Why LLMs Won't Break Symmetric Cryptography

On July 28 Anthropic reported new cryptanalytic results obtained with the language model Claude Mythos. The first was a key-recovery attack on the post-quantum signature scheme HAWK, a candidate for NIST standardization. Apart from the toy version HAWK-256 with 64-bit security, which is already all but breakable, the attack has no practical significance. It does, however, meaningfully lower the estimated security of HAWK-512 from the claimed 128 bits to at most 108, and by speculative estimates to 81 bits.

The second result was an improved attack on 7 rounds of AES-128 (the full version uses 10). It poses no threat to AES and, as the blog's author notes, surprises no one. Far more important is the negative outcome: Mythos found neither a stronger attack nor, much less, a way to break full-round AES. Anthropic also took part in building the CryptanalysisBench benchmark, with problems on AES, ChaCha, BLAKE and post-quantum candidates.

A Cryptographer's View

Jean-Philippe Aumasson, co-author of BLAKE, rates Anthropic's work positively and especially welcomes the call to formalize cryptanalytic methods: too many papers use homemade notation to describe what is essentially the same thing. He expects models to be useful in another way too — finding errors in attack-complexity estimates and in security proofs. Earlier this year he already asked neural networks to find flaws in the proofs of EUROCRYPT 2026 papers and got objections to most of them.

Still, on the main point Aumasson is confident: LLMs will break none of the established symmetric algorithms and will not refute the conjectures of the paper “Too Much Crypto.” He gives several reasons.

First, the high-level constructions — the GCM and CTR modes, the sponge construction of hash functions — are provably secure. Second, unlike number-theoretic problems and most public-key schemes, symmetric ciphers simply have no mathematical structure. The designer deliberately destroys any symmetry and regularity. BLAKE3, in the author's words, is a long sequence of XORs, modular additions and bit rotations, where XOR breaks the linearity of addition and addition breaks the linearity of XOR.

Matthew Green captured this “messiness” well: designing a symmetric cipher is like dragging a tractor into quicksand and pouring it over with cement. The operations of each round are simple and fast, but their iterations turn into an unpickable tangle, and extra “intelligence-hours” are unlikely to help here.

Third, almost all cryptanalysis of symmetric schemes consists of varieties of differential analysis, a territory explored inside and out; models are unlikely to discover fundamentally new classes of attacks. On top of that, such analysis is partly empirical: statistical biases are found experimentally, without always understanding their nature. Finally, these algorithms have gone through thousands of hours of scrutiny — mostly unsuccessful and therefore unpublished.

Aumasson's conclusion is pragmatic: symmetric cryptography is the sturdiest part of our security systems, so LLM tokens are better spent hunting for errors in the less-studied post-quantum candidates.

Source: Lobsters