Tyyps

I think you are missing the points of my argument, my argument don't stand on AI isn't capable of discovering new techniques, as I don't believe in new techniques from the sky. My argument is about any targeted goal based AI (which to the best of my knowledge is the case for LLMs as used now). My point is, if there exists a computationally bounded path from existing work that led to solving a conjecture and if the goal of the AI is to solve this conjecture, then alternative path that would have led to new discovery will be dismissed on the way (or lost in the computational trace if you prefer), leading to the conjecture being solved but maybe closing forever/for a long time new paths. I don't see how you could have as a goal to explore alternative path without a good metric of what is a good alternative path (like rating a chess position), which to me, seems unlikely to exist. If you don't have such metric then you would have a clear exponential blowup. More like a percolation problem if you prefer, a neglected approach might have introduced a concept that would make further discoveries accessible. Missing that concept could therefore leave a whole region unexplored, not just one branch of one proof.

I guess you can see this as an exploration problem, in pure maths, while the goal is to solve a conjecture, the limitation of humans on pure computational power led to the exploration of alternative paths. Sometimes, these paths weren't leading to solving the initial conjecture but opened new idea and new direction. Sometimes a less direct but more humanly natural path was taken to solve the conjecture which also led to new and humanly understandable questions. In some ways solving the question wasn't the most important part of the work, as this doesn't have direct impact on our life (as I saw people comparing this with drug discovery), but the path leading to the solution raised new conjectures and techniques that further developed the field.

I have a really hard time reading AI proof so this might be a biased statement, but most of them feels like having a superpowerfull machine, that would have bruteforce all the possible words of finite length in your logical syntax. You have the path to the solution, using tools that where already known and even direction that where abandoned because they seemed to fail for our human brain. But at the end, as a mathematician, you don't learn anything that is really new.

To me this is the main risk with AI and in general the one most mathematican try to explain but fail, we might miss a lot of alternative path that would have raised more interesting questions (I think this is already more or less what is happening). On top of that, we will run out of mathematicians as no one wants to pursue a career in the field anymore.

Full title: Meta Paid Hundreds of Contractors to Pretend to Be Teenagers While Barraging Its Competitors’ AI With Disturbing Content

The model is constantly switching to Opus for me, this is kinda unusable sadly.

About QKD: https://arxiv.org/abs/1803.04520

There is no clear evidence that the risk of "a practical post quantum computer would arrive in the next 5 years" is greater than "post quantum scheme X is broken" for any scheme X. The only way to go is hybridation and it is quite hard from an engineering point apparently.

I think it is pretty direct from my comment that if you use a hybrid approach (done correctly) you can rely on the hardness of dlog based assumption and therefore my comment on potential weakness of PQ assumptions can be ruled out. In this way we disagree that rushing PQ is the appropriate choice if it rules out dlog based security.

> He's also pointing out that the only scenario in which hybrid is of benefit is one in which crypto related QC remains either relatively ineffective or extremely expensive in the medium term. Since that assumption is looking increasingly suspect it calls into question the point of hybrid to begin with. In the face of cheap QC hybrid adds zero value.

This is exactly what I'm pointing out as extremely dangerous. My take was that the risk of seeing a quantum computer breaking dlog in a near future isn't stronger than breaking PQ assumptions in a near future.

He is assessing that the risk of seeing a quantum computer break dlog cryptography is stronger than the risk of having post quantum assumptions broken, in particular for lattices.

One can always debate but we have seen more post quantum assumptions break during the last 15 years than we have seen concrete progress in practical quantum factorisation (I'm not talking about the theory).

I agree, but the blog post was specifically ruling out hybrid approach.

This is quantum annealing and it has nothing to do with Shor (I should have been precise sorry).

It is not clear at all that quantum annealing provides any speedup compared to a classical computer.

Just a little selections of recent attacks on a few post quantum assumptions:

Isogenie/SIDH: https://eprint.iacr.org/2022/975

Lattices: https://eprint.iacr.org/2023/1460

Classical McEliece: https://eprint.iacr.org/2024/1193

Saying that you can trust blindly PQ assumptions is a very dangerous take.

Indeed anti-hybrids arguments are very dangerous takes at best. People are putting a tremendous amount of faith in very understudied assumptions, in particular given the complexity of geometric relations and the structure of current lattice based scheme.

I think people have to be extremely careful with this kind of opinion. In particular seeing such a push for post-quantum crypto while the current state of the art for quantum factorisation is 15 and 21 and the fact that current assumptions (for KEM in particular) are clearly not as studied as dlog.

It's maybe good to remember that SIDH was broken in polynomial time by a classical computer 3 years ago... I'm really concerned by the current rush for PQ solutions and what are the real intentions behind it. On a side note there might even be a world where a powerfully enough quantum computer that break 2048 bigs RSA will never exists (Hooft, Palmer... Recent quantum gravity theory).

The anti-privacy movement in Europe is really concerning. In particular as general population don't really care about it, we are going toward some major shifts. I'm wondering though how this radical turn was initiated and if some lobbies are pulling the strings behind the scene...

I think you are mixing the function itself and it's output, if for a given input to the function the output is uniformly random, then this is a way to derive randomness. The fact that the function itself is deterministic tells you nothing about the distribution of it's output.

He is technically not wrong, most signatures can be seen has a public coin interactive proof system where you prove knowledge of a private key. They are then compiled into an non-interactive proof system via the Fiat-Shamir transform that uses a random oracle concretely instantiated using a hash function (easy to see in Schnorr signature). So at the end you are using a Hash function to generate your random coin.

Hash functions are used to instantiate a random oracle (which is a theoretical object that can't be instantiated because it would be of infinite size but makes it easy to reason about) because it doesn't seems crazy as an assumption that finding if finding a collision between 2 hashes it should be hard to predict the output of the so called hash function. However it is well known that there was some contrive counter example for protocols that are secure under the Random Oracle model and unsecure when instanciated with any hash function. The problem with this paper is that the protocol it described isn't so contrive anymore. Cryptography is a matter of assumptions and what you believe in or not. You might want to not use random oracle but you will therefore have to restrict yourself in what you can concretely build.

And the reason behind the problem outlined in the paper isn't a biased randomness problem but the fact that you can represent the hash function compared to a RO.