Cryptographers Debate Whether LLMs Could Break Symmetric Encryption

On November 3, Johns Hopkins cryptography professor Matthew Green and cryptographer Stefano Tessaro engaged in a multi-round public debate on X over whether LLMs pose a threat to symmetric cryptography, centered on whether LLM-driven cryptanalytic attacks can generalize to real-world deployed symmetric encryption algorithms.

Confirmed

• Key facts from Green: the best known attack on AES-128 only reaches 7 rounds, requiring roughly 2^89 computation and 2^105 queries—nowhere near the deployed frontier; AES-128's security strength sits right at the 128-bit key limit.
• Green argues the intuition that "more rounds = more security" still holds: no attack on a full cipher has ever beaten brute force, and cryptanalysis only covers a very small class of attacks.
• Green also surveyed the taxonomy of symmetric cipher constructions—ARX variants, DES-style S-box structures, SPN-type AES and wide-block AES variants, Snow-class LFSR structures, table permutations, etc.—noting that attacks almost never generalize across constructions, in response to Tessaro's claim that the space of feasible constructions is overestimated.
• Tessaro's core position: "attacks don't generalize" is largely a problem of how science is presented—writing attacks in general form is hard, but for anyone who knows how to ask, generalization is just "one LLM query" away; he also believes people overestimate the space of feasible constructions while underestimating attack generalization, noting that deployed block ciphers fall into only two major paradigms with too few people working on them publicly.

Unconfirmed

• Whether LLMs can actually generalize existing narrow-domain cryptanalytic attacks into cross-construction universal attacks: neither side provided empirical evidence, so this remains a disagreement of academic judgment rather than a conclusion.

Why it matters

• This debate bears directly on how the long-term security of mainstream symmetric ciphers like AES should be assessed in the AI era: if Tessaro's "generalization is one prompt away" holds, current security-margin arguments would need rewriting; if Green is right, LLMs merely amplify existing cryptanalytic tools without changing the security landscape of symmetric cryptography.

2026-11-03 ~ 2026-11-03 · 6 related posts

• Matthew Green: 'More rounds = more security' still holds for symmetric ciphers — matthew_d_green · 2026-11-03
• [source] Tessaro: deployed block ciphers span just two paradigms, too few studying them — StefanoMTessaro · 2026-11-03
• Matthew Green maps the cipher construction zoo where attacks rarely generalize — matthew_d_green · 2026-11-03
• [source] Cryptographer Tessaro: generalizing LLM cipher attacks is just an LLM query away — StefanoMTessaro · 2026-11-03
• [source] Matthew Green: LLM-generalized attacks still nowhere near breaking symmetric crypto — matthew_d_green · 2026-11-03
• Cryptographer Matthew Green pushes back on LLM cryptanalysis fears: best AES-128 attacks still need 2^89 work — matthew_d_green · 2026-11-03