dan Boneh?

  Then, then basically we have to move to post-quantum cryptography, which we're already doing. We have to move to these lattice-based systems, which are already deployed. If you look, by the way, if you can literally look at many internet connections today, they are actually using agile cryptography. They're encrypted using elliptic curves and lattices at the same time. If you break elliptic curves, it doesn't matter because it's also encrypted under a lattice-based system.

• 39:34Speaker 03

  Yeah. Didn't like iMessage make that migration last year? And, and, and many other such systems have done that.

• 39:40Dan Boneh?

  Exactly. Signal and so on. Yes, yes. In fact, but I was actually referring to one of the TLS exchange.

• 39:46Speaker 03

  Yeah, yeah.

• 39:46Dan Boneh?

  I guess it's called X25519, MLKM768, the jumble of letters. But what it means is you're protected by both elliptic curves and, and lattices. Now, maybe the labs come forward and say, oh, we broke both, right? Well, fine, then we introduce a third one. We'd have to standardize, that would be a longer process, but that would be what would come next. So we kind of know where to go. It's just going to be more work and perhaps more, more of a rush.

• 40:13Speaker 03

  Yeah. And maybe at the risk of stating the obvious, like, I have no doubt they would be prudent enough to do this the right way. It goes without saying, but the labs shouldn't go and share this just like throw out, you know, a, a scheme to break, uh, break elliptic curves. They should responsibly disclose it to, to the, to the industry, to the government, to the industry, develop a plan and everybody needs to update their software as quickly as possible. And hopefully we could move quickly and, and, and adapt. But, but again, that is a known process that a lot of people take for granted. Like I'm, it's almost like silly I'm saying it because all, security experts know this very, very well.

• 40:56Speaker 03

  And so there is, there is a way to do such a thing, should it happen.

• 41:00Speaker 01

  Great. Well, thank you for that. I feel calmer. So hopefully everyone else does as well. Thanks so much.

• 41:07Dan Boneh?

  This was fun.

• 41:07Speaker 03

  Thank you.

• 41:10Erik Torenberg?

  Thanks for listening to this episode of the A16Z Podcast. If you liked this episode, be sure to like, comment, subscribe, leave us a rating or review and share it with your friends and family. For more episodes, go to YouTube, Apple Podcasts and Spotify. Follow us on X at A16Z and subscribe to our Substack at A16Z.substack.com. Thanks again for listening and I'll see you in the next episode. As a reminder, the content here is for informational purposes only, should not be taken as legal, business, tax or investment advice or be used to evaluate any investment or security and is not directed at any investors or potential investors in any A16Z fund. Please note that A16Z and its affiliates may also maintain investments in the companies discussed in this podcast.

• 41:54Erik Torenberg?

  For more details, including a link to our investments, please see A16Z.com/disclosures.