Matthew Green has been writing a rather pessimistic series of posts about the potential for AI systems to vastly outperform humans in cryptanalysis of both symmetric and public-key ciphers.
I am more optimistic than he is. That is, I have stronger faith in the over-engineering cryptographers tend to do. I am trying to write this up in more detail.
Dave Sanford • October 14, 2026 11:38 AM
If AIs can solve the Navier-Stokes existence and smoothness problem, they can probably do this. I’m concerned that AI-driven offensive and defensive cryptanalysis could spark a new arms race.
Study4Pass • October 14, 2026 12:46 PM
Your optimism about over-engineering is reassuring, but it raises a question for me: does that margin protect us mainly against incremental improvements, or also against a genuinely novel attack idea? Human cryptanalysis has historically advanced in jumps — differential, linear, side channels — not just faster brute force. If AI’s edge is in combining techniques and searching spaces humans would never explore by hand, the worry isn’t that it out-computes us, but that it finds a structural shortcut we assumed was impractical to discover. I’m curious whether your longer write-up will address how much of that safety margin is mathematical versus merely ‘nobody has found the trick yet.’ As someone studying cryptography fundamentals through Study4Pass, this distinction between a cipher being strong and being merely unbroken so far is the part I find hardest to internalize.
Clive Robinson • October 14, 2026 1:10 PM
@ Bruce,
With regards,
“I am more optimistic than [Matthew Green] is”
Actually I’m not I’m actually more pessimistic than Matthew Green is…
The reason is,
Cryptographic systems are way way more than algorithms.
We saw this with AES, the implementations designed by cryptographers and put up on the NIST Competition Web Site were not exactly what you might hope from the theoretical strength of the algorithms.
The AES implimentation was designed for speed and in the process opened up a series of side channels.
Which unfortunately leaked “secrets to the line”…
As others noted the NSA knew all about this sort of “implementation problem” but never said anything to NIST or anyone else…
It was in fact so bad that not only were “secrets leaked to line” so strong was the leakage it passed through upstream routers into the cloud.
Where users generally can not see but the NSA can easily do so…
There are still copies of that “bad code” in libraries that get used in things like “Smart Meters” and other “Internet of Things”(IoT) devices.
Is it “accidental or deliberate?”
It is hard to know but as this sort of thing goes on all the time, I suspect even “Post Quantum Cryptography”(PQC) practical implementations will have “accidental side channels”… Effectively “built in” in low cost devices like Smart Meters, Medical Electronics, and similar with half century installation being part of the design spec…
So it’s not the National Security or other similar systems I worry about, but the ordinary cheap and mundane devices.
We are already seeing Anthropic worrying about IoT devices as the next threat to worry about,
Anthropic conjures another threat that doesn’t exist yet to stoke fears of AI apocalypse
Self-replicating AI botnets could become feasible on IoT hardware within months, claims the Claude maker, if smaller models get smarter
“Nothing sells AI products as well as fear. Using new research, Anthropic claims that self-replicating AI worms could be just months away from spreading across vulnerable IoT devices, which would be a problem if it came true.
The frontier lab published a research report Monday suggesting that AI models could eventually self-replicate without relying on data center hardware, with a 9-billion-parameter model successfully setting up inference on eight of the nine hardware types Anthropic tested.“
Now depending on what you believe this is a threat or it is not.
I err on the side of caution when assessing such things.
But… What I assess is often not the original idea (they are often to prosaic).
So consider how many IoT devices out there, that could be taken over by a suitably small model.
Just how many would be needed?
A lot but is it an issue with IoT being fairly ubiquitous…
Many years ago this idea was proposed as the “Chinese TV lottery” idea (If memory serves correctly this was before our host @Bruce published his first “Applied Cryptography” book in the early 1990’s (blue cover).
Subscribe to comments on this entry
Sidebar photo of Bruce Schneier by Joe MacInnis.
Ferentarius • October 14, 2026 10:40 AM
Re: “I’m not going to get a prize for being right, and everyone will make fun of me for being wrong“
To be right is a barren victory, and to be wrong is a public crucifixion. Life is a theater where applause and ridicule are equally hollow; the only authentic moment is the one in which we recoil from both.