Boneh Rejects Drake's AI Panic, Says OpenAI Tests Broke No Encryption

Boneh驳斥Drake的AI恐慌言论，称OpenAI测试未攻破任何加密算法 前沿AI模型未攻破任何标准密码系统，算法攻击的失败最终将增强对现有原语的实证信心，而后量子敏捷性则保护着数字网络。 针对OpenAI发布约700篇数学论文后因“进入地堡模式”的警告而引发的恐慌，专家小组澄清现代密码学仍未被攻破。专家解释称，密码学家依赖的是计算复杂性假设而非绝对的数学证明，并指出如果解决离散对数的高效经典算法并不存在，任何AI都无法凭空创造出来。他们并未将AI单纯视为威胁载体，而是强调廉价的自动化推理可以通过对假设进行不懈测试并消除软件漏洞，从而加速建立实证信心。此外，成熟的密码敏捷性、混合实现以及标准化的后量子替代方案确保了广泛的互联网和区块链生态系统在任何单一数学假设减弱时，都拥有可直接替换的备选方案。 对AI攻破密码学的广泛恐慌由OpenAI发布的约700篇数学研究论文引发，但没有一篇论文展示了对密码原语的攻击，也未涉及密码学难解性。 (3:00) 理论计算机科学界的共识认为，攻破椭圆曲线离散对数等问题的高效经典算法可能并不存在，这意味着即使是超智能AI也无法发现根本不存在的捷径。 (17:15) 将数千万美元的前沿AI算力用于攻击密码学假设，可作为一项重大的防御资产，在数周内提供的实证难解性保证比人类十年的同行评审还要多。 (12:30) 互联网基础设施和即时通讯应用正在积极推出具备密码敏捷性的防御措施，包括将经典椭圆曲线与后量子格密码学相结合的X25519MLKEM768等混合密钥交换标准。 (38:43)

Stanford cryptographer Dan Boneh and a16z crypto partners Eddy Lazzarin and Justin Thaler argue that recent panic over artificial intelligence breaking modern cryptography is fundamentally unwarranted, noting that no classical algorithmic breakthroughs against core primitives have materialized. They contend that automated reasoning models are far more likely to reinforce cryptographic confidence and eradicate implementation bugs than to invent attacks against intractable mathematical problems. Unwarranted Panic and the AI Cryptography Vacuum (0:00) A wave of industry anxiety arose after Ethereum researcher Justin Drake advised high-value accounts to enter 'bunker mode' by concealing public keys off-chain, warning that rapid AI advancements could dismantle elliptic curve cryptography within months. Dan Boneh rejects this alarm, stressing that current foundational security remains unchanged from prior years. The public discourse conflated long-studied quantum computing threats—which require physical, fault-tolerant hardware to execute algorithms like Shor's—with speculative frontier AI attacks discovering classical algorithmic shortcuts. Justin Thaler emphasizes that theoretical computer science consensus holds that no efficient classical algorithm exists for discrete logarithms, and an AI cannot manifest a mathematically impossible solution. The panic was compounded by OpenAI releasing roughly 700 papers solving intractable mathematics and theoretical computer science benchmarks, which conspicuously omitted any work on cryptography. Eddy Lazzarin and Dan Boneh note this absence points to two possibilities: either frontier models failed completely when challenged with cryptographic assumptions, or proprietary labs have chosen not to disclose their findings. Boneh issued an explicit public appeal for frontier labs to transparently disclose their internal results testing cryptographic hardness assumptions. Compute-Driven Scrutiny as a Confidence Engine (5:00) Modern cryptography relies on computational complexity assumptions, such as the Elliptic Curve Discrete Logarithm Problem (ECDLP) and lattice-based Shortest Vector Problems (SVP), which cannot be formally proven without resolving the open P versus NP problem. Historically, confidence in these primitives was acquired slowly across decades as human mathematicians repeatedly failed to break them. Lazzarin notes that frontier AI models invert this dynamic: labs can now concentrate tens of millions of dollars in compute on a single primitive, simulating the scrutiny of an estimated 100,000 mathematicians within weeks. Boneh and Thaler explain that if capable models attempt to break deployed cryptosystems and fail—or merely reduce security margins by minor margins such as 10 bits—that outcome offers rigorous empirical validation rather than evidence of fragility. However, because cutting-edge models remain restricted behind proprietary lab walls, outside cryptographers are currently prevented from reviewing internal results, creating an artificial information vacuum. Lattice and Hash-Based Post-Quantum Trade-Offs (25:00) As the broader internet standardizes on lattice-based cryptography for post-quantum public-key exchange and digital signatures, the blockchain ecosystem remains divided between lattice and hash-based architectures. Proponents favor hash-based schemes because they avoid new algebraic hardness assumptions and offer structural agility: if a specific hash function fails, it can be swapped for an unbroken one without altering the underlying scheme. Conversely, a failure in core lattice assumptions would invalidate that entire paradigm without a direct substitute. However, Boneh and Thaler caution that hash-only constructions impose severe trade-offs. Hash-based signatures generate massive data payloads and lack algebraic structures, preventing advanced features like threshold signatures and non-hardened key derivation. Proposals to compress hash signatures using recursive zero-knowledge SNARK proofs introduce enormous implementation complexity. Thaler warns that recursively verifying proofs compounds software attack surfaces, creating non-quantifiable bug risks that cannot be readily solved in the near term. Defensive Crypto Agility and Automated Bug Eradication (35:00) The panel emphasizes that the core defense against mathematical surprises is crypto agility—the architectural capacity to swap algorithms and parameter sets without rewriting application layers. Production web protocols already employ this model; Boneh cites hybrid TLS key-exchange standards like X25519MLKEM768 and messaging platforms like Signal, which combine classical elliptic curves with post-quantum lattice schemes so that compromising one layer leaves data secured by the other. Concurrently, falling intelligence costs—dropping 90% to 99% across successive model iterations—make AI an immediate defensive asset for software implementation. Because source code contains a finite number of implementation flaws, teams are shifting from periodic third-party audits to continuous, automated code rescanning at every pull request, allowing developers to design away vulnerabilities before deployment. While the secrecy of frontier AI research labs leaves external cryptographers without full visibility into automated cryptanalysis tests, the panel stresses that panic-driven migrations historically cause far more capital loss through operational error than cryptographic exploits do. Pre-standardized post-quantum backups, hybrid cryptographic agility, and continuous implementation auditing remain the proven safeguards against both quantum and automated mathematical threats.

针对以太坊研究员 Justin Drake 引发的“AI 将迅速破解密码学并迫使行业进入掩体模式”的恐慌，斯坦福密码学家 Dan Boneh 及 a16z 合伙人 Eddy Lazzarin 和 Justin Thaler 认为，底层数学假设并未被削弱，舆论混淆了 AI 数学推理与量子物理威胁；前沿 AI 针对密码假设的失败攻击反而能增强经验安全性，而加密敏捷性与 AI 辅助代码审计正在为防御端带来实质优势。 恐慌与现实：区分 AI 推理与量子计算 (0:00) 以太坊研究员 Justin Drake 近期公开发出警告，称人工智能的突破可能比预期中的量子计算机更快攻破经典密码学，建议机构进入隐藏未曝光公钥的“掩体模式”。Dan Boneh 明确反驳了这一恐慌情绪，指出当前密码学的基础现状与一两年前毫无二致。Boneh 强调，公众舆论将两种完全不同的威胁机制混为一谈：量子计算依赖物理容错硬件执行 Shor 算法等确定性手段，而 AI 威胁论则仅停留在利用通用推理能力寻找经典算法捷径的推测层面。 Justin Thaler 与 Vitalik Buterin 进一步指出，在缺乏实质威胁证据的情况下仓促行动往往适得其反。历史经验表明，用户在恐慌中匆忙进行资产迁移所导致的资金损失，远多于协议底层密码学被攻破带来的损失。此外，主要加密资产托管机构（如 Coinbase）已将隐藏未上链交易公钥作为常规操作规范，所谓“掩体模式”的防御措施在现实工业界早有落实，并非应对突发危机的应急手段。 前沿模型测试空白与经验安全验证模型 (3:00) 本次行业焦虑的导火索之一是 OpenAI 集中公布的约 700 篇前沿数学与理论计算机科学论文。尽管这批成果展示了惊人的推理进展，但 Boneh 与 Lazzarin 指出其中存在一个显著反常现象：数百篇论文中没有一篇涉及密码学，甚至未涉及不含现实攻击风险的构造性证明。业界由此推论出两种可能：要么前沿模型在密码学假设上彻底受挫，证明了密码学原语的稳健；要么实验室取得了未公开的进展。Boneh 为此公开呼吁前沿实验室说明其模型在基础密码学问题上的测试结果。 Boneh 解释称，除了一次性便签等少数特例，现代公钥密码学并不具备绝对的无条件数学证明，其安全性建立在计算复杂度假设之上（严格证明其不可破解等同于解决 P vs. NP 问题）。因此，算法的安全性完全依赖于数十年未被攻破的经验积累。Thaler 和 Lazzarin 补充认为，如果私立实验室耗费数千万美元算力让顶级模型攻击椭圆曲线离散对数（ECDLP）或格最短向量问题（SVP）却未能攻破，这种高强度测试相当于成千上万名顶级密码学家的集中审视，反而为现实世界使用的密码原语提供了前所未有的经验安全性证明。 后量子路线分歧：格密码与纯哈希方案权衡 (25:00) 在防范未来潜在数学突破的路径上，传统互联网基础设施与区块链开发界出现了分歧。主流互联网已经基本收敛至美国国家标准与技术研究院（NIST）标准化的基于格（Lattice）的公钥加密与数字签名体系。然而，部分比特币与以太坊核心开发者则试图绕过格体系，探索完全基于哈希函数（Hash-based）的签名机制，以避免引入新的代数结构假设。 Boneh 与 Thaler 详细剖析了纯哈希方案的重大技术代价。尽管哈希签名具备“若特定哈希函数失效可直接替换”的结构敏捷性，但它完全丧失了丰富的代数性质，无法原生支持门限签名与非硬化密钥推导等高级功能，且签名体积庞大、往往需要有状态管理。为了压缩哈希签名体积，以太坊研究界提出的递归 SNARK 证明方案引入了极高的工程复杂度。Thaler 警告，让一个 SNARK 验证器递归验证另一个验证器会急剧扩大代码攻击面，且学术界对递归 SNARK 的安全性界限尚未充分量化，盲目追求纯哈希并不意味着系统更安全。 加密敏捷性与防御端代码审计红利 (35:00) 专家一致认为，抵御未知数学突变的标准防御范式并非临时避险，而是推行“加密敏捷性”（Crypto Agility）——即在协议层构建模块化解耦架构，允许随时替换底层算法。Boneh 举例说明，现有的互联网标准已在实践混合部署，例如 TLS 采用的 X25519MLKEM768 混合密钥交换协议，同时使用经典椭圆曲线和后量子格算法进行加密。即使其中一种算法被 AI 攻破，通信内容仍能被另一层算法完整保护，消费级通信软件 Signal 也已部署了类似防御。 从工程攻防角度来看，Lazzarin 认为 AI 对防御者的赋能远大于攻击者。随着前沿推理模型调用成本每隔数月暴跌 90% 到 99%，获取深度审查算力的门槛已大幅降低。由于软件中的代码漏洞是有限的，工程团队如今已能在每次代码拉取请求（PR）时调用 AI 进行全自动化差分扫描与沙箱审计。在 AI 具备真正破解抽象代数问题的非多项式复杂度能力之前，低成本的自动化智能更有可能率先将现实世界中的软件实现漏洞压缩至接近于零。 专家组总结指出，理论计算机科学界的主流共识依然认为经典多项式时间内破解离散对数的算法根本不存在，AI 无法凭空发现不存在的数学捷径。当前真正的风险源于闭源前沿实验室与外部学术界之间的信息真空。Boneh 等专家建议普通用户与开发者维持现有安全习惯、切勿盲目迁移，并敦促 AI 实验室遵循负责任的披露机制，公开发布其针对标准密码学假设的压力测试数据以协同全球防御。

## Background 该内容由 Liz Harkavy、Eddy Lazzarin、Justin Thaler 与 Dan Boneh 于 2026 年 10 月 13 日通过 RSS 及播客平台发布。节目简介指出，针对近期 AI 在数学研究领域的飞跃所引发的现代加密系统破解恐慌，a16z crypto 主持人与斯坦福密码学专家共同探讨了 AI 威胁与量子计算的区别、现代密码学假设的本质，以及 AI 如何反向增强软件安全。 ## TL;DR 节目围绕安全研究员关于 AI 攻破密码学并呼吁进入“地堡模式”的舆论风波展开，深入剖析了现代加密体系的真实安全现状。专家们指出，OpenAI 的数百篇数学突破论文完全未涉及密码学破解，而密码学的安全性本就建立在计算复杂性假设与长期的攻击失败测试之上。与主要威胁特定数论结构的量子计算相比，AI 的推理能力虽然更具泛化性，但无法凭空创造出数学上根本不存在的“高效解法”。即便核心假设面临风险，行业也已具备格密码、哈希签名等多层备选方案与密码敏捷性架构，且大幅下降的智能成本正在帮助开发者提前扫除软件漏洞，盲目恐慌和草率迁移远比理论攻击更具破坏力。 ## Atmosphere & style 整场对话在冷静理性的学术思辨与尖锐的工程现实碰撞中展开，开篇以直面行业恐慌情绪定调，迅速打破了非理性的末日叙事。斯坦福密码学家 Dan Boneh 扮演着沉稳安抚的智者角色，与 a16z 的投资人及研究员展开了高密度的逻辑推演，言辞犀利却充满严谨的学术求证态度。听众能明显感受到从最初对“前沿实验室黑盒”的悬疑担忧，逐步转向对数学基石、密码敏捷性及 AI 防御潜力的深层笃定，整体氛围专业通透、逻辑扎实且令人安心。 ## Bulletin - `02:30` 针对近期 OpenAI 发布约 700 篇数学论文引发的密码学破解恐慌，斯坦福教授 Dan Boneh 指出论文并未包含任何密码学问题，呼吁公众保持冷静，当前数字基础设施安全性并无改变。 - `05:00` 现代密码学建立在计算复杂性假设之上而非绝对证明，学界认为这些问题在数学上很可能根本不存在高效解法，若前沿 AI 极限攻击失败反而会为算法安全性提供巨大背书。 - `20:00` 与针对特定数论结构的量子计算威胁（如 Shor 算法）不同，AI 的威胁更具泛化性，可能同时波及传统公钥系统与后量子候选算法，倒逼系统全面落实“密码学敏捷性”。 - `33:48` AI 带来的防御正向不对称性显著：机器智能成本年降 90% 至 99%，使得开发者能在上线前以极低成本对代码库进行全量扫描与形式化验证，推动软件逼近“零漏洞”。 ## Key takeaways - `00:00` 安全研究员 Justin Drake 的推文引发了关于 AI 攻破密码学的焦虑，但该恐慌混淆了特定的量子计算威胁与 AI 通用数学推理能力的本质区别。 - `02:30` OpenAI 集中发布的数学和计算科学成果中完全没有涉及密码学问题，顶级实验室尚未系统性披露利用大模型尝试攻击现行密码标准的测试结果。 - `05:00` 现代密码学的安全信心来自数十年来全球学者反复尝试攻破计算复杂性假设却屡屡失败的历史，而非无条件的数学证明。 - `10:00` 利用前沿大模型投入算力进行穷尽式攻击，有望打破传统“耗时 10 年积累置信度”的验证周期，大幅加速密码学分析进程。 - `15:00` 密码学假设若在数学上根本不存在多项式时间内的搞笑解法，则无论 AI 算力与推理能力多么强大，也无法无中生有制造出破解算法。 - `15:00` 盲目恐慌和仓促迁移资产造成的损失往往远超理论上的黑客攻击，保持良好安全卫生规范（如不暴露公钥）比草率采取极端行动更重要。 - `15:00` 密码学体系具备深厚的技术储备与退路，涵盖格密码、同源密码、基于编码、多元多项式以及基于哈希的签名等多种备选方案。 - `20:00` 量子计算威胁主要聚焦于 RSA 和 ECC 等具备特定代数结构的公钥体系，而 AI 的数学推理突破理论上可能对包括后量子候选方案在内的更广泛领域发起冲击。 - `25:00` 区块链社区倾向于纯哈希签名以最小化数学假设，但因签名体积庞大必须依赖复杂的递归 SNARK，反而成倍激增了代码缺陷与漏洞风险。 - `30:00` 基于格的密码学拥有出色的代数性质，能原生支持门限签名和密钥派生等高级结构，在功能扩展性上显著优于极度受限且有状态的纯哈希系统。 - `33:48` AI 模型强大的反编译能力削弱了闭源软件的安全性，倒逼系统架构向强权限隔离和能力沙箱机制转型。 - `38:43` 主流通信协议已在广泛部署密码学敏捷性架构（如 X25519MLKEM768 混合套件），即便椭圆曲线被瞬间攻破，底层流量仍受后量子算法保护。 - `38:43` 即便前沿实验室在算法破解上取得理论突破，行业既有的负责任披露机制（Responsible Disclosure）也将确保系统补丁与热更新平稳推进，而非走向秩序崩溃。 ## Detailed walkthrough ### `00:00` 恐慌的源头：Justin Drake 的推文与 AI 破解密码学的隐忧 Liz Harkavy 开门见山地抛出了近期在加密与安全社区引爆的一场巨大争论。安全研究员 Justin Drake 发布了一条警告推文，呼吁加密行业与各大机构做好进入所谓的“地堡模式”（bunker mode）准备，考虑转移资金以应对前所未有的威胁。这股焦虑的核心在于：人们担忧前沿人工智能（AI）在数学推理领域的突飞猛进，可能会先于量子计算彻底攻破现代密码学系统。在过去，密码学界讨论安全防御体系演进时，通常以量子计算机为主要参照物，但这次由 OpenAI 最新发布的一批研究论文以及在多项未解数学难题上的突破，引发了全新的恐慌。 面对外界不断发酵的焦虑，来自斯坦福大学的密码学教授 Dan Boneh 率先给这场讨论降温，安抚大家保持理智：“Everybody calm down. Don't panic. Calm down. The world today is the same as it was a year ago, two years ago.”他指出，大众目前将两件完全不同的事情混为一谈了：一件事是讨论已久的“量子计算对密码学的威胁”，而另一件事则是最近突然冒出来的全新担忧——“我们的人工智能朋友们是否会凭借其‘超强智能’去攻击那些我们原本认为坚不可摧的密码系统”。这两者在机理和性质上有着本质区别，必须彻底厘清。 ```mermaid flowchart TD accTitle: AI破译密码学争论的起源 accDescr: 展示从OpenAI发布数学成果到引发加密行业恐慌的连锁反应逻辑流 subgraph Trigger["触发事件"] A["OpenAI 发布约 700 篇论文<br/>攻克多项数学/计算科学未解难题"] B["Justin Drake 发布推文预警<br/>建议行业开启『地堡模式』(Bunker Mode)"] end subgraph Panic["行业认知偏差"] C["担忧 AI 攻破密码学的速度<br/>将超过量子计算"] D["大型机构考虑转移资金避险"] end subgraph Reality["Dan Boneh 的澄清与定调"] E["世界今天与一两年前毫无区别，无需恐慌"] F["严格区分：量子威胁 vs AI 数学推理威胁"] end A --> B B --> C C --> D D --> E E --> F ``` ### `02:30` 700篇数学论文的“缺席真相”：前沿实验室为何不测密码学？ Dan Boneh 详细梳理了引发这次恐慌的直接诱因：OpenAI 等团队在网上集中发布了大约 700 篇论文，展示了 AI 在数学和计算机科学领域取得的惊人突破。Dan Boneh 坦言自己的邮箱瞬间被各方询问塞爆，大家都在迫切寻求密码学家的专业研判。他自己怀着极其震撼的心情逐一查阅了这批成果中取得进展的所有问题清单，但在通读全部清单后，一个极为刺眼的反常现象引起了他的注意：“Wow, this is incredible progress in mathematics, in computer science. But there are no questions here on cryptography.” 这批论文不仅完全没有涉及实际应用中的攻击，甚至连理论密码学（Theoretical Cryptography）的正面构造、全新密码系统设计等与现实攻击无关的纯学术问题也只字未提。Dan Boneh 对此向顶级实验室发出了公开呼吁：“I think one of the things that I would maybe like to start with is a call to the frontier labs to please tell us what have you done with trying to use these models to answer basic questions in cryptography.”他最想知道的是，这些实验室到底有没有用这些前沿模型尝试去攻破现行已标准化、已在全球部署的密码学方案。 Eddy Lazzarin 对此展开了深入的二元推演。他指出，OpenAI 论文涵盖的许多数学分支虽然不叫密码学，但在逻辑推导和技术工具上与密码学高度近邻。这种整体缺席非常引人深思，其背后必然是两种截然不同的可能性之一： 1. **密码学具有独特的坚固性**：如果实验室确实尝试过在理论或应用密码学上寻找突破，但 AI 模型表现极其糟糕、什么都没发现，这就意味着密码学在抵抗 AI 推理方面拥有超出常态的鲁棒性，这本身就是极具价值的重磅利好。 2. **实验室有所保留**：如果实验室实际上取得了突破但隐匿不发，甚至发现了值得担忧的攻击手段，那行业就必须立刻提高警惕并弄清楚内幕。 ### `05:00` 密码学的基石：复杂性假设与“被攻击失败”赋予的信心 针对“现行密码标准能否被人类或 AI 攻破”的疑问，Dan Boneh 指出，现代密码学的根基并非无条件的数学证明，而是建立在计算复杂性理论的“假设”之上的。因为在计算机科学中，著名的 P/NP 问题尚未解决，在该问题未有突破之前，没有任何人能够从数学上绝对证明某些密码问题是坚不可摧的；而 OpenAI 这次发布的成果，距离解决 P/NP 问题还差得十万八千里。 现代加密体系完全依赖于少数经典困难问题的计算假设： - **椭圆曲线离散对数问题（Elliptic Curve Discrete Logarithm Problem）** - **格上最短向量问题（Shortest Vector Problem in Lattices）** 在长达数十年的时间里，全球无数数学家和密码学者尝试攻破这些假设，文献库中堆满了失败的尝试、部分的进展与局部的弱化，而这种屡攻不破的历史正是大家信任这些算法的底气。针对 AI 这个试图寻找人类未曾察觉之漏洞的新选手，Dan Boneh 直言这与过去几十年中某个天才数学家突然灵光一闪没有任何本质不同：“The fact that people try to break them and fail gives us more confidence.” Dan Boneh 与 Justin Thaler 进一步指出，前沿实验室让顶级模型去猛攻现有的密码学假设不仅不是灾难，反而是一次千载难逢的“压力测试”良机： - **全面攻击失败即是巨大背书**：如果最强大的 AI 模型在经过严密测试后依然无法撼动核心假设，这将给整个密码学界注入无与伦比的安全信心。 - **即使削减安全裕度也是重大利好**：Dan 强调，就算模型最终将某个在实际中广泛使用的密码学问题的安全强度“削减了 10 个比特的安全等级（shave off 10 bits of security）”，这也是极好的成果，说明该问题在极限制约下依然极其坚挺，完全处于安全掌控之中。 - **用 AI 寻找更强的理论证据**：Justin Thaler 补充道，目前对很多格密码（Lattice-based cryptography）的信心来源于其“最坏情况与平均情况一样困难”的理论性质；未来学界甚至可以反向利用这些高级 AI 模型去寻找计算复杂性理论层面的深层证明，从数学结构上给出这些问题缺乏高效算法的更强有力证据，而不再仅仅依靠“人类尝试了几十年都没找出来”这种经验主义的信心。 ### `10:00` 密码学假设的“时间验证”机制与 AI 带来的认知加速 Liz Harkavy 指出，讨论源于一条针对加密货币钱包及 ECDSA（椭圆曲线数字签名算法）可能被攻破的推文，但这背后的影响绝不仅限于加密货币领域，而是关乎更广泛的网络安全底座。对此，Dan Boneh 详细拆解了底层逻辑：现实世界中的密码学系统依赖于特定的数学难题假设，例如椭圆曲线离散对数（Elliptic Curve Discrete Log）。如果该假设被证实并不像预想的那么坚固，甚至出现了切实可行的攻击算法，后果固然极其严重，但整个行业绝非束手无策。美国国家标准与技术研究院（NIST）早已在推进多种新型公钥加密体制的标准化工作，学术界和工业界拥有充足的备用替代方案。当前真正的症结在于“认知的真空”：大家不知道攻破这些假设究竟属于迫在眉睫的极高优先级事件，还是近期根本无需担忧的问题。 ```mermaid flowchart TD accTitle: 密码学安全验证机制的演进对比 accDescr: 对比传统通过数十年学术时间积累信心的机制，与未来利用前沿大模型高强度测试快速建立置信度的新范式。 subgraph Traditional["传统验证路径 (耗时约 10 年)"] A["提出数学假设与构建算法"] --> B["公开发布并交由学术界审视"] B --> C["密码学家自发测试与尝试破解"] C --> D["历经长时间无人攻破，建立安全置信度"] end subgraph AIAccelerated["AI 驱动验证路径 (前沿实验室范式)"] E["前沿 AI 模型 (顶配推理/数学能力)"] --> F["集中算力轰击 (如投入数千万美元极限攻击)"] F --> G{"是否发现有效攻击算法？"} G -- "否" --> H["远超十年积累的高确定性安全置信度"] G -- "是" --> I["快速倒逼迁移至备选密码学方案"] end ``` Eddy Lazzarin 随后将这种困境提炼为一个深刻的方法论转变：在无法从数学上严格证明某个问题就是不可解的情况下，人类密码学本质上一直在“用时间换置信度”。传统模式下，密码学家提出一套方案后公之于众，然后大家开始漫长地等待，依靠全球专家零散的注意力和自发审查；如果一套系统历经十年以上依然屹立不倒，社会便对其产生安全信心。然而，AI 数学能力的突飞猛进打破了这一时间节奏，在 AI 的进化速度与前沿实验室对外披露的信息之间形成了一条明显的断层。Dan Boneh 赞同并强调，过去一种新假设提出后往往需要“苦等 10 年”才能建立起投入实用的信任，而如今前沿模型完全有能力极大压缩这一周期，成为加速密码学分析的非凡工具。 Eddy Lazzarin 进一步描绘了未来的安全验证图景：前沿实验室完全可以动用最顶尖、最无限制且具备顶尖网络安全能力的大模型，投入数千万美元让其进行穷尽式攻击，最终获得的置信度可能远胜传统机制十年的检验。但当下的核心矛盾在于信息不对称——这些最强模型目前仅掌握在少数实验室手中，普通公众与研究界尚无法获知其极限测试的真实边界。 - 密码学体系建立在若干计算复杂度假设之上（如椭圆曲线离散对数问题），由于缺乏绝对的不可解数学证明，行业以往极度依赖“多年未被攻破”的历史来积累信任。 - 传统流程中，学术界和公众依赖全球密码学者稳定的背景关注度（Background Rate of Attention）和自发优先级排序来排查漏洞，系统从提出到成熟部署往往耗时长达 10 年左右。 - 前沿 AI 实验室凭借顶尖模型和高昂算力（如单次投入 2000 万至 5000 万美元进行专项暴力破解测试），具备以前所未有的速度确立系统安全性或提前暴露隐患的潜力。 - 目前最大的痛点在于信息鸿沟：拥有顶级算力和模型能力的研究机构尚未通过传统学术渠道系统性公开其关于底层数学假设的研究全貌。 > “在过去，当有人提出一个假设并在其基础上构建系统时，我们必须等待大约 10 年才能将该系统投入部署以获取信心，给人们足够的时间去分析这个假设。而现在，突然之间，我们可以使用这些模型极大地加速这一进程。” —— Dan Boneh > “实验室完全可以说：我们动用了最顶尖、完全不受限制、网络攻防能力最强的模型，让它火力全开进行极限测试，并且花费了 2000 万甚至 5000 万美元试图攻破这个方案；而测试结束后，我们对该方案所获得的信心，可能比通过传统流程历经十年所能获得的还要多。” —— Eddy Lazzarin --- ### `15:00` 恐慌情绪反思：不存在的算法、巨鲸避难所与防御性实践 面对普通用户对技术安全的恐慌，Dan Boneh 给出了非常明确的定心丸：“世界今天和一周前、一年前没有任何不同。”他强调，在关于标准密码系统的最新实质性研究成果出炉之前，技术基础设施没有发生任何改变，普通用户完全无需恐慌，应保持冷静并照常使用现有系统。Eddy Lazzarin 补充分析指出，外界这几天的剧烈反应并非源于任何关于密码学被实质攻破的新证据，而更像是对 OpenAI 发布的数学评测成果的一种间接投射——虽然 AI 的数学能力令人惊叹，但其迅猛进展早在硅谷的预期之中，大家并未掌握任何表明椭圆曲线或特定假设安全性下降的确凿数据。Dan 进一步罗列了密码学储备方案：公钥密码学并不单一寄生于椭圆曲线或格密码（Lattices），行业还储备了同源密码（Isogenies）、基于编码的系统（Code-based Systems）、多元多项式系统（Multivariate Polynomial-based Systems）以及基于哈希的签名（Hash-based Signatures）等，随时具备退路和重建能力。 Justin Thaler 随后从计算复杂性的本质剖析了恐慌的逻辑漏洞。密码学界普遍认为这些底层难题“不存在高效解法”，这与“存在解法但人类太笨找不到”有着本质区别。如果某种算法从数学原理上根本不存在，那么无论 AI 变得多么聪明，也不可能凭空找出一个不存在的算法。针对社交媒体上的争议源头，Justin 梳理了事件脉络：最初是以太坊基金会的 Justin Drake 发推警告椭圆曲线可能在未来几个月内面临完全失效的风险，并建议以太坊上的大型冷钱包进入所谓的“避难所模式”（Bunker Mode），即确保公钥不在链上公开暴露；随后 Vitalik Buterin 也发布了一条语气相对缓和、但仍在推测 AI 潜在攻击能力的推文。 讨论中大家特别提到了 Vitalik 推文里的一个细节：Vitalik 自己因“搞砸了的迁移操作”所损失的个人资产，甚至比他遭遇的所有黑客攻击损失总和还要多。Justin Thaler 借此指出人类心理的一大弱点：人们极易被破坏力巨大、带有末日色彩的“长尾风险”所支配，反而忽视了平凡却无处不在的软件缺陷（Bugs）和人为操作失误。仓促采取行动往往适得其反，“当下你能做的最糟糕的事可能就是轻举妄动，你应该什么都别做。”况且，Justin Drake 所提出的“避难所模式”建议（如不直接暴露公钥）本就是 Coinbase 等大型合规托管机构早已在严格执行的日常安全规范（Good Hygiene），与 AI 或量子威胁的出现并无直接因果关系。整场讨论明确传达出一个共识：密码学界早在未雨绸缪，防御与迁移路径始终存在，盲目恐慌与草率变更往往比理论上的算法威胁更具毁灭性。 - 密码学安全的理论基石在于这些难题很可能根本不存在多项式时间内的“高效解法”（Efficient Algorithm），AI 的高超智力无法凭空创造出数学上不存在的工具。 - 密码学体系拥有深厚的技术纵深，可供迁移的备用数学范式涵盖： - 基于格的密码学（Lattice-based Cryptography） - 基于同源的密码学（Isogeny-based Cryptography） - 基于纠错码的密码学（Code-based Cryptography） - 多元多项式密码学（Multivariate Polynomial-based Cryptography） - 基于哈希的签名技术（Hash-based Signatures） - 舆论风波由 Justin Drake 警示椭圆曲线风险并倡导大型钱包采取“避难所模式”引发，Vitalik Buterin 随后跟进发文讨论，但 Vitalik 亦坦承其因资产迁移失误造成的损失远超黑客盗窃。 - Coinbase 等头部加密机构公开表示，其内部早已落实了不公开暴露公钥等一系列防范措施，此类操作属于行业既有的通用安全规范。 > “在有关我们标准密码系统的新情况出现之前，什么都没有改变；继续照常使用这些系统，当我们获知新信息时，要么我们会更加笃定，要么我们就必须采取应对措施，但在掌握更多信息之前，一切照旧，所以请不要恐慌，保持冷静。” —— Dan Boneh > “我们普遍认为这些问题不存在高效的算法，这并不是说我们认为可能存在该算法而人类只是不够聪明去找到它；我们认为它根本就不存在。如果它根本不存在，那么 AI 有多聪明都无所谓，它无法找到一个根本不存在的算法。” —— Justin Thaler > “在 Vitalik 的推文中，他甚至提到，他个人在搞砸了的迁移操作中所损失的个人资产，比他在所有黑客攻击中损失的还要多。所以我认为，我们人类往往很难妥善应对那些极其吓人、并且在心理上很容易主导我们思绪的长尾风险……眼下你可能做出的最糟糕的事情就是轻举妄动，你现在应该按兵不动。” —— Justin Thaler ### `20:00` 反驳“地堡心态”与 AI 对比量子计算的威胁范围 面对有关 AI 可能攻破现代密码学的恐慌言论，嘉宾们首先对所谓的极端应对措施提出了质疑。某些观点（例如 Justin Drake 在社交媒体上的言论）呼吁行业应当立刻进入“地堡模式”（bunker mode）严加防范。然而 Eddy Lazzarin 指出，这种建议对于普通人来说不仅缺乏可操作性，甚至伴随极高风险；而对于真正应该承担此类风险的机构而言，相关防御举措实际上早已落实。大家一致认为，眼下最急需的不是盲目恐慌，而是获取更多真实有效的信息以调整策略。 主持人 Liz Harkavy 提及，被指出可能被先进 AI 攻破的密码学类型，实际上与量子计算机所威胁的领域高度重合。Eddy Lazzarin 强调，人们之所以容易将两者混为一谈，是因为 Justin Drake 重点表达了对椭圆曲线密码学（ECC）的担忧，而密码学界因为防范量子威胁，早就在评估 ECC 的脆弱性并推进应对方案。Justin Thaler 更是尖锐地指出其逻辑脱节： > “If what Justin was warning about happens in the timelines he mentioned, it's a cataclysmic event for all digital infrastructure security throughout the entire world.” 在短短几年内，全球数字基础设施根本不可能彻底弃用 ECC；如果这一体系在极短时间内崩塌，整个世界的安全防线都将瓦解，此时单纯强调所谓的“区块链安全卫生规范”（blockchain hygiene）显得极其不协调。 Dan Boneh 进一步分析了量子计算与 AI 威胁本质上的不同： - **量子威胁具有特异性**：量子算法（如 Shor 算法）主要破坏基于数论结构的问题，集中在 RSA 和椭圆曲线密码学（ECC）。 - **AI 威胁具有更广泛的泛化性**：AI 不受特定代数结构限制，它同样有可能去攻击并削弱后量子密码学（PQC）候选算法。 - **应对核心原则是“密码学敏捷性”（Crypto Agility）**：该概念已提出十余年，其核心是构建能够迅速在不同加密设计方案间切换的系统，一旦现有底层假设被打破，系统能立即迁移到安全架构。 ```mermaid flowchart TD accTitle: Comparison of Quantum and AI Cryptographic Threats accDescr: Diagram showing quantum computing attacking specific math while AI threatens a broader set of cryptosystems. subgraph Threats["威胁来源"] Q["量子计算威胁"] AI["AI 威胁 (数学推理突破)"] end subgraph Targets["攻击目标与应对"] ECC["传统公钥加密 (ECC / RSA)"] PQC["后量子候选方案 (格密码 / 哈希)"] CA["防御策略: 密码学敏捷性 (Crypto Agility)"] end Q -->|"针对数论问题攻破"| ECC AI -->|"潜在威胁"| ECC AI -->|"潜在削弱或攻破"| PQC ECC -.->|"迁移驱动"| CA PQC -.->|"动态切换"| CA ``` --- ### `25:00` 后量子路线之争：格密码 vs. 纯哈希与 SNARK 递归的权衡 探讨延伸到了各种密码学底层数学假设的安全性差异。互联网通用标准已经基本尘埃落定：主流网络基础设施全面拥抱基于格（Lattice-based）的密码系统用于秘钥交换和数字签名。然而，在区块链领域（特别是比特币与以太坊社区），关于选择格密码还是纯哈希密码（Hash-based）依然存在激烈辩论。 Dan Boneh 说明了区块链社区更青睐哈希签名机制的两个核心理由： 1. **更高的敏捷性与通用框架安全**：哈希签名方案的数学框架本身是严密可靠的。如果某一个具体哈希函数被发现存在弱点，开发人员只需直接替换为一个新的哈希函数，整体系统依然成立。反之，格密码与 ECC 类似，依赖于某些核心数学难题的硬度假设，一旦其底层格问题被破解，整个机制将全面崩溃，没有任何后退空间。 2. **假设最小化（Minimizing Assumptions）**：区块链的核心运作（如 Merkle 树）本来就必须依赖哈希函数的抗碰撞假设。如果签名也采用纯哈希机制，系统就不需要引入额外的代数难题假设；若是混合使用哈希与格密码，任何一方被攻破都会危及整个区块链的安全。目前比特币核心开发者与以太坊基金会不少研究员都对彻底摆脱 ECC 假设抱有浓厚兴趣。 针对区块链能否完全依赖哈希函数，Justin Thaler 提出了冷思考与深层权衡： - **通用能力受限**：仅靠哈希函数无法实现高效的公钥加密与秘钥交换。 - **签名体积庞大**：纯哈希签名的数据体量过大，以太坊社区设想的解决方案是通过“递归 SNARK”（SNARK recursion）进行状态压缩（即用零知识证明去证明一批签名，再用更高层的证明去验证底层证明）。 - **代码复杂度与漏洞风险**：这种嵌套证明系统极其复杂，系统暴露的 Bug 攻击面成倍激增。Thaler 指出，虽然人们寄希望于 AI 帮助开发者发现并修复代码漏洞，但全自动修复如此复杂的代码本身就是一个极其艰难的任务。因此，纯哈希结合递归证明的技术路线是否能在整体安全性上击败格密码，仍是一个高度复杂的工程难题。 ### `30:00` 格密码与哈希密码的技术权衡及 AI 带来的安全信心 Justin Thaler 指出，仅仅依赖哈希函数会放大某些系统性风险，而且业内目前对 SNARK 递归（snark recursion）的安全性理解还远远不够。密码学中充斥着难以量化的风险，当外界指责格密码可能被攻破时，哈希方案和递归证明同样存在未知盲区，因此在公共讨论中权衡这些假设往往令人沮丧。 Dan Boneh 补充强调了基于格（lattice-based）与基于哈希（hash-based）的系统之间的本质差异：格密码系统拥有远比哈希系统优越的代数属性，这也是为什么许多密码学家倾向于格密码。格系统能够天然支持门限签名（threshold signatures）、非硬化密钥派生（non-hardened key derivation）等高级应用；而哈希签名体系不仅体积极大、往往有状态（stateful），在工程落地上面临重重困难，且缺乏可供构建复杂应用的代数结构。Dan Boneh 略带遗憾地表示：“作为一名密码学家，老实说，如果我们最终使用的是基于格的方案，我会感到非常高兴，因为那给了我们更多发挥和构建有趣结构的空间。”尽管哈希系统的极度受限在某种程度上带来了额外的心理安全感，但也牺牲了系统的功能扩展性。 谈及外界对 AI 破解密码学的恐慌，Liz Harkavy 总结道：是否存在攻破这些密码学假设的高效算法本身并非定论；但如果真存在这种算法，AI 的跃进无疑会大幅压缩人类找到它的时间表。Eddy Lazzarin 则提出了一个颠覆性的视角：如果各大顶尖前沿实验室（AI labs）投入海量算力、时间和资金尝试攻破某些密码学方案后宣布“我们未能破解”，这实际上应当让人产生比过去任何时候都更强的安全信心。正如 Eddy Lazzarin 所强调的：“如果你真如许多人一样相信，这些模型现在或不久后就能匹敌甚至超越绝大多数研究这些系统的专家，那么得知有相当于 10 万名专家级数学家或密码学家审查过某个方案，应该会让你比以往任何时候都更加自信。” ```mermaid flowchart TD accTitle: 格密码与哈希密码特性对比 accDescr: 对比格密码系统和哈希密码系统的代数属性、应用支持以及安全性与约束条件 subgraph Lattices ["基于格的密码系统 (Lattice-based)"] L1["支持丰富的代数结构"] L2["支持门限签名、非硬化密钥派生"] L3["无状态签名、尺寸更紧凑"] L4["为构建高级密码学应用提供广阔空间"] end subgraph Hashes ["基于哈希的密码系统 (Hash-based)"] H1["几乎没有代数属性可供利用"] H2["签名尺寸巨大、往往有状态 (Stateful)"] H3["约束极为严格，但带来纯粹的保守安全感"] H4["在复杂应用构建中难以施展"] end Lattices -.->|"设计取舍：功能性与假设权衡"| Hashes ``` --- ### `33:48` AI 赋能的防御新范式：逼近“零漏洞”与软件安全重塑 讨论转向初创企业与开发者该如何应对技术演进。Eddy Lazzarin 提到，当前软件设计的根本假设正在发生剧变。随着模型反编译能力的突飞猛进，“闭源软件基本上在上周就已经宣告死亡了”。同时，AI 智能体（agents）具备自主执行发散性分支任务（unbounded side quests）的特性，这迫使工程界重新审视安全边界、沙箱机制以及基于能力的权限管理体系。 Dan Boneh 指出，AI 能力的爆发其实是赠予初创公司和成熟软件厂商的一份厚礼。过去密码系统最容易遭受攻击的时刻，恰恰是系统刚宣布即将部署或已部署上线之时——此时它才引来密码学界的审视，但为时已晚。如今，开发者可以在发版之前利用先进的大模型对系统架构和通用代码进行深度漏洞分析。Dan Boneh 预测，随着工具链的普及，未来的代码若未通过模型的形式化安全校验将根本无法发布，全球软件和密码系统的整体质量将迎来飞跃。 针对成本与安全攻防的不对称性，Eddy Lazzarin 分析指出，像 Claude 3.5 Haiku 等新模型的推出，让单位算力的智能成本相比一年前暴跌了 90% 到 99%。如果软件中的潜在 Bug 总数是有限的，那么智能成本的几何级下降意味着人类正在以极低成本逼近“零漏洞”的理想状态。Eddy Lazzarin 直言，网络安全并非对抗双方单纯比拼智力、胜者通吃的无解战场：“这依赖于漏洞的存在。而漏洞是可以被消除、被设计规避、被缓解的。我们用来缓解漏洞的主要资源——也就是机器智能——每隔几个月就变得更加便宜。”目前许多先锋企业每当模型升级或代码迭代时，都会全量重新扫描代码库；如何更高效、增量化地实现全自动软件审计，正成为巨大的创业与科研机遇。 - 闭源架构在强大的 AI 反编译能力面前逐渐透明，权限隔离与能力沙箱成为刚需。 - 智能成本以年化 90%–99% 的幅度锐减，将代码审计推向持续化、全量化验证。 - 软件防御呈现正向不对称性：消除既有漏洞即可从根本上剥夺攻击面，净提升全球网络安全水平。 --- ### `38:43` 假想危机应对：密码敏捷性与负责任披露 Liz Harkavy 提出了一个假想情境：如果某家 AI 实验室明天真的动用超算破解了椭圆曲线密码学（ECC），世界将会怎样？ Dan Boneh 明确表示，人类早已为此准备好了路线图——直接迁移到后量子密码学（PQC）与格密码系统，这一进程在现实中早已启动。如今许多核心网络通信协议已经部署了“密码敏捷性”（cryptographic agility）架构，同时使用两套算法进行混合加密。例如，主流 TLS 密钥交换协议中广泛应用的混合套件 `X25519MLKEM768`（即 X25519 与 ML-KEM-768 的组合）以及 Signal 协议的更新，都同时基于椭圆曲线和格系统运行。哪怕椭圆曲线在明天清晨彻底失效，流量依然受到格密码底座的严密保护。即使未来实验室声称连格密码也被破解，密码学界也拥有备用候选方案去启动新的标准化流程，这仅意味着更多的工程迁移压力与时间紧迫感，而非秩序的彻底终结。 最后，Eddy Lazzarin 和 Dan Boneh 强调了行业规范与负责任披露（responsible disclosure）机制。如果实验室取得了突破，绝不会草率公开发布破坏性攻击方案，而是应当遵循既有的安全行业流程：私下向行业组织、标准化机构和政府通报，联合制定补丁与迁移方案，推动全网客户端与服务端有序热更新。Dan Boneh 总结道：“我们大致清楚该往何处去，这只是意味着更多的工作，或许还有更为紧迫的排期。”既然存在清晰的应急流程与成熟的后备加密学组件，公众和从业者便无须陷入非理性的恐慌之中。 ## Notable quotes > `33:48` 漏洞是可以被消除、被设计规避、被缓解的。我们用来缓解漏洞的主要资源——也就是机器智能——每隔几个月就变得更加便宜。 — Eddy Lazzarin > `15:00` 我们人类往往很难妥善应对那些极其吓人、并且在心理上很容易主导我们思绪的长尾风险……眼下你可能做出的最糟糕的事情就是轻举妄动，你现在应该按兵不动。 — Justin Thaler > `15:00` 在有关我们标准密码系统的新情况出现之前，什么都没有改变；继续照常使用这些系统，当我们获知新信息时，要么我们会更加笃定，要么我们就必须采取应对措施，但在掌握更多信息之前，一切照旧，所以请不要恐慌，保持冷静。 — Dan Boneh > `30:00` 作为一名密码学家，老实说，如果我们最终使用的是基于格的方案，我会感到非常高兴，因为那给了我们更多发挥和构建有趣结构的空间。 — Dan Boneh ## Mentioned Liz Harkavy, Eddy Lazzarin, Justin Thaler, Dan Boneh, Justin Drake, Vitalik Buterin, OpenAI, Stanford University, a16z crypto, NIST, Coinbase, Claude 3.5 Haiku, Signal, X25519MLKEM768, P/NP 问题, ECDSA, Shor 算法 ## Video description Could AI break the cryptography protecting everything from crypto wallets and banking to private messages? Recent advances in AI-driven mathematical research have sparked new warnings about the security of today's encryption systems, but how much of the concern is supported by evidence? a16z crypto's Liz Harkavy is joined by Stanford cryptographer Dan Boneh, a16z crypto General Partner Eddy Lazzarin, and Research Partner Justin Thaler to separate what we know from what remains speculation. They explain why modern cryptography relies on mathematical assumptions, what OpenAI's recent results do and don't demonstrate, and how the potential threat from AI differs from quantum computing. They also discuss why existing security practices and cryptographic alternatives offer reasons for confidence, the importance of building systems that can adapt if an assumption fails, and how AI could ultimately help researchers and developers make software more secure. [Source](https://mgln.ai/e/1344/afp-848985-injected.calisto.simplecastaudio.com/3f86df7b-51c6-4101-88a2-550dba782de8/episodes/ded4b58e-4303-418c-807e-fffaeb59a92c/audio/128/default.mp3?aid=rss_feed&awCollectionId=3f86df7b-51c6-4101-88a2-550dba782de8&awEpisodeId=ded4b58e-4303-418c-807e-fffaeb59a92c&feed=JGE3yC0V)

[33:48] Eddy Lazzarin: 漏洞是可以被消除、被设计规避、被缓解的。我们用来缓解漏洞的主要资源——也就是机器智能——每隔几个月就变得更加便宜。 [15:00] Justin Thaler: 我们人类往往很难妥善应对那些极其吓人、并且在心理上很容易主导我们思绪的长尾风险……眼下你可能做出的最糟糕的事情就是轻举妄动，你现在应该按兵不动。 [15:00] Dan Boneh: 在有关我们标准密码系统的新情况出现之前，什么都没有改变；继续照常使用这些系统，当我们获知新信息时，要么我们会更加笃定，要么我们就必须采取应对措施，但在掌握更多信息之前，一切照旧，所以请不要恐慌，保持冷静。 [30:00] Dan Boneh: 作为一名密码学家，老实说，如果我们最终使用的是基于格的方案，我会感到非常高兴，因为那给了我们更多发挥和构建有趣结构的空间。

[22:30] Dan Boneh: Crypto agility is in some sense our friend for defending against the unexpected. [25:00] Dan Boneh: If for some reason it turns out that the core lattice problems are not as hard as we thought, the whole mechanism collapses and we have no recovery.

[0:00] All of a sudden, a new threat emerged in the world of cryptography, which is whether our AI friends can actually attack cryptosystems that we thought were secure. The fear here is that the AI labs could break them if they are breakable. The fact that people try to break them and fail gives us more confidence. NIST is already standardizing many other types of public key systems that we can switch to. So if it turns out one of our assumptions is broken, we have backups. Are there startup opportunities here and where a new company might be able to come in and help? to separate fact from speculation. They discuss what the recent breakthroughs actually tell us, how AI threats differ from quantum computing, and why there's no reason to panic today. They also explained how AI could ultimately help make cryptography and software more secure. - Hey, welcome to our show today. I'm Liz. I'm joined here with Dan Bonet, a professor at Stanford, and Eddie Lazarin and Justin Thaler, two members of our team here at E16Z. We're here to talk about a pretty big discussion that's going on right now that's been kicked off yesterday by a tweet that a security researcher, Justin Drake, put out warning the crypto industry to start preparing for what he's calling bunker mode, specifically around this worry that the advances in AI are going to cause a breakthrough or breaking of cryptography faster even than a quantum computer might, which is normally the basis of the discussion that we have when we think about modern day cryptography and what the state of the art looks like. big institutions to start thinking about moving funds and start thinking about this. And a lot of that has been kicked off by some papers that OpenAI put out and different kind of breakthroughs they had in mathematical problems that were previously unsolved and how that relates back to cryptography. And so, Dan, I don't know if you want to kind of summarize what those breakthroughs were or what those papers put out and how that kind of kicked this off. So let's see. I guess the first thing I should say is, you know, everybody calm down. Don't panic. Calm down. The world today is the same as it was a year ago, two years ago. That's the first message. Now, I guess before we get started, I just want to make sure people are on the same page in that there are kind of two stories that are getting entangled. And I think we should first disentangle them. There is this long going conversation on the threat of quantum computing to cryptography. This is not what this is about. Here, there's all of a sudden a new threat that's kind of emerged in the world of cryptography. which is whether our AI friends can actually attack crypto systems that we thought were secure using their super intelligence and so on. So I guess the backdrop to all this is that around 700 papers were put up online presenting enormous progress in mathematics and computer science. I can't say enough about how impressed I am with the results that have been put on online. It's really quite remarkable to see all the progress. My kind of inbox blew up when this came online. Everybody was asking for opinions and so on. So I started going through the list of problems that progress was made on. And as I finished the list, the thing that kind of stuck in my mind is that, wow, this is incredible progress in mathematics, in computer science. But there are no questions here on cryptography. Yeah, not even on theoretical cryptography, right? I mean, in principle, there are lots of really interesting open problems in constructing positive development in cryptography, constructing new cryptosystems, maybe even in a theory, things that wouldn't directly be relevant to the real world. None of those questions were in the list of 700 problems that were posted. So you might wonder, well, does that mean the models are really bad at cryptography? We don't know. And so I think one of the things that I would maybe like to start with is a call to the Frontier Labs to please tell us what have you done with trying to use these models to answer basic questions in cryptography. I guess the real question is, what is the status, for example, on actually attacking standardized and deployed crypto? Have the Frontier Labs tried any of their models? specific to cryptography, but rather that just the fact that they had massive breakthroughs in any sort of mathematics means there is likely a breakthrough in cryptography. It was the OpenAI drop had a variety of papers across hundreds of different topics. [5:00] hundreds of different topics. And many of those topics, although weren't specifically about cryptography, were adjacent to cryptography, I'd say, in the loose sense that they involve progress using similar techniques and mathematical reasoning that one would use to make progress in cryptography. So their absence is a little bit conspicuous, right, is what Dan is saying. And it's something that you have to consider the explanations for. On the one hand, if the reason for the omission is that AI models are notably bad and couldn't find anything, and that cryptography is particularly robust for some reason, that in itself would be very interesting, right? In other words, if the lab's attempted to make progress in theoretical or applied cryptography and didn't really find anything worth discovering, that would be in itself very interesting. If, on the other hand, they did make progress... And there could have been a lot to share, but there are reasons that what they could have shared would be concerning. then that would be very interesting to know as well. And so I just I want to go go back to what you kind of kicked off with here, which is we kind of breezed over this is, It is not a given that the current kind of like cryptographic standards we use are human breakable. We just don't know if they are or not today. And so the fear here is that the AI labs could be, break them if they are breakable? Yeah, I think this is actually a really important point in that all of cryptography is based on complexity assumptions. Yeah, it's based on assumptions. We have to assume that certain problems are hard. The reason we can't prove that those problems are hard is because that's related to a famous open problem in computer science called the P versus NP problem. In some sense, we first have to resolve that problem before we can actually argue that cryptography, the certain cryptographic problems really, really are hard. And so since that we're very far away from that, none of the problems that were posted this week come even close to resolving the P versus NP problem. We still have to keep making assumptions in cryptography. So the assumptions are that certain problems are hard. Let's say elliptic curve discrete log. Let's say shortest vector and lattices. that we know and love and we build cryptosystems from. A lot of people have worked over the years on trying to break those assumptions. And in fact, there's a huge body of literature on failed attempts, on partial attempts, partially successful attempts. So this is a very active area. And so far, all these problems remain secure and our cryptosystems are based on those problems. But now there's a new player in town. Somebody else could try to come up with other ways to solve these problems. And maybe they'll see something that. us humans have not seen. That's certainly a possibility. But again, I need to stress, this is not a new possibility. Two years ago, five years ago, 10 years ago, you know, a clever human could have come up with a new attack that nobody has seen before and break some cryptographic assumptions. Cryptography is sort of built on assumptions. We realize things are built on assumptions that could end up not being as strong as we expect. And so it's wonderful that people try. This is actually how we gain confidence in our assumptions. break them and fail gives us more confidence. So in fact, I would say this would be an extremely positive development if the labs tried their best models at some of our basic cryptographic assumptions. The models fail to break them. the labs say that they fail to break them, that will give us tremendous confidence that our assumptions are valid. And even if they shave off a little bit of security, let's say they shave off 10 bits of security from one of the problems that we use in practice, that's great. That's wonderful for us to know the fact that all they could do is shave off 10 bits of security. is actually already very strong evidence that the assumptions are actually worthwhile using. Another thing that would be nice for the labs to try is I think we can hope to use these models to give much stronger evidence than we currently have that these problems are hard. By which I mean, for a lot of these problems are evidence right now, while we have things like, you know, we know they're just as hard in the worst case as the average case, which, you know, for some of them, these lattice problems, which is helpful. There are complexity theoretic results you could hope to show that would give more evidence, more confidence in the intractability of these problems, that they have no efficient algorithms. I'd say that, you know, Dan is totally right. Like most of the reason for, you know, today's cryptography that we have confidence, you know, these problems actually are intractable is, you know, people have just tried for decades and decades and haven't come up with any good algorithms. But we can hope for other kinds of evidence. Thank you. [10:00] And those are like pure math questions that these frontier labs could be turning their models on. The specific tweet that we're referencing was about crypto wallets and how the impact of this on on crypto. But there is a much broader implication of breaking like ECDSA. And so I don't know if maybe one of you is willing to kind of elaborate a little bit more on the larger implications of what that would look like and why it exists outside of that bubble. Oh, yeah, of course. So the implication of, let's just pick on one of the assumptions that are being used in the real world, let's say what's called elliptic curve discrete log. If it turns out this assumption is not as strong as we thought, and there's actually a realistic attack on it, that would not be good. or break, I should say that we already, NIST is already standardizing many other types of public key systems that we can switch to. So if it turns out one of our assumptions is broken, we have backups that we can move to. In fact, we have several backups that we can move to. And so we just need to know, is this like a high priority? Is this something that we don't need to do right away? And so the lack of knowledge right now is creating a vacuum, I think, in the, you know, That vacuum really needs to be filled. So maybe to simplify just a little bit, it's that the process in the absence of the ability to prove that these problems are hard, the problems on which cryptography is built. In the absence of that ability, we specifically rely in some sense on time. That's kind of what we were doing. I know I'm oversimplifying a little bit, but we put these schemes out and we wait. And we wait because what we believe is happening is that experts like cryptographers and mathematicians are testing and trying to break these things. And if they're around for long enough and many enough people have talked about them and tested and talked with each other about their trying to break these schemes and they don't. We emerge with confidence. at their hard to break. And because of the pace of progress on AI's mathematical abilities, it's a little bit There is a conspicuous absence of time. There is kind of a gap. between the rate of progress, and the information we're getting, from the people who seem to have most of the effort, most of the cognitive ability to even scrutinize these things. A whole new well of cognitive ability to scrutinize has appeared, and we're not hearing from them. about what they are discovering through their work in the normal way that we would from the academic and computer science and cryptography research mechanism. You're totally right. In the past, when someone would make an assumption and build a system based on it, we'd have to wait like 10 years before that system could be deployed to gain confidence, to give people enough time to analyze the assumption. And now, all of a sudden, we can accelerate this process tremendously using these models. This is a remarkable tool. that the assumption is valid, what's the system? - Yeah, it's funny because it's a change in how we normally do it, right? Normally we have this, to the public, or to an informed person in the public. We have a background rate of attention that is paid by our cryptographers to these systems. And we just sort of sit back and we wait long enough and we assume, make some assumptions about their prioritization, that they're paying attention to the important things. And then after long enough, we say, This has got to be good. This is probably good. But now we have a completely new thing where we're The labs can say, we took our tip-top, totally unrestricted, most cyber-capable model, and we told it to go absolutely insane. And we spent $20 million, $50 million trying to break this scheme. And at the other end, we have more conviction about its confidence than you could probably get from the conventional process in a decade. So we actually have the prospect to have more confidence in our security than ever before. It's just there's a little bit of a gap in how that information is being created and shared. Okay. And we can accelerate the deployment of better cryptography. And the gap, I have to say, is also the fact that obviously some of the models... are accessible to the labs, but not to the rest of the public. In the absence of that information, What would you recommend or how do you kind of think about this as just like an everyday user of technology? Like, is this how does this impact how you interact with technology, if at all? So nothing has changed. [15:00] The world today is the same as the world a week ago, the world a year ago. Nothing has changed until we learn something new about our standard cryptographic systems. Nothing has changed. Keep using the systems as they are. When we learn something new, either we'll have more confidence or we'll have to react. But until we have more information, Nothing has changed. So please don't panic. You know, keep calm. Yeah, to put it another way, you know, the reaction yesterday... and continuing today, is not a reaction to new information. The reaction is maybe an indirect reaction to the dump of mathematical results from OpenAI, a very indirect kind of information about AI's progress, which, again, was amazing, but I don't think is a surprise. It's like all Silicon Valley's been talking about for years now. But it's not a specific reaction to a specific piece of information about cryptography. We didn't learn that elliptic curves are vulnerable in a way that they weren't before. learn that any specific cryptographic assumptions had have less security than they did before. Maybe to give people a little bit more confidence also... We have a lot of different types of assumptions that we use to build public key cryptography. It's not just elliptic curves or lattices. We have isogenies and code-based systems and multivariate polynomial-based systems. There are many hash-based signatures. There are many other types of assumptions that we can build public key cryptography from. So if we need to react, we can react. Of course, everything takes time, but we sort of know where to go. If the worst of the worst happens, there are still plenty of ways for us to recover. So one thing I guess worth mentioning is like we – We generally believe there is no efficient algorithm for these problems. And it's not that we think there might be and humans just aren't smart enough to find it. We think there is not one. And so if there is not one, it doesn't matter how smart the AI is, it cannot find the non-existent algorithm. And so the worry is that just our belief is totally wrong. But to be clear what the belief is, it's not the algorithms there and we're too dumb to find it. It's just not there at all, right? So that's one thing to clarify. The first tweet was won by Justin Drake of the Ethereum Foundation, warning of a possible complete break of elliptic curve cryptography in the coming months, and suggesting that at least large cold wallets on the Ethereum blockchain enter, what do you call it, bunker mode, or at least not have exposed public keys on chain. And then Vitalik Buterin followed up with a slightly more toned down tweet, but still speculating about better attacks that AI might find on cryptosystems. So, yeah, in Vitalik's tweet... even mentioned that he himself has lost more personal funds in botched migrations than in all hacks. So I think we as humans tend to struggle with tail risks that are very scary and sort of psychologically prone to dominate our thoughts less scary and less cataclysmic. And so, yeah, I just want to emphasize that, you know, bugs remain everywhere. The AIs are good at finding the bugs. I actually hope that's good for, you know, AIDS defensive practices more in the medium to long term than offensive ones. And yeah, it's basically the worst thing you can probably do right now is something. You should do nothing. recommendations in Justin Drake's post were really just good practice, good hygiene that all of these institutions should already be following independent of AI or quantum or anything. To Justin's point regarding institutions following all of these practices, you know, Coinbase already came out and said they already do this. They already do a lot of the specific measures outlined in bunker mode. And I think that they will continue to do that. It's true. A funny thing about it is that the further down this rabbit hole you go, I think we are already preparing. My understanding is that we are already preparing. As Dan said, we have already different types of assumptions that we can switch to in cryptography, and we've prepared the path a little bit. We already require, from the market I mean, institutions to take some of these best practices, like making sure public keys aren't revealed on the blockchains where that's relevant. [20:00] We already do a lot of these things. And as we learn more, accelerated by AI research and their skills in math, we will probably add more and more methods of preparation to our kit. So the frustrating thing about the take, we need to go into bunker mode, we need to prepare, is that, It is. the specific things that it advises us to do, are probably not good and risky, for normal people to do and are already things that the hardcore institutions who should take responsibility for these risks are doing. So there is not a specific set of recommendations that come out of this specific new practices. If we're calling for anything here. What we're calling for is more information so we can know how to adapt. and Correct me if I'm wrong, but... the types of cryptography that this tweet, the Justin Drake tweet, is referring to possibly being broken by advanced AI, are the same types of cryptography that are under threat from a quantum computer as well. So this is like a threat we've already been thinking about for a while, a threat we've already been preparing for for a while. And if it comes from AI before it comes from the quantum computer, it doesn't make it No. Dan opened with a couple remarks on this about the conflation of the quantum issue from the AI math skills issue. And part of the reason why those things get conflated is that what Justin Drake was talking about was a lot of his fears about elliptic curve cryptography. And what's funny is because of fears of the quantum threat, people have already begun to treat elliptic curve cryptography as something that may be vulnerable soon. So we have already actually... engaged in and prepared and deployed many of the mitigations you'd need to, for those exact concerns for a different threat. So that's why it's a little bit of a funny thing for him to say, Because it didn't come with specific concrete recommendations about how institutions ought to prepare in a way they are not preparing today. I would also add that If What Justin was warning about happens in the timelines he mentioned. Um, it's a cataclysmic event for all digital infrastructure security throughout the entire world. There's no way we're fully moving off of elliptic curve cryptography in the next couple of years. And so the focus on blockchain hygiene, is just very discordant with this cataclysmic event he was discussing. You know, I will add to that, though, that the quantum threats... is really only about these elliptic curve type systems and RSA and such. The AI threat, in some sense, is broader. It could actually also look at our post-quantum system and potentially weaken them in some way, maybe break them altogether. And so it is quite important to know that the latest models could not break our post-quantum candidates because those are the ones we're moving to. So that would be quite helpful. Now, in terms of what to do, people, I mean, I guess the question is kind of what do we do about this? I totally agree with Eddie. The answer is we should be doing what we are already preaching to do. And one of the main things that we always preach is what's called crypto agility. Yeah, that we deploy systems that can quickly switch from one type of design to another if the design is being used turns out to be insecure. Crypto agility is in some sense our friend for defending against the unexpected. Yeah. And we should keep on doing that. Yeah. We're already crypto agility is a term that's over a decade old. Yeah. So we should keep on doing that. And if our AI friends come up with things that we didn't expect, well, you know, the crypto agility will kick in and we'll move to something that is that remains secure. This debate also surfaced another opportunity to relitigate something that comes up all the time, which is elliptic curves versus hashes versus lattice cryptography as the fundamental basis for elliptic curves. specific constructions and specific applications. And of course, Dan, of course, is totally correct that the AI thread is broader because the, just to reiterate it slightly, is If cryptography relies on the difficulty of specific problems, it could find flaws in these problems on any of the schemes, right? Not just elliptic curve cryptography. But to get a little bit into the details, what Drake was saying was that there may be structure... in lattice cryptography and elliptic curve cryptography that perhaps makes it more vulnerable to the ideations of a very well-resourced AI model. Again, we didn't learn anything specific about that, per se. [25:00] from the OpenAI drop, but Uh, but, you know, I think it's a little bit less clear to me, and I'd love to hear from Dan and from Justin about what is it specifically maybe about – hashes or about lattice cryptography in addition to elliptic curve cryptography that maybe makes gives someone might give someone reasons to believe some are more secure than others to an AI threat And the point there is that we think of hash functions as post-quantum. But they might not be post-AI. That's the... Yeah, that's right. That's right. And we think of lattice as post-quantum, but not necessarily post-AI, right? And so how do you think of the... How do you think of them? Right. Good. So the migration to post-quantum cryptography, I guess, in the blockchain space, there is actually quite a bit of debate on whether we should be using lattice-based signatures or hash-based signatures. On the Internet at large, there is no debate. On the Internet at large, everybody's using lattice-based cryptosystems for key exchange, for signatures. That's a done deal. In the blockchain space, there is still a debate as to whether we're going to use hash based signatures or lattice based signatures. Generally, the attitude in the community is that hash based signatures are more secure. And there is multiple reasons to say that. One reason is that if it turns out that one hash function turns out to be not as secure as we thought, we simply switch it out for another hash function and everything works as before. The framework is guaranteed to be correct. Yeah. So there's like more agility when we use hash-based signatures. If for some reason it turns out that the core lattice problems are not as hard as we thought, the whole mechanism collapses and we have no recovery. We can just not use lattices, period. So in some sense, hash-based signatures are far more agile than a lattice-based signature. Yeah, because a hash-based scheme, although it may vary in the specific hash function being used, the entire construct of a hash-based scheme is... - The framework is sound. - The framework is sound. So in other words, the choice of hash function, which would be the thing that would break, is very, less important, so to speak, in the grand construction. Whereas in lattice-based cryptography, maybe like elliptic curve cryptography, all those different schemes rely on maybe a specific shared problem or shared set of assumptions. Yeah, the other argument that I hear a lot in the blockchain space is that, specifically in Bitcoin and Ethereum, is that... the hash assumptions that we make are necessary for other parts of the blockchain to operate. Merkle trees and such, we already make hash assumptions for the core functioning of the blockchain. So in some sense, if our signatures were also purely hash based, we are not adding any new assumptions to the security of the blockchain. Whereas if we're, For one part of the blockchain, we use hashes. And for signatures, we use lattices. All of a sudden, now we have two different types of assumptions that if either one of them breaks, we have a problem. And so reducing the number of assumptions in the blockchain is also something that people are kind of excited about. I get a sense that in the Bitcoin space, in particularly the core devs that I talk to, they're actually quite excited about getting rid of elliptic curve assumptions in Bitcoin. function without any additional assumptions. In some sense, the same thing is also playing out in the Ethereum foundation space. Yeah, so I think I'd say those are kind of the comparisons between the two. This is a complicated question, much more so than it appears on the surface. Should blockchains rely exclusively on hashes or should they use lattices? One thing to say is, if, um, We only use hash-based cryptography because you just can't do good encryption key exchange from that. But also, especially in the Ethereum community, the way they plan to use only hashes, which comes with downsides like just bigger cryptography, is to... use what's called snark recursion. So basically, you have these proofs that, you know, you know, a bunch of signatures or something, and then you prove you know those proofs and prove you know those proofs and so on and so forth. And so there are two issues there. The more prosaic issue is this is just very complicated, right, to like prove you ran a snark verifier that itself verified a proof that verified a proof. And so the surface area for bugs just gets very large. And yes, I'm very optimistic that the same AI tools that are scaring people about cryptography will also help us get all the bugs out. That's a very hard problem. So, you know, we have to speculate just as much on, I know the bugs is like a really, really, really hard problem. So the AI is going to have to be really good if we're going to get all of those bugs out from a system that complicated. And I think... [30:00] relying exclusively on hashes amplifies that. And the other thing is that we don't understand the security of snark recursion very well. So that's another, you know, you tell me lattices might be attackable. I say, well, I don't know about snark recursion. You know, again, it's, there's a lot of non-quantifiable risks. And, you know, I'll just leave it at that. We have to do our best to weigh these things. And the public discussion weighing them can be pretty frustrating sometimes. Hmm. Yeah, that's right. I do want to make one more point on the hash-based versus lattice-based. It is quite important to understand that lattice-based systems have much better properties than hash-based. which is actually why many in the crypto community are pushing towards lattice-based systems. So things like threshold signatures, things like non-hardened key derivation, there are many properties of lattice-based systems that we simply don't have with hash-based systems. Also, hash-based systems are harder to use in principle. Like Justin was saying, they're much larger and they're stateful versus stateless. There are many technical issues with getting hash-based signatures to work. Many of us cryptographers are actually a little sad that some of the blockchain community will move to hash based signatures that really have no algebraic properties for us to leverage for more advanced applications. So in some sense, there's a tradeoff that we're making in perhaps we are removing assumptions from the blockchain space, but we're also removing capability in that now we are going to be using a tradeoff. signature schemes that have far fewer properties than what we would have if we were using lattices. So as a cryptographer, to be honest, I would be quite happy if we ended up using lattice-based schemes. because that gives us much more room to play in and build interesting structures. But the hash-based schemes are much, much more constrained. But perhaps that constraint is also where this extra sense of security comes from. So, Maybe to give a quick summary of what we've kind of discussed so far, what it sounds like is, you know, and I think Justin laid this out very nicely, it is not a given that there is an efficient algorithm that could be found to break this type of cryptography. If there is an efficient algorithm out there, then the time frame at which to find it is likely very, very sped up, given our advances in AI. And that's where the kind of panic and confusion is coming from, is the possibility that that efficient algorithm both exists, and now the timeline is much shorter than it would be without these advances in AI. is for more information from the labs to come out on how much work they've done to try to find that algorithm. And if the labs came out and said, you know, we threw a bunch of compute and time and money at this and we couldn't crack it, that would give you confidence at least until the next a big upgrade in the model that we have a reasonable safe security assumption. In the extreme case, it should give you more confidence than the history until today. If you really do believe, like many do, like many of the people posting yesterday believe, that... These, you know, these models are now basically at at or better than the vast majority of people who are trying to, you know, who are studying these systems, or they will be soon or whatever, then you should get great confidence from knowing that the equivalent of, you know, 100,000 expert mathematicians or cryptographers is, took a look at a scheme. It should actually make you more confident than you could have ever been about one before that. I can't help but emphasize, like, we need to reconsider just how we even decide what we feel confident about. So we've talked a little bit about You know, if you're an institution, there's a lot of these security best practices that you probably are already doing or should have been doing already. If you're an everyday user... nothing to do at the moment, don't panic, continue on. If you're a startup that wants to take advantage of this really interesting kind of piece of technology unfolding in this way. Are there startup opportunities here and where a new company might be able to come in and help? I think the most obvious note that I take out is that, well, startups will have to need to have you know seriously consider what types of security assumptions they make in their in their software today you know however they design their systems that's already kind of happening on multiple fronts right how people think about open source is changing right uh didn't close source basically everyone recognized closed source died last week right because of our ability to decompile things um It's also the case that because of the agentic properties of AI systems, by agentic properties I mean. They can go on unbounded side quests, right, and do all kinds of random things in pursuit of a goal for you. Because of this, we have to think very carefully [35:00] about the security boundaries and sandboxes and capabilities-based permissioning schemes we put around AI agents. So we're already thinking about rethinking security from that lens. Well, this is just yet another way we need to reconsider what systems are capable of and how to design software and products that remain secure and that protect users as much as they empower them. I would go even a step further. I think that... these new capabilities are a gift to startups and to even a more established software shops. So I can tell you in the past, when I The time when a crypto system becomes really interesting to attack is once it's announced that it's about to be deployed or is already deployed. Like this is when after it's deployed, it gets a lot of attention from cryptographers. And that's kind of the wrong time to attack a crypto system. and analyzes general software for bugs. This is an incredibly powerful tool that didn't exist before. Over time... As more and more software shops adopt this technology, I believe that software quality is going to go up. Crypto quality is going to go up because nothing will ship. Yes. Unless the model said that it's valid. I saw someone recently because of the release of like 5.5 Haiku, they were comparing with 4.5, right? And making many comparisons between models from a year ago versus today. And it's always hard to do an apples to apples comparison when they. the capabilities per token have increased so much, but some people were coming up with estimates like, it's 90 plus 95% cheaper, right? 99% cheaper for, uh, you know, uh, intellectual capability per dollar, right? If that's the case, And you pair that with a frame we've said before, we talked about before, which is that the number of bugs in software is finished. then we're asymptotically approaching zero bugs. Maybe and maybe we actually just hit zero at some point. Maybe we have the ability to create zero with some assumptions, right? If that's the case, we are net improving, the security status of the world. instead of eroding it, right? This is not a battle of wits where you have a system, I have a system, your system is smarter than mine, therefore I am vulnerable to you. Like no matter what, no matter how I configure myself, you can overpower my computer and destroy my computer, right? that relies on there being vulnerabilities. And vulnerabilities can be removed. They can be designed away. They can be mitigated. And the primary... we dedicate to mitigating it. is the thing that's getting... radically cheaper. every couple months. And that's AI capabilities, intellectual capabilities, intelligence, machine intelligence, whatever you want to call it. Companies actually are already doing this. Companies are actually spending a lot of money on exactly scanning their code base with the latest models. And it's actually really quite interesting. Every time there's a software update, they scan the software again. Every time a new model comes out, they scan the software again. we are quite interested in is how do we do software scanning at more efficiently? So we don't have to maybe rescan everything every time a new model comes out or every time a change is introduced. So there's even lots of interesting areas for thought and research here. Yep. Let's say the labs take up your plea, they throw a bunch of compute at it, and they come out and they say, "You're right, we did break elliptic curve cryptography, actually." What happens next? Like, you know, We record this podcast today and tomorrow... What does the world look like? What is the next step? Then basically we have to move to post-quantum cryptography, which we're already doing. We have to move to these lattice-based systems, which are already deployed. If you look, by the way, you can literally look at many internet connections today. They are actually using agile cryptography. They're encrypted using elliptic curves and lattices at the same time. If you break elliptic curves, it doesn't matter because it's also encrypted under a lattice-based system. many other such systems have done that. Exactly. Signal and so on. Yes, yes. In fact, but I was actually referring to one of the TLS key exchange methods. I guess it's called X25519 MLChem768. It's a jumble of letters. But what it means is you're protected by both elliptic curves and lattices. Now, maybe the labs come forward and say, oh, we broke both, right? Well, fine. Then we [40:00] a third one. We'd have to standardize. That would be a longer process, but that would be what would come next. So we kind of know where to go. It's just going to be more work and, um, Perhaps more of a rush. Yeah, and maybe at the risk of stating the obvious, I have no doubt they would be prudent enough to do this the right way. It goes without saying, but the labs shouldn't go and share this, just like throw out a scheme to break elliptic curves. They should responsibly disclose it to the industry, to the government, to the industry, develop a plan, and everybody needs to update their software as quickly as possible. and adapt. But again, that is a known process that a lot of people take for granted. It's almost silly I'm saying it because security experts know this very, very well. And so there is a way to do such a thing should it happen. Great. Well, thank you for that. I feel calmer. So hopefully everyone else does as well. Thanks so much. This was fun. Thank you. of the A16Z podcast. If you liked this episode, be sure to like, comment, subscribe, leave us a rating or review and share it with your friends and family. For more episodes, go to YouTube, Apple Podcasts, and Spotify. Follow us on X at A16Z and subscribe to our sub stack at a16z.substack.com. Thanks again for listening and I'll see you in the next episode. As a reminder, the content here is for informational purposes only. It should not or be used to evaluate any investment or security and is not directed at any investors or potential investors in any A16Z fund. Please note that A16Z and its affiliates may also maintain investments in the companies discussed in this podcast. For more details, including a link to our investments, please see A16Z.com forward slash disclosures. Thank you. Thank you.