We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Hacker News·28d ago·5 min read
AI Meets Cryptography 1: What AI Found in Cloudflare's Circl
TL;DR
AI was used to audit Cloudflare's CIRCL cryptography library, uncovering seven significant bugs, including critical vulnerabilities in RSA and attribute-based encryption. The AI audit agent, zkao, aims to continuously identify and fix bugs in cryptographic code.
✦ Why It Matters
Engineers should consider integrating AI audit tools like zkao into their cryptographic projects to enhance security.
Key Takeaways
- Implement AI tools like zkao for continuous code auditing.
- Regularly update cryptographic libraries to fix identified vulnerabilities.
- Conduct experiments to understand AI reasoning in cryptography.
- Use insights from AI audits to improve code security practices.
Full Summary
Cloudflare's CIRCL is an experimental cryptography library that was audited using an AI tool called zkao, developed by zkSecurity. This AI audit pipeline identified seven real bugs, including a critical precision loss in threshold RSA and a complete access-control failure in attribute-based encryption.
The methodology involved using large language models (LLMs) to scan open-source cryptography projects, focusing on both finding vulnerabilities and understanding how LLMs reason about cryptographic code. All identified bugs have been fixed upstream, demonstrating the potential of AI in improving software security.
The ongoing experiments not only surface vulnerabilities but also contribute to building a benchmark suite for zkao, enhancing its bug detection capabilities. Insights gained from these experiments help refine the AI's reasoning patterns, amplifying its strengths and mitigating its weaknesses in cryptography.