Can AI Break Cryptography? What the Experts Actually Think
00:00 All of a sudden, a new threat emerged in the world of cryptography, which is whether our AI friends can actually attack crypto systems that we thought were secure. The fear here is that the AI labs could break them if they are breakable. The fact that people try to break them and fail gives us more confidence. NIST is already standardizing many other types of public key systems that we can switch to. So if it turns out one of our assumptions broken, we have backups. We just need to know. There are startup opportunities here and where a new company might be able to come in and help.
00:35 AI is getting better at solving difficult math problems. Could it eventually break the cryptography protecting our banking systems, private messages, and crypto wallets? Recent results from OpenAI have sparked new concerns about the security of modern cryptography. In this episode, A16Z Cryptos Liz Harcobee is joined by Stanford Professor Dan Bonnet, general partner Eddie Lazarin, and research partner Justin Daler, to separate the same. fact from speculation. They discussed what the recent breakthroughs actually tell us, how AI threats differ from
01:06 quantum computing, and why there's no reason to panic today. They also explained how AI could ultimately help make cryptography and software more secure. Hey, welcome to our show today. I'm Liz. I'm joined here with Dan Bonnet, a professor at Stanford, and Eddie Lazaran and Justin Thaler, two members of our team here at A16Z. We're here to talk about a pretty big discussion that's going on right now that's been kicked off yesterday by a tweet that a security researcher Justin Drake put out, warning the
01:36 crypto industry to start preparing for what he's calling bunker mode, specifically around this worry that the advances in AI are going to cause a breakthrough or breaking of cryptography faster even than of a quantum computer might, which is normally the basis of the discussion that we have when we think about modern day cryptography and what the state of the art looks like. And so he called on, you know, big institutions to start thinking about moving funds and start thinking about this. And a lot of that has been kicked off by some papers that Open AI put out
02:06 and different kind of breakthroughs they had in mathematical problems that were previously unsolved and how that relates back to cryptography. And so, Dan, I don't know if you want to kind of summarize what those breakthroughs were or what those papers put out and how that kind of kicked this off.
02:21 So let's see. I guess the first thing I should say is, you know, everybody calm down. Don't panic. Calm down. The world today is the same as it was a year, a year ago, two years ago, that's the first message. Now, I guess before we get started,
02:34 I just want to make sure people are on the same page and that there are kind of two stories that are getting entangled. I think we should first disentangle them. There is this long-going conversation on the threat of quantum computing to cryptography. This is not what this is about. Here, there is all of a sudden a new threat
02:53 that's kind of emerged in the world of cryptography, which is whether our, you know, my friends can actually attack cryptosystems that we thought were secure using their super intelligence and so on. So I guess the backdrop to all this is that around 700 papers were put up online, presenting enormous progress in mathematics and computer science. I can't say enough about how impressed I am with the results that have been put on online. It's really quite remarkable to see all the progress.
03:25 I remember my kind of inbox blew up when this came online. Everybody was asking for opinions and so on. So I started going through the list of problems that progress was made on. And as I finished the list, the thing that kind of stuck in my mind is that, wow, this is incredible progress in mathematics in computer science. But there are no questions here on cryptography. Not even on theoretical cryptography, right? I mean, in principle, there are lots of really interesting open problems. in constructing, you know, positive development in cryptography,
03:59 constructing new cryptosystems, maybe even in a theory, things that wouldn't directly be relevant to the real world, none of those questions were in the list of 700 problems there were posted. So you might wonder, well, does that mean the models are really bad at cryptography? We don't know. And so I think one of the things that I would maybe like to start with
04:19 is a call to the Frontier Labs to please tell us what have you done with, trying to use these models to answer basic questions in cryptography. I guess the real question is what is the status, for example, on actually attacking standardized and deployed crypto? Have the Frontier Labs tried any of their models? Sorry, so just to clarify what you're saying, this tweet was not kicked off because there was something in the paper specific to cryptography, but rather that just the fact that they
04:48 had massive breakthroughs in any sort of mathematics means there is likely a breakthrough in The Open AI drop had a variety of papers across hundreds of different topics, hundreds of different topics. And many of those topics, although weren't specifically about cryptography, were adjacent to cryptography. I'd say in the loose sense that they involve progress using similar techniques and mathematical reasoning that one would use to make progress in cryptography. So their absence is a little bit conspicuous, right, is what Dan is saying. And it's something that, you know, you have to consider the explanations for. On the one hand, if the reason for the omission is that AI models are notably bad and couldn't find anything and that cryptography is particularly robust for some reason, that in itself would be very interesting, right? If, in other words, if the labs attempted to make progress in theoretical or applied cryptography and didn't really find anything worth discovering,
05:53 that would be in itself very interesting. If on the other hand, they did make progress and there could have been a lot to share, but there are reasons that what they wanted to, what they could have shared would be concerning, then that would be very interesting to know as well. And so I just, I want to go back to what you kind of kicked off with here, which is we kind of breezed over this,
06:14 is we are not, it is not a given that the current kind of like cryptographic standards we use are human breakable. We just don't know if, they are or not today. And so the fear here is that the AI labs could break them if they are breakable. Yeah, I think this is actually a really important point in that all of cryptography is based on complexity assumptions. Yeah, it's based on assumptions. We have to assume that certain problems are hard. The reason we can't prove that those problems are hard is because that's related to a famous open problem in computer science called a P versus NP problem. In some sense,
06:52 we first have to resolve that problem before we can actually argue that cryptography, the certain cryptographic problems really are hard. And so since that, we're very far away from that, none of the problems that were posted this week come even close
07:08 to resolving the P versus NP problem, we still have to keep making assumptions in cryptography. So the assumptions are that certain problems are hard. Let's say elliptic curve discrete log, let's say short of vector and lattices. We have a whole list of problems that we know and love and we build cryptosystems from.
07:26 A lot of people have worked over the years and trying to break those assumptions and in fact there's a huge body of literature on failed attempts, on partial attempts, partially successful attempts. So this is a very active area. And so far, all these problems remain secure and our cryptosystems are based on those problems.
07:46 But now there's a new player in town, right? Somebody else could try to come up with other, ways to solve these problems, and maybe they'll see something that us humans have not seen. That's certainly a possibility, but again, I need to stress, this is not a new possibility. Two years ago, five years ago, ten years ago, you know, a clever human could have come up with a new attack that nobody has seen before and break some cryptographic assumptions. Cryptography is sort of built on assumptions. We realize things are built on assumptions that could end up not being as strong as we expect. And so it's wonderful that people try. This is
08:21 actually how we gain confidence in our assumptions. The fact that people try to break them and fail gives us more confidence. So in fact, I would say this would be an extremely positive development if the labs try their best models at some of our basic cryptographic assumptions. The models fail to break them. The labs say that they fail to break them. That will give us tremendous confidence that our assumptions are valid. And even if they shave off a little bit of security, let's say they shave off 10 bits of security from one of the problems that we use in practice. That's great. That's wonderful for us to know. The fact that all they could do is shave off 10 bits of security
08:59 is actually already very strong evidence that the assumptions are actually worthwhile using. Another thing that would be nice for the labs to try is I think we can hope to use these models to give much stronger evidence than we currently have that these problems are hard. by which I mean for a lot of these problems are evidence right now. Well, we have things like, you know, we know they're just as hard in the worst case as the average case, which, you know, for some of them, these lattice problems, which is helpful. But there are complexity theoretic results you could hope to show that would give more evidence, more confidence in the interactability of these problems that they have no efficient algorithms.
09:40 I'd say that, you know, Dan is totally right. like most of the reason for, you know, today's cryptography that we have confidence, you know, these problems actually are intractable is, you know, people have just tried for decades and decades and haven't come up with any good algorithms. But we can hope for other kinds of evidence. And those are like pure math questions that these frontier labs could be turning their models on. The specific tweet that we're referencing was about crypto wallets and the impact of this on crypto. But there is a much broader implication of breaking like ECDS.
10:13 And so I don't know if maybe one of you is willing to kind of elaborate a little bit more on the larger implications of what that would look like and why it exists outside of that bubble. Oh, yeah, of course. So the implication of, let's just pick on one of the assumptions that are being used in the real world. Let's say what's called elliptic curve discrete log. If it turns out this assumption is not as strong as we thought and there's actually a realistic attack on it, that would not be good. Yeah. So not only for the blockchain space, this would affect the entire Internet. It affects the, actually, to be honest, it affects the entire digital world.
10:47 So home banking, health care, government communications, everything is impacted by such a break. I should say that we already, NIST is already standardizing many other types of public key systems that we can switch to. So if it turns out one of our assumptions is broken, we have backups that we can move to. In fact, we have several backups that we can move to. And so we just need to know, is this like a high priority? is something that we don't need to do right away. And so the lack of knowledge right now is creating a vacuum, I think, in the Tweedosphere.
11:21 And that vacuum really needs to be filled. So maybe to simplify just a little bit. It's that the process, in the absence of the ability to prove that these problems are hard, the problems on which cryptography is built. In the absence of that ability, we specifically rely in some sense, on time.
11:43 Right? That's kind of what we're doing. I'm no, I'm oversimplifying a little bit, but we put these schemes out and we wait. And we wait because what we believe is happening is that experts, like cryptographers and mathematicians, are testing and trying to break these things. And if they're around for long enough and enough people have talked about them and tested and talked with each other about they're trying to break these schemes and they don't, we emerge with confidence that they're hard to break. And because of the pace of progress on AI's mathematical
12:19 abilities, there is a conspicuous absence of time. There is kind of a gap between the rate of progress and the information we're getting from the people who seem to have most of the effort, most of the cognitive ability to even scrutinize these things. A whole new well of cognitive ability to scrutinize has appeared. And we're not hearing from them about what they are discovering through their work in the normal way that we would from the academic and
12:48 computer science and cryptography research mechanism. You're totally right. In the past, when someone would make an assumption and build a system based on it, we'd have to wait like 10 years before that system could be deployed to gain confidence to give people enough time to analyze the assumption.
13:04 And now, all of a sudden, we can accelerate this process tremendously using these models. This is a remarkable tool. Somebody makes, let's say, I'm making a new assumption and build an amazing crypto system based on it. Now we can just let a model run for a month, try to break it. And if the model can't break it,
13:20 boy, do we have, we have a lot of confidence that the assumption is valid. Yeah, it's a system. Yeah. It's funny because it's a change in how we normally do it, right? Normally we have this to the public or to an informed person in the public. We have a background rate of attention that is
13:36 paid by our cryptographers to these systems. And we just sort of sit back and we wait long enough and we assume, and we assume make some assumptions about their prioritization, that they're paying attention to the important things. And then after long enough, we say, this has got to be good. This is probably good. But now we have a completely new thing where the labs can say, we took our tip top totally unrestricted, most cyber capable model, and we told it to go absolutely insane. And we spent $20 million, $50, million dollars trying to break this scheme. And at the other end, we have more conviction about its confidence than you could probably get from the conventional process in a decade.
14:20 So we actually have the prospect to have more confidence in our security than ever before. It's just there's a little bit of a gap in how that information is being created and shared. And we can accelerate the deployment of better cryptography. And the gap, I have to say, is also the fact that obviously some of the models are accessible to the labs, but not to the rest of the public. In the absence of that information, what would you recommend
14:50 or how do you kind of think about this as just like an everyday user of technology? Like is this, how does this impact how you interact with technology, if at all? So nothing has changed. The world today is the same as the world a week ago, the world a year ago. Nothing has changed.
15:05 Until we learn something new about our standard cryptographic systems, nothing has changed. Keep using the systems as they are. When we learn something new, either we'll have more confidence or we'll have to react. But until we have more information, nothing has changed. So please don't panic. You know, keep calm. Yeah, to put it another way, you know, the reaction yesterday and continuing today
15:31 is not a reaction to new information. What the reaction is maybe an indirect reaction to the dump of mathematical results from Open AI a very indirect kind of information about AI's progress which again is it was amazing but I don't think is a surprise it's like all Silicon Valley's been talking about for years now but but it's not a specific reaction
15:56 to a specific piece of information about cryptography we didn't learn that elliptic curves are vulnerable in a way that they weren't before. We didn't learn that any specific cryptographic assumptions had have less security than they did before. Maybe to give people a little bit more confidence also, we have a lot of different types of assumptions that we use to build public key cryptography.
16:18 It's not just elliptic curves or lattices. We have isogenes and code-based systems and multivariate polynomial-based systems. There are many, the hash-based signatures, there are many other types of assumptions that we can build public-key cryptography from. So if we need to react, we can react. Of course, everything takes time, but we sort of know where to go.
16:39 And so even if the worst of the worst happens, there are still plenty of ways for us to recover. So one thing, I guess, worth mentioning is like we generally believe there is no efficient algorithm for these problems. and if, you know, it's not that we think there might be, and humans just aren't smart enough to fight it. We think there is not one. And so if there is not one, it doesn't matter how smart the AI is, it cannot find the non-existent algorithm, right? And so, you know, the worry is, you know,
17:14 that just our belief is totally wrong. But to be clear what the belief is, right? It's not the algorithms there, and we're too dumb to find it. It's just not there at all, right? So that's one thing to clarify. The first tweet was won by Justin Drake of the Ethereum Foundation, warning of a possible complete break of elliptic curve cryptography in the coming months,
17:38 and suggesting that at least like large cold wallets on the Ethereum blockchain enter what do you call bunker mode, or at least not have exposed publicies on chain. And then Vitalik Bouturin followed up with a slightly more toned down tweet, but still speculating about, you know, better attacks that AI might find on cryptosystems. So, yeah, in Vitalik's tweet even mentioned that, like, he himself has lost more, you know, personal funds in botched migrations than in all hacks, right? So, you know, I think we as humans tend to, you know, struggle with tail risks that are very scary
18:23 and sort of psychologically, you know, prone to dominate our thoughts, when there are sort of clear and present risks that are actually more dire, even though less scary and less cataclysmic. And so, yeah, I just want to emphasize that, you know, bugs remain everywhere. The AIs are good at finding the bugs. I actually hope that's good for, you know, AIDS defensive practices more in the medium to long term than offensive ones. And yeah, basically the worst thing you can probably do right now
18:59 is something. You should do nothing. And actually the recommendations in Justin Drake's posts were really just good practice, good hygiene, that all of these institutions should already be following independent of AI or quantum or anything. To Justin's point regarding institutions following all of these practices, you know, Coinbase already came out and said,
19:23 they already do this, right? They already do a lot of the specific measures outlined in bunker mode. And I think that they will continue to do that. It's true. A funny thing about it is that the further down this rabbit hole you go, I think we are already preparing. My understanding is that we are already preparing. As Dan said, we have already different types of assumptions
19:43 that we can switch to in cryptography, and we've prepared the path a little bit. We already require, you know, from the market, I mean, institutions to take some of these best practices like making sure, you know, public keys aren't revealed on the blockchains where that's relevant, right? We already do a lot of these things. And as we learn more accelerated by AI research and their skills in math, we will probably add more and more methods of preparation to our kit. So the frustrating thing about the take, we need to go into bunker mode, we need to prepare, is that it, the specific thing,
20:23 that it advises us to do are probably not good and risky for normal people to do, and are already things that the hardcore institutions who should take responsibility for these risks are doing. So there is not a specific set of recommendations that come out of this, specific new practices. If we're calling for anything here, what we're calling for is more information so we can know how to adapt. And correct me if I'm wrong, but The types of cryptography that this tweet, the Justin Drake tweet, is referring to possibly being broken by advanced in AI are the same types of cryptography that are under threat
21:03 from a quantum computer as well. So this is like a threat we've already been thinking about for a while, a threat we've already been preparing for a while, and if it comes from AI before it comes from the quantum computer, it doesn't make it new. Dan opened with a couple remarks on this about the conflation of the quantum issue from the AI math skills.
21:23 issue. Right. And the reason those, part of the reason why those things get conflated is that what Justin Drake was talking about was a lot of his fears about elliptic curve cryptography. And what's funny is, because of fears of the quantum threat, people have already begun to treat
21:38 elliptic curve cryptography as something that may be vulnerable soon. So we have already actually engaged in and prepared and deployed many of the mitigations you'd need for those exact concerns for a different threat. right so that's why it's a little bit of a funny thing for him to say because it didn't come with specific concrete recommendations about how institutions ought to prepare in a way they are not preparing today i would also add that if um what justin was warning about happens in the timelines he mentioned um it's a cataclysmic event for all digital infrastructure security throughout the entire world right there there's no
22:23 way we're, you know, fully moving off of elliptic curve cryptography in the next couple years. And so the focus on blockchain hygiene is just very discordant with this catacrismic event he was discussing. You know, I will add to that, though, that the quantum threat is really only about these elliptic curve type systems and RSA and such. The AI threat, in some sense, is broader in that it could actually, also look at our post-quantum system and potentially weaken them in some way, maybe break them all together. And so it is quite important to know that the latest models could not break our post-quantum candidates because those are the ones we're moving to. So that would be quite helpful. Now, in terms of what to do, people, I mean, I guess the question is kind of what do we do about this?
23:18 I totally agree with Eddie. The answer is we should be doing what we are already preaching to do. And one of the main things that we always preach is what's called crypto agility, yeah, that we deploy systems that can quickly switch from one type of design to another if the design is being used turns out to be insecure. Crypto agility is in some sense our friend for defending against the unexpected. Yeah. And we should keep on doing that. Yeah, we're already, crypto agility is a term that's over a decade old. Yeah, so we should keep on doing that. And if our AI friends come up with things that we didn't expect, well, you know, the crypto agility will kick in and we'll move to something that is, that remains secure. This debate also surfaced another opportunity to relitigate something that comes up all the time, which is elliptic curves versus hashes versus lattice cryptography as the fundamental basis for specific constructions and specific applications.
24:13 And of course, Dan, of course, is totally correct that. that the AI threat is broader because just to reiterate it slightly is, you know, if cryptography relies on the difficulty of specific problems, it could find flaws in these problems on any of the schemes, right? Not just elliptic curve cryptography. But to get a little bit into the details, what Drake was saying was that there may be structure in lattice cryptography and elliptic curve cryptography. that perhaps makes it more vulnerable to the ideations of a very well-resourced AI model.
24:56 Again, we didn't learn anything specific about that per se from the open AI drop. But, you know, I think it's a little bit less clear to me, and I'd love to hear from Dan and from Justin about what is it specifically maybe about hashes or about lattice cryptography, in addition to elliptic curve cryptography, that maybe makes, gives someone, might give someone reasons to believe some are more secure than others to an AI threat. And the point there is that we think of hash functions as post-quantum, but they might not be post-AI.
25:34 That's the... Yeah, that's right. That's right. And we think of lattice as post-quantum, but not necessarily post-AI, right? And so how do you think of the... Yeah. How do you think of them? Right.
25:43 Good. So the migration to post-crantum cryptography, I guess, in the blockchain space, there is actually quite a bit of debate on whether we should be using lattice-based signatures or hash-based signatures. On the Internet at large, there is no debate. On the Internet at large, everybody's using lattice-based cryptosystems. For key exchange, for signatures, that's a done deal. In the blockchain space, there is still a debate as to whether we're going to use hash-based signatures or lattice-based signatures. Generally, the attitude, in the community is that hash-based signatures are more secure. And there is multiple reasons to say that.
26:19 One reason is that if it turns out that one hash function turns out to be not as secure as we thought, we simply switch it out for another hash function and everything works as before. The framework is guaranteed to be correct. Yeah? So there's like more agility when we use hash-based signatures. If for some reason it turns out that the core lattice problems
26:40 are not as hard as we thought, the whole mechanism collapses and we have no recovery. We can just not use lattices, period. So in some sense, hash-based signatures are far more agile than lattice-based signatures. Yeah, because a hash-based scheme,
26:54 although it may vary in the specific hash function being used, the entire construct of a hash-based scheme... The framework is sound. The framework is sound. So, in other words, the choice of hash function, which would be the thing that would break,
27:07 is less important, so to speak, in the grand construction. Whereas in lattice-based cryptography, maybe like elliptic curve cryptography, all those different schemes rely on maybe a specific shared problem or shared set of assumptions. Yeah, the other argument that I hear a lot in the blockchain space is that, specifically in Bitcoin and Ethereum, is that the hash assumptions that we make are necessary for other parts of the blockchain to operate. Merkel trees and such, we already make lattice hash assumptions for the core functioning of the blockchain.
27:41 So in some sense, if our signatures were also purely hash-based, we are not adding any new assumptions to the security of the blockchain. Whereas if for one part of the blockchain, we use hashes, and for signatures we use lattices, all of a sudden now we have two different types of assumptions that if either one of them breaks, we have a problem. And so reducing the number of assumptions in the blockchain is also something that people are kind of excited about.
28:08 I get a sense that in the Bitcoin space, in particularly the core devs that I talk to, they're actually quite excited about getting rid of elliptic curve assumptions in Bitcoin and having Bitcoin only depend on the security of a particular hash function without any additional assumptions. And in some sense, the same thing is also playing out in the Ethereum Foundation space. Yeah, so I think I'd say those are kind of the comparisons between the two. This is a complicated question, much more so than it appears on the surface,
28:37 sort of, you know, should blockchains rely? exclusively on hashes, or should they use lattices? So, I mean, one thing to say is, like, the whole world digital infrastructure is going to be very challenged if we only used
28:54 hash-based cryptography because you just can't do good encryption key exchange from that. But also, like, especially in the Ethereum community, the way they plan to use only hashes, which comes with downsides, like, you know, just, bigger cryptography is to
29:14 use what's called snark recursion. So basically you have these proofs that, you know, you know a bunch of signatures or something, and then you prove you know those proofs and prove you know those proofs and so on and so forth. And so there are two issues there. The more prosaic issue is this is just very complicated
29:30 right, to prove you ran a snark verifier that itself verified a proof that verified a proof. And so the surface area for bugs just gets very large. And yes, I'm very optimistic that the same AI tools that are scaring people about cryptography will also help us get all the bugs out. That's a very hard problem. So, you know, we have to speculate just as much on, I know the bugs is like a really, really, really hard problem. So the AI is going to have to be really good if we're going to get all of those bugs out from a system that complicated.
29:59 And I think relying exclusively on hashes amplifies that. And the other thing is that we don't understand the security of snark recursion very well. So that's another, you know, you tell me lattices might be attackable. I say, well, I don't know about snark or curt. You know, again, there's a lot of non-quantifiable risks, and, you know, I'll just leave it at that. We have to do our best to weigh these things, and the public discussion weighing them can be pretty frustrating sometimes. Yeah, that's right. I do want to make one more point on the hash-based versus lattice-based.
30:30 It is quite important to understand that lattice-based systems have much better properties than hash-based, which is actually why many in the crypto community are pushing to. towards lattice-based systems. So things like threshold signatures, things like non-hardened key derivation, there are many properties of hash-based systems that we simply don't have with hash-based systems. Also, hash-based systems are harder to use in principle.
30:55 Like Justin was saying, they're much larger, and they're stateful versus stateless. There are many technical issues with getting hash-based signatures to work. So many of us cryptographers are actually a little sad that some of the blockchain community will move to hash-based signatures that really have no algebraic properties
31:17 for us to leverage for more advanced applications. So in some sense, there's a trade-off that we're making in perhaps we are removing assumptions from the blockchain space, but we're also removing capability in that now we are going to be using signature schemes that have far fewer properties than what we would have,
31:38 if we were using lattices. So as a cryptographer, to be honest, I would be quite happy if we ended up using lattice-based schemes because that gives us much more room to play in and build interesting structures, but the hash-based schemes who are much, much more constrained, but perhaps that constraint is also where this extra sense of security comes from. So maybe to give a quick summary of what we've kind of discussed so far,
32:02 what it sounds like is, you know, and I think Justin led this out very nicely, it is not a given that there is an efficient algorithm that could be found to break this type of cryptography. If there is an efficient algorithm out there, then the time frame at which to find it will have is likely very, very sped up given our advances in AI. And that's where the kind of panic and confusion is coming from
32:27 is the possibility that that efficient algorithm both exists and now the timeline is much shorter than it would be without these advances in AI. and the easiest way to minimize that panic is for more information from the labs to come out on how much work they've done to try to find that algorithm. And if the labs came out and said, you know, we threw a bunch of compute and time and money at this
32:48 and we couldn't crack it, that would give you confidence at least until the next, a big upgrade in the model that we have a reasonable safe security assumption. In the extreme case, it should give you more confidence than the history until today, right? If you really do believe, like many do, like many of the people posting yesterday believe, that these models are now basically at or better than the vast majority of people who are trying to, you know, who are studying these systems, or they will be soon or whatever, then you should get great confidence
33:25 from knowing that the equivalent of, you know, 100,000 expert mathematicians or cryptographers took a look at a scheme. It should actually make you more confident than you could have ever been about one before that. I can't help but emphasize. We need to reconsider just how we even decide
33:44 what we feel confident about. So we've talked a little bit about if you're an institution, there's a lot of these security best practices that you probably are already doing or should have been doing already. If you're an everyday user, nothing to do at the moment,
33:58 don't panic, continue on. If you're a startup that wants to take advantage of this really interesting kind of like piece of technology unfolding in this way. Are there startup opportunities here and where a new company might be able to come in and help? I think the most obvious note that I take out is that, well, startups will have to need to have, you know, seriously consider what types of security assumptions they make in their software today. You know, however they design their systems. That's already kind of happening on multiple fronts, right? how people think about open sources changing, right?
34:34 Didn't close source? Basically, everyone recognized closed source died last week, right, because of our ability to decompile things. It's also the case that because of the agentic properties of AI systems, by agentic properties, I mean, they can go on unbounded side quests, right, and do all kinds of random things in pursuit of a goal for you. Because of this, we have to think very carefully
34:59 about the security boundaries and sandboxes and capabilities-based permissioning schemes we put around AI agents. So we're already thinking about rethinking security from that lens. This is just yet another way. We need to reconsider what systems are capable of and how to design software and products
35:18 that remain secure and that protect users as much as they empower them. I would go even a step further. I think that these new capabilities are a gift to startups and to even a more established software shops. So I can tell you in the past, when the time when a cryptosystem
35:37 becomes really interesting to attack is once it's announced that it's about to be deployed or is already deployed. This is when after it's deployed, it gets a lot of attention from cryptographers. And that's kind of the wrong time to attack a crypto system.
35:52 Whereas now, because we control these AI models, any startup or any software shop that's deploying a new crypto capability or actually even deploying any software at all can now have these models analyze its cryptography and analyze its general software for bugs. This is an incredibly powerful tool that didn't exist before.
36:13 Over time, as more and more software shops adopt this technology, I believe that software quality is going to go up, crypto quality is going to go up because nothing will ship unless the model said that it's valid. I saw someone recently because of the release of like 5.5 haiku, they were comparing with 4.5, right?
36:35 And making many comparisons between models from a year ago versus today. And it's always hard to do an apples to apples comparison when the capabilities per token have increased so much. But some people were coming up with estimates like it's 90 plus 95% cheaper, right? 99% cheaper for, you know, intellectual capability per dollar, right? If that's the case, and you pair that with a frame we've said before, we talked about before, which is that the number of bugs in software is finit, right? Then we're asymptotically approaching zero bugs.
37:19 Maybe, and maybe we actually just hit zero at some point. Maybe we have the ability to create zero with some assumptions, right? if that's the case, we are net improving the security status of the world instead of eroding it, right? This is not a battle of wits where you have a system, I have a system, your system is smarter than mine, therefore I am vulnerable to you. Like, no matter what, no matter how I configure myself, you can overpower my computer and destroy my computer, right? That relies on there being vulnerabilities, and vulnerabilities can be removed. they can be designed away, they can be mitigated. And the primary resource we dedicate to mitigating it
38:01 is the thing that's getting radically cheaper every couple months. And that's, you know, AI capabilities, intellectual capabilities, you know, intelligence, machine intelligence, whatever. You want to call it? Companies actually are already doing this. Companies are actually spending a lot of money on exactly scanning their code base with the latest models. and it's actually really quite interesting.
38:25 Every time there's a software update, they scan the model, the software again. Every time a new model comes out, they scan the model again. They scan the software again. And so I have to say, one of the interesting research questions in the space is something actually we are quite interested in
38:38 is how do we do software scanning more efficiently. Yeah? So we don't have to maybe rescan everything every time a new model comes out or every time a change is introduced. So there's even lots of interesting areas for thought and research here.
38:53 Yeah. Let's say the labs take up your plea. They throw a bunch of compute at it. And they come out and they say, you're right. We did break elliptic turf cryptography, actually. What happens next? Like, you know, we record this podcast today and tomorrow, what does the world look like?
39:09 What is the next step? Then basically we have to move to post-quantum cryptography, which we're already doing. We have to move to these lattice-based systems, which are already deployed. If you look, by the way, You can literally look at many internet connections today. They are actually using agile cryptography.
39:25 They're encrypted using elliptic curves and lattices at the same time. If you break elliptic curves, it doesn't matter because it's also encrypted under a lattice basis. Didn't like IMessage make that migration last year and many other such systems have done that? Exactly. Signal and so on. Yes, yes. In fact, but I was actually referring to one of the TLS exchange methods. I guess it's called X-25519, ML Chem-7.
39:49 It's a jumble letters, but what it means is you're protected by both elliptic curves and lattices. Now, maybe the labs come forward and say, oh, we broke both, right? Well, fine. Then we introduce a third one. We'd have to standardize. I would be a longer process, but that would be what would come next. So we kind of know where to go. It's just going to be more work and perhaps more of a rush.
40:13 Yeah, and maybe at the risk of stating the obvious, like, I have no doubt they would be prudent enough to do this the right way. it goes without saying, but the labs shouldn't go and share this, just like throw out a scheme to break, break elliptic curves. They should responsibly disclose it to, I said, to the industry, to the government, to the industry,
40:36 develop a plan, and everybody needs to update their software as quickly as possible, and hopefully we could move quickly and adapt. But again, that is a known process that a lot of people take for granted. Like, it's almost like silly I'm saying it because security experts know this very, very well.
40:56 And so there is a way to do such a thing should it happen. Great. Well, thank you for that. I feel calmer. So hopefully everyone else does as well. Thanks so much. This was fun. Thank you, Liz. Thanks for listening to this episode of the A60Z podcast. If you like this episode, be sure to like,
41:16 comment, subscribe, leave us a rating or review, and share it with your friends and family. For more episodes, go to YouTube, Apple Podcasts, and Spotify. Follow us on X at A16Z and subscribe to our substack at A16Z.com. Thanks again for listening, and I'll see you in the next episode.
41:35 As a reminder, the content here is for informational purposes only. It should not be taken as legal business, tax, or investment advice, or be used to evaluate any investment or security and is not directed at any investors or potential investors in any A16Z fund. Please note that A16Z and its affiliates may also maintain investments in the companies discussed in this podcast.
41:55 For more details, including a link to our investments, please see A16Z.com forward slash disclosures.
There aren't comments yet for this episode. Click any sentence in the transcript to leave one.