On October 6, OpenAI makes an announcement about an unreleased internal model resolving long-standing open problems in mathematics. https://openai.com/index/sharing-ai-progress-in-mathematics/
Then Justrin Drake tweets this original ↗ And calls upon the blockchain industry to "calmly begin planning for 'bunker mode'."
"IMO it is now reasonable to brace for the possibility that ECDSA breaks before qday, in the worst case in months not years. By "break" I mean fast private key recovery (e.g. in one week) on available hardware (e.g. a large GPU cluster).
Recent days have been humbling for human mathematical intuition. Long-held, unquestioned hypotheses have fallen. This includes the n log(n) bound for integer multiplication and the 3SUM conjecture. In hindsight, May's unexpected disproof of the Erdős unit distance conjecture was our warning shot.
Yesterday's OpenAI drop made it clear that mathematical superintelligence is upon us. They say there are weeks where decades happen. We are about to live through weeks where centuries of mathematical progress happen. Could our magic 64-byte ECDSA signatures be too good to be true? Was it just security through obscurity all this time?"
Many others chimed in. Some agreeing with the possibility of AI breaking crypto/ECC, others saying it is FUD and there is no evidence to suggest AI could break ECDSA.
Vitalik original ↗ Neutral
Matthew Green original ↗ Agreed
Christopher Portmann original ↗ Disagreed
This section that follows was an AI generated summary
Yehuda Lindell (head of cryptography at Coinbase, professor at Bar-Ilan) wrote the sharpest technical rebuttal, calling the post “a really bad take” and “the very definition of FUD.”
His thread argued there is “no evidence whatsoever” of a break in elliptic-curve hardness; that AI proving hard theorems does not imply assumed-hard problems are easy; that hardness assumptions rest on a belief in inherent hardness, not only on “humans haven’t found an attack”; that hashes have historically been broken more often than elliptic curves; and that a real ECC break would also forge PKI certificates and signed software, so treating it as a crypto-only bunker problem is incomplete.
End of AI generated content
Yehuda Lindell's tweet original ↗
My take? Bunker mode is such a braindead suggestion, that if that is a serious suggestion, I have to doubt the mental capacity of the individual who made it, and side with the "This is FUD" crowd. Even if you were to protect your funds by sending to a new address that never spent before (bunker mode), as soon as it was general knowledge that crypto is not safe, the entire market goes to zero overnight. And crypto is not the only thing imploding either. This FUD will be the catalyst everyone points to for why we are back at bear market lows by the end of the year.
Either way, sounds like we are about to live through centuries of progress in years. One step closer to the singularity.
Thoughts?
Matthew Green expanded on his "I think we might lose public key cryptography." comment: https://x.com/matthew_d_green/status/2108278850555674975 original ↗
the math-ai news is real. no one doubts now that theorem-proving math is a solved problem. “ecdsa dies in months” is not. proving a theorem is not the same as pulling a private key. agree with @shortwavesurfer2009. if that actually breaks it is not a monero problem. it is every cert, every bank login, every signed update. the whole internet is on fire.
@samourai is probably right though. if someone breaks it, it is some government with exclusive access to models the public does not get. they are the first ones interested in keeping the status quo and a stable situation. and they are not gonna tell us unless there is a whistleblower.
The prep is not "ECC dies next month." It is: the people who already know where the structure is just got a faster lab. And IMO they will not announce it when they do.
Honestly, if we get to the point where an AI can break cryptography, we've got a hell of a lot more to worry about than cryptocurrency.
Think nuclear launch codes, for example. Just depends on what kind of damage you want to do.
I filed these types of things under worth keeping an eye on, but not worth stressing about. If it happens, it happens, and we'll deal with it. And if it doesn't happen, then it doesn't happen. Pretty much all fiat currencies would immediately fail as well because most fiat currency is just database entries. The only thing that might retain some residual value would be the paper cash or gold
I think the encryption being broken is always a threat regardless of the source. The only thing that can be done about it is to continuously rigorously test cryptography breaking methods, test new cryptographic encryption methods, and attempt to adjust to new developments in cryptographic offense or defense no matter the origin. Luckily I think monero actually has the best defense against this. If such a technology is invented than you would have to target accounts at random to try and determine which ones would be high value enough to prioritize their decryption otherwise you might spend more time and money attempting the decryption than you would get from looting the account. The worst case would probably be that someone figures out an exploit, immediately drains a couple high profile wallets, and then the whole economic model gets thrown out the window as everyone panics to sell and it doesn't end up mattering anyways. A much easier attack to perform would be if someone FALSELY CLAIMS that this happened. Also, I do think there is a takeaway for devs here:
If possible (it very well may not be, I'm not a crypto dev), we should have a drill to swap algos in a testnet to enable a pivot if this ever happens. If such a thing isn't possible, can the codebase be modified to be more modular so it could be possible?
I think bunker mode is a reasonable intermediary precaution. Breaking ECDSA w/ a classical algorithm and breaking it w/ a quantum computer are two different problems, but that's the closest sibling of it I can think of.
For example, Solana's Winternitz Vault uses hash-based one-time signatures instead of Ed25519. This's primarily relevant to quantum resistance, since Shor's algorithm doesn't give you the same shortcut against hash functions that it does against elliptic curves.
Would it solve the hypothetical AI breakthrough Drake's talking about? IDK, depends on what exactly gets broken. But it shows we can experiment w/ alternatives today, even if they come w/ tradeoffs and aren't a drop-in replacement for existing wallets, stuff we have.
These breakthroughs may come crazy fast. I think "as soon as it was general knowledge that crypto is not safe, the entire market goes to zero overnight" is a bit too catastrophic an assumption. Different chains use different cryptographic primitives, and breaking one doesn't necessarily mean all cryptography is broken tomorrow. Some breaks could and probably will be partial, affecting certain schemes, implementations or use cases more than others.
I'd rather have vaults and stuff ready as potential alternatives, and migration paths we can actually use, than watch everything burn while we're figuring out what to do IMO :P
Kayaba Luke our dear Serai amateur cryptographer (his words IIRC, not mine) would be the guy to ask such question.
Just today I was watching MikroTik software update video, saw that they included support for hybrid post quantum key exchange for SSH. Took a note. I'll check this topic further and will probably swap my keys, we'll see.
https://stasher.news/uploads/714
https://youtu.be/ZUjiBTaltvQ original ↗
My thoughts on all these aren't mature thought TBH.
Even if there are chains which remain safe in this hypothetical scenario, it will get dragged down by the rest of the market. Nobody is going to think "OK, which crypto IS safe? so that I move my money to safe crypto?"
No, they will panic, and yell in unison "GET OUT OF CRYPTO, AI BROKE CRYPTO. YOUR MONEY IS NOT SAFE IN CRYPTO. WALLETS BEING DRAINED AS WE SPEAK."
So it doesn't matter if you've taken all the right steps to secure your funds/chain. If Bitcoin or ETH or some other chain gets pwned by AI, thats a black swan event and your coins are going down 50 to 99% quickly.
The problem I have with these hypotheticals is that they are impossible to disprove because they are based on unknowns. You can't prove there is something we don't know that AI is going to discover this unknown knowledge and pwn encryption as we know it. Its like saying, "Prove there isn't a meteor made out of an invisible new undiscovered element hurtling towards the earth right now to destroy it."
@untraceable: it's always and everywhere impossible to prove. That's why I emphasize the importance of alternatives here:
#340543
Agreed. I've been an advocate for holding precious metals for quite a while.
https://stasher.news/uploads/738