Matthew Green has been writing a rather pessimistic series of posts about the potential for AI systems to vastly outperform humans in cryptanalysis of both symmetric and public-key ciphers.
I am more optimistic than he is. That is, I have stronger faith in the over-engineering cryptographers tend to do. I am trying to write this up in more detail.
Dave Sanford • October 14, 2026 11:38 AM
If AIs can solve the Navier-Stokes existence and smoothness problem, they can probably do this. I’m concerned that AI-driven offensive and defensive cryptanalysis could spark a new arms race.
Study4Pass • October 14, 2026 12:46 PM
Your optimism about over-engineering is reassuring, but it raises a question for me: does that margin protect us mainly against incremental improvements, or also against a genuinely novel attack idea? Human cryptanalysis has historically advanced in jumps — differential, linear, side channels — not just faster brute force. If AI’s edge is in combining techniques and searching spaces humans would never explore by hand, the worry isn’t that it out-computes us, but that it finds a structural shortcut we assumed was impractical to discover. I’m curious whether your longer write-up will address how much of that safety margin is mathematical versus merely ‘nobody has found the trick yet.’ As someone studying cryptography fundamentals through Study4Pass, this distinction between a cipher being strong and being merely unbroken so far is the part I find hardest to internalize.
Clive Robinson • October 14, 2026 1:10 PM
@ Bruce,
With regards,
“I am more optimistic than [Matthew Green] is”
Actually I’m not I’m actually more pessimistic than Matthew Green is…
The reason is,
Cryptographic systems are way way more than algorithms.
We saw this with AES, the implementations designed by cryptographers and put up on the NIST Competition Web Site were not exactly what you might hope from the theoretical strength of the algorithms.
The AES implimentation was designed for speed and in the process opened up a series of side channels.
Which unfortunately leaked “secrets to the line”…
As others noted the NSA knew all about this sort of “implementation problem” but never said anything to NIST or anyone else…
It was in fact so bad that not only were “secrets leaked to line” so strong was the leakage it passed through upstream routers into the cloud.
Where users generally can not see but the NSA can easily do so…
There are still copies of that “bad code” in libraries that get used in things like “Smart Meters” and other “Internet of Things”(IoT) devices.
Is it “accidental or deliberate?”
It is hard to know but as this sort of thing goes on all the time, I suspect even “Post Quantum Cryptography”(PQC) practical implementations will have “accidental side channels”… Effectively “built in” in low cost devices like Smart Meters, Medical Electronics, and similar with half century installation being part of the design spec…
So it’s not the National Security or other similar systems I worry about, but the ordinary cheap and mundane devices.
We are already seeing Anthropic worrying about IoT devices as the next threat to worry about,
Anthropic conjures another threat that doesn’t exist yet to stoke fears of AI apocalypse
Self-replicating AI botnets could become feasible on IoT hardware within months, claims the Claude maker, if smaller models get smarter
“Nothing sells AI products as well as fear. Using new research, Anthropic claims that self-replicating AI worms could be just months away from spreading across vulnerable IoT devices, which would be a problem if it came true.
The frontier lab published a research report Monday suggesting that AI models could eventually self-replicate without relying on data center hardware, with a 9-billion-parameter model successfully setting up inference on eight of the nine hardware types Anthropic tested.“
Now depending on what you believe this is a threat or it is not.
I err on the side of caution when assessing such things.
But… What I assess is often not the original idea (they are often to prosaic).
So consider how many IoT devices out there, that could be taken over by a suitably small model.
Just how many would be needed?
A lot but is it an issue with IoT being fairly ubiquitous…
Many years ago this idea was proposed as the “Chinese TV lottery” idea (If memory serves correctly this was before our host @Bruce published his first “Applied Cryptography” book in the early 1990’s (blue cover).
Kempton • October 14, 2026 5:15 PM
Bruce, I hope your “stronger faith in the over-engineering cryptographers tend to do” is founded. The idea of the non-existence of “a weaker/weakest link(s)” fascinates me. And of course, the idea of #OverEngineering in many subsystems leading to a stronger and more resilient system as a whole seems, at least in theory (maybe also in practice, as your faith indicates), possible. Time will tell. And, fortunately, or unfortunately, with the speed of grow of #AIPower, we won’t need to wait too long if and when beep hits the fan above us all, and the shower of beep won’t be too pretty.
Clive Robinson • October 15, 2026 12:34 AM
@ Kempton, ALL,
With regards,
“The idea of the non-existence of “a weaker/weakest link(s)” fascinates me.”
All Systems not just software of any useful complexity will have multiple different links.
Simple logic dictates that if you make a chain of different links then there will always be a weakest link and a strongest link.
But from a more practical point systems “process” that is they have through put from input to output from subsystem to subsystem often what goes through a system is altered differently in each subsystem.
This means that the links within the chain of the system even if identical have different loads. Thus the strength or weakness of a link varies with how what is being processed changes.
Which brings us to,
“the idea of #OverEngineering in many subsystems leading to a stronger and more resilient system as a whole seems, at least in theory … possible.”
The bad news is “OverEngineering” always adds increased complexity, and complexity is where the harder to resolve vulnerabilities are usually found…
It’s why two of the fundamental design rules of secure design are,
1, Strong segregation by functional isolation with the minimum of needed coupling.
2, Reduce complexity in each functional block to the minimum needed to do a required function.
One “gotcher” is the assumption that things go from left to right and top down. The sad truth is that for reliable function either a designed feedback path or accidental feedback path exists at all times, and this harms the idea of segregation.
For instance there is over confidence in “data diodes” for segregation. Unfortunately to handle “errors or omissions” it necessitates some form of feedback signalling.
Such feedback moves in the reverse direction backwards through the data diode from output back through the input and potentially all the way back through an entire system. As such it can be used for “Fault Injection Attacks” and the creation of “covert channels” by timing attacks.
It’s knowing such things and that humans were effectively designed by evolution to err, that causes my pessimism to increase way faster than others (and for good reason).
So whilst “in theory” we can design tools to develope the parts of a secure system. In practice,
1, The tools will always be imperfect / incomplete.
2, New attack methods not covered by the tools will be discovered on a frequent basis.
Ismar • October 15, 2026 1:49 AM
It all comes down to the old adage that it is much easier to break things than to make them (work as intended)
Robin • October 15, 2026 4:35 AM
@Clive, you’re absolutely right about not just cryptographers over-engineering things.
A good counter-example to your design principles comes to mind: about 7 or 8 years ago Lidl were selling a multicooker that used a customised 7″ Android tablet for the control panel. It ran Android 6.0 (Marshmallow) with a MediaTek MT6580 quad-core processor. Don’t know how much RAM it had. Out of the box it was loosely locked down but I remember a project that hacked into it for laughs – maybe activating the microphone? It was obviously cheaper and more flexible to repurpose a commodity tablet that design a whole new bit of hardware. OK, this is an old story and maybe the new versions are better, but I can’t believe that this is the only example of using a hugely over-capable, and easily hackable device for a banal IoT product. Get used to talking nicely to your toaster.
Winter • October 15, 2026 4:42 AM
@Ismar
It all comes down to the old adage that it is much easier to break things than to make them (work as intended)
That’s the second law of thermodynamics in a nutshell:
Things go wrong all by themselves. To make things go right takes work[1]
[1] Work both in the thermodynamics sense and the social sense.
Clive Robinson • October 15, 2026 10:04 AM
@ Robin, ALL,
With regards,
“Out of the box it was loosely locked down but I remember a project that hacked into it for laughs”
It was not the first and it won’t be the last…
There are quite a number of “Rocket Competitions” for Uni Students to participate in…
The UK “Civil Aviation Authority”(CAA) has overall authority on non passive “toy” rockets. With the “Communications Agency / OfCom having control on EM radiated “communications” from “DC to Daylight and beyond”.
Because of the perceived “terrorism / hostile nation state” risk the CAA do not allow “flight course control” or indirectly the use of the likes of Android mobile phones.
Which from previous experience before the CAA lockdown used to be fun as modern phones have just about everything you need including “visual ground mapping to target to check / avoid GNS systems are not being jammed etc. And For non rocket drones it gives various operator feed back… And the building of a USB to Fiber network cable has likewise been done…
As most of them are made in China and shipped world wide putting a ban on the technology is beyond any National Government (even North Korea has illicit mobile phone issues close to it’s national boarders).
And with what is going on at the East of Europe, and now in the Middle East might not appear surprising.
But… It’s given the Defence Industry Market which used to suck in a lot of money into the UK what is in effect an existential crisis… So big money pressure is being brought on Politicians and the likes of MI6 are being left “Wrong Footed” and “flapping in the breeze” (as has recently been seen)
But that is all fairly modern and about to change drastically…
As some know I’ve gad a fairly eclectic work life in electronics, communications and other engineering …
I used to work for a while in the “Broadcast Industry” where a friend had well regarded product manufacturing that he and I had designed product. However he had issues arise in that customers wanted “fancy controls” and displays even on Transmitters in racks up the top of mountains… And more importantly remote control via computer networking.
Designing our own system was going to be ludicrously expensive and fraught with issues (CE / FCC compliance being the most problematic but most time consuming).
So I suggested using the guts of a two screen very popular hand held computer game console, that had already got a significant “hacker following”.
Thus it was not much more than a simple mechanical task taking it out of it’s plastic “consumer case” and mounting it on the back of a “Professional 19″ rack front panel”.
Then loading in a hacked OS and Graphics System and writing custom apps for it. So a new “High end” transmitter was added to the range of products for a heck of a lot less cost and issues very rapidly (yup run fast but don’t break things or fall on your face).
Later products used the Pi SBC products and their US and Chinese competitors… As long as it had verified CE and FCC compliance testing (a lot of Chinese products have neither so you have to be carefull, as “Compliance by constructors file” only gets you so far.
So… you could untill RAM prices climbed through the roof get for just pocket change boards in quantity that would rival *nix boxes that were in the tens of thousands of dollars range well within preceding human memory in terms of compute power.
But getting back to the UK CAA, it is going to prove interesting… UK politicians want to go “all in” on both small rockets and AI and keep the Defence Industry happy. As the UK already has a best in class in certain Defence systems and satelite “Payload Reputation” they want to snaggle the rest of the Space industry. Which will mean lifting some of the CAA restrictions on Universities and educational establishments, and actually encouraging the to “Aim for Space”.
As I’ve pointed out before, doing this sort of thing is well within Undergraduate Project level, and in some cases is seen as a “class groups” project each semester carrying 40% or more of the course marks…
It’s not just AI that can be seen as a modern day “Existential Threat” technology, drones and their control systems are very definitely beating AI on that score “Due to unrestricted Agency”, only few realise it yet…
Clive Robinson • October 15, 2026 10:22 AM
@ Robin, ALL,
This sort of throw away comment you made of,
“Get used to talking nicely to your toaster.”
Requires a response of it’s own 😉
Back last century the carton series “The Simpsons” gave rise to another cartoon series by the same people, many of whom were shall we say “quite educated” and at least one cartoon in Futurama actually gave rise to a real advancement in the field of mathematics…
But the episode I’m thinking of involved the uprising of the robots from “Mom Corp”…
In it what we would now call “IoT Devices” rebelled in a Marxist-Leninist uprising…
There is a funny seen with Fry trying to get the toaster to do his bidding.
A similar seen occured a decade or so before that in the BBC series “Red Dwarf”, but the protagonist was not worried about starving to death because of it.
freedom • October 15, 2026 8:13 PM
Clive wrote:
not only were “secrets leaked to line” so strong was the leakage it passed through upstream routers into the cloud.
What channel was this, exactly. To exploit a so called side channel you need physical access to measure voltages/timings. Or you need to run malware on the target device, to again measure timing, or exploit poorly designed hardware like in the spectre attacks.
What kind of side channel could span multiple network connections though.
Clive Robinson • October 16, 2026 1:29 AM
@ freedom, ALL,
With regards,
“What kind of side channel could span multiple network connections though.”
The side channel was due to “loop unrolling” and exhibited as delay.
The NSA and other “SigInt” agencies “playground” is by putting taps on upstream routers. Thus the first router “blocks the target of observation” from seeing anything beyond it.
As the upstream routers natively had a fraction of the time delay they were nearly transparent to it.
It’s the same sort of timing channel used to deliberately leak information from the core of a system out through various system sub assemblies out to the cloud and far beyond.
Matt Blaze and his Students published a paper two decades ago on this. The mechanism they used was to apply a Spread Spectrum jitter to the key press timing,
Keyboards and Covert Channels
“This paper introduces JitterBugs, a class of inline interception mechanisms that covertly transmit data by perturbing the timing of input events likely to affect externally observable network traffic. JitterBugs positioned at input devices deep within the trusted environment (e.g., hidden in cables or connectors) can leak sensitive data without compromising the host or its software. In particular, we show a practical Keyboard JitterBug that solves the data exfiltration problem for keystroke loggers by leaking captured passwords through small variations in the precise times at which keyboard events are delivered to the host. Whenever an interactive communication application (such as SSH, Telnet, instant messaging, etc) is running, a receiver monitoring the host’s network traffic can recover the leaked data, even when the session or link is encrypted. Our experiments suggest that simple Keyboard JitterBugs can be a practical technique for capturing and exfiltrating typed secrets under conventional OSes and interactive network applications, even when the receiver is many hops away on the Internet.“
https://www.researchgate.net/publication/234829288_Keyboards_and_Covert_Channelsf
Note the last half of the last sentence of the above abstract,
“… even when the receiver is many hops away on the Internet.”
In the past two decades network latency has been decreased through switches and routers, thus making the issue worse.
In the past when I’ve referenced this paper people have noted it was a PS2 compatible keyboard not a USB keyboard as though it was some technical defect.
It’s not, using PS2 protocols incurred no cost as it was an Open Standard. USB on the other hand was and still is a Closed Standard and requires the payment of a large fee for use. Whilst not an issue for those with nefarious intent, it is a major financial road block for academic publication.
freedom • October 16, 2026 11:40 AM
Thanks for the reference Clive.
These kinds of attacks are a serious threat, but they explicitly bypass encryption. So if we’re looking at how so called “AI” can help with cryptanalysis, I’m not sure they are too relevant.
As to using the hyperhyped chatbots to do cryptanalysis, I suppose they might stumble upon some overlooked trick simply by trying mindless combinations. So far I don’t think the chatbots have solved any actual problem, despite “news” used to manipulate stock prices. i.e. fraud.
ps:here’s a direct link to the paper
http://usenix.org/events/sec06/tech/shah/shah.pdf
https://www.usenix.org/conference/15th-usenix-security-symposium/keyboards-and-covert-channels
Clive Robonson • October 16, 2026 7:40 PM
@ freedom,
“So if we’re looking at how so called “AI” can help with cryptanalysis, I’m not sure they are too relevant.”
It depends on what you call “cryptanalysis”. Put simply,
1, Breaking the “Theory”
2, Breaking the “System”
Mostly these days it’s those with an “academic viewpoint” that go for the “Theory” and most such attacks are in themselves “theoretical”… As on their own they cannot work within time or other resource requirements to be “effective attacks” (ie whilst the encryption protected information is still practically relevant for human relevant time scales).
Which means these days most algorithms for encryption and the modes they are put to use in are considered sufficient to protect information from classical attacks.
But the Strongest/Weakest link in the chain reasoning still applies well beyond the encryption and mode algorithms. Which is why “end-run attacks” are usually the only practical option (hence the move by authoritarians from “backdooring E2EE” to “backdooring the user interfaces” or what we now call “Client Side Scanning”).
Since at least the 1980’s by my direct knowledge the aim of the SigInt Agencies has been two pursue both paths effectively independently to either “build” or “break” systems respectively.
With regards “break” any electronic system especially those using digital logic are very susceptible to new “break the system” attacks that monitor radiated or conducted “energy signals” that have “confidential information” “cross modulated” on them. Hence the term “side channel attacks”. Which makes “break the system” the chosen attack method.
Where Current AI systems can work well is that the LLMs can very effectively “pull signals out of noise” that has any statistical pattern.
This can be viewed as moving into the “middle ground” between “Break the theory” and “Break the system”.
This is what many think “Quantum Cryptography” will also do.
I won’t go into the arguments about hunting for statistics from repeated actions other than note they are in some ways little more than “averaging out noise”.
Claude Shannon realised back almost a century ago that the length of the “Key Material”(KeyMat) has a significant fundamental effect on how the statistics could be used as does compression. In practical terms block ciphers are seen as no different to simple substitution ciphers that can in effect be broken by incredibly simple means (see the DES encrypted Linux Penguin image). It’s why those “encryption modes” are so important.
That is the longer the KeyMat compared to the message length the less statistical information an attacker can obtain to work with in any given time frame. Likewise compression “flattens the plaintext statistics”. With the encryption mode in effect providing ways to “muddle both the reduced statistics” so the KeyMat appears to be longer than it actually is.
So just one of the things it is hopped AI will do is make finding statistical relationships easier, more effective or both.
Clive Robinson • October 17, 2026 3:26 PM
@ freedom, ALL,
Another link you might find of interest, where it’s the system using encryption that gets attacked, rather than the encryption,
https://techxplore.com/news/2026-10-cyber-threat-exposes-limits-encryption.html
Simplistically it uses the length of standard messages that have been encrypted as well as when they are sent, and correlates them with observable actions.
This is a form of traffic analysis first worked out at Bletchley Park during WWII. Where breaking an enigma message to plaintext could take way more than a day. Traffic analysis of the same messages could give actionable information / intelligence within minutes.
The trick to protecting against traffic analysis is to,
“Prevent any kind of correlation (including anti-correlation).”
This however is very difficult to do especially with automated systems unless they are well thought out at the pre-design stage.
The question that of course arises is,
“As AI is good at spotting patterns thus correlations, will we see AI be used for Traffic Analysis?”
To which I suspect the answer is almost certainly “Yes” if it has not been done so already in certain active war zones.
Subscribe to comments on this entry
Sidebar photo of Bruce Schneier by Joe MacInnis.
Ferentarius • October 14, 2026 10:40 AM
Re: “I’m not going to get a prize for being right, and everyone will make fun of me for being wrong“
To be right is a barren victory, and to be wrong is a public crucifixion. Life is a theater where applause and ridicule are equally hollow; the only authentic moment is the one in which we recoil from both.