“…and he saw his own name which nowhere else could he have ciphered out at all logged into the records as a thing already accomplished.”
— Cormac McCarthy, Blood Meridian
I’ve lately been experimenting with LLMs and cryptanalysis. A month ago I argued that LLM wouldn’t break symmetric crypto. Today here I am, breaking a blockcipher using an LLM.
I recently got access to OpenAI’s DayBreak Blue, or GPT‑5.6 Sol “with safeguards tailored to authorized defensive security work.” I asked it to look through ePrint recent experimental symmetric crypto schemes. It found MERIDIAN, “A Toroid-Inspired Permutation Block Cipher for Constrained Environments,” described in a 199-page paper:
If you’ve been doing cryptography seriously for a while you can’t read “toroid-inspired” without seeing a red flag. I then read the abstract and my cryptographic spidersense tingled: it’s not Time AI-level nonsense but it doesn’t read like the work of experienced cryptographers—and I don’t mean that in a demeaning way, my own early research was early research.
GPT 5.6 took less than 5 minutes of “thinking” to find an attack, and a trivial one: the blockcipher is not a permutation, which means that you can find distinct plaintexts mapping to the same ciphertext: it found two distinct internal states
A = 02290229022902290229022902290229
and
B = 02460246024602460246024602460246
that collide after MERIDIAN’s first nonlinear layer:
DS(A) = DS(B) = dd96dd96dd96dd96dd96dd96dd96dd96
Consequently, the construction is noninjective for every key. No inverse permutation exists, so MERIDIAN cannot provide uniquely defined decryption. GPT also found a differential with probability exceeding that of the claimed bound.
The main issue I ran into was GPT repeatedly censoring itself before finishing an answer and replacing the current text with a safety warning. After a couple attempts it completed its mission:
…
…
Then I asked it to write a Python proof-of-concept implementation. I checked that GPT’s understanding of the specs and analysis were correct. The collision blunder was so bad that I first assumed GPT has misunderstood the paper, but I triplechecked the author’s definition and their cipher is indeed flawed. I also checked the differential to the best of my abilities.
Next I asked another LLM (Gemini) to verify the analysis and the PoC code:
…
…
..
What’s a bit unfortunate is that nowhere in the 199 pages do the authors provide test vectors, which is the second most important thing in such a paper after the specification of a cipher.
Finally, I asked GPT to draft a one-page PDF, which I then edited and which you can download here or here (I’ll probably also submit it to ePrint.)
Featured image: Steins;Gate