AI能破解密码学吗？专家的真实看法

突然之间，密码学领域出现了一个新的威胁：我们的AI朋友真的能攻击那些我们以为很安全的加密系统吗？

All of a sudden, a new threat emerged in the world of cryptography, which is whether our AI friends can actually attack crypto systems that we thought were secure.

大家担心的是，如果这些系统能被破解，AI实验室可能会动手。

The fear here is that the AI labs could break them if they are breakable.

人们尝试去破解但都失败了，这反而让我们更放心。

The fact that people try to break them and fail gives us more confidence.

NIST已经在标准化其他多种公钥系统，我们可以随时切换过去。所以万一某个假设被推翻，我们还有备用方案。

NIST is already standardizing many other types of public key systems that we can switch to, so if it turns out one of our assumptions is broken, we have backups.

我们只需要搞清楚这一点。

We just need to know.

这里有没有初创企业的机会，让新公司进来提供帮助？

Are there startup opportunities here where a new company might be able to come in and help?

AI在解决复杂数学问题方面越来越强了。

AI is getting better at solving difficult math problems.

它最终会不会攻破保护银行系统、私人消息和加密货币钱包的加密技术？

Could it eventually break the cryptography protecting our banking systems, private messages, and crypto wallets?

OpenAI最近的一些成果引发了人们对现代密码学安全性的新担忧。

Recent results from OpenAI have sparked new concerns about the security of modern cryptography.

在本期节目中，a16z Crypto的Liz Harkavy邀请了斯坦福大学教授Dan Boneh、普通合伙人Eddy Lazzarin以及研究合伙人Justin Thaler，一起分辨事实与猜测。

In this episode, a16z Crypto's Liz Harkavy is joined by Stanford professor Dan Boneh, general partner Eddy Lazzarin, and research partner Justin Thaler, to separate fact from speculation.

他们讨论了这些最新突破到底说明了什么，AI威胁与量子计算有何不同，以及为什么现在没有必要恐慌。

They discuss what the recent breakthroughs actually tell us, how AI threats differ from quantum computing, and why there's no reason to panic today.

他们还解释了AI最终如何帮助让密码学和软件变得更加安全。

They also explained how AI could ultimately help make cryptography and software more secure.

嘿，欢迎来到我们今天的节目。

Hey, welcome to our show today.

我是Liz。

I'm Liz.

今天和我一起的是斯坦福大学教授Dan Boneh，以及我们a16z团队的两位成员Eddy Lazzarin和Justin Thaler。

I'm joined here with Dan Boneh, a professor at Stanford, and Eddy Lazzarin and Justin Thaler, two members of our team here at a16z.

我们今天要聊的是一个最近引发热议的话题，起因是昨天安全研究员Justin Drake发的一条推文，他警告加密行业要开始准备他所谓的“地堡模式”，主要是担心AI的进步会导致密码学被突破或破解，速度甚至可能比量子计算机还要快，而量子计算机通常是我们讨论现代密码学和最新技术时的主要话题。

We're here to talk about a pretty big discussion that's going on right now that's been kicked off yesterday by a tweet that a security researcher, Justin Drake, put out, warning the crypto industry to start preparing for what he's calling bunker mode, specifically around this worry that the advances in AI are going to cause a breakthrough or breaking of cryptography faster even than a quantum computer might, which is normally the basis of the discussion that we have when we think about modern-day cryptography and what the state-of-the-art looks like.

所以他呼吁各大机构开始考虑转移资金，并开始思考这个问题。

And so he called on big institutions to start thinking about moving funds and start thinking about this.

而这一切很大程度上是由OpenAI发布的一些论文引发的，他们在之前未解决的数学问题上取得了各种突破，以及这些突破与密码学的关系。

And a lot of that has been kicked off by some papers that OpenAI put out and different kind of breakthroughs they had in mathematical problems that were previously unsolved, and how that relates back to cryptography.

那么Dan，不知道你是否想总结一下那些突破是什么，或者那些论文发表了什么，以及这些是如何引发这场讨论的。

And so Dan, I don't know if you want to kind of summarize what those breakthroughs were or what those papers put out and how that kind of kicked this off.

那让我们来看看。

So let's see.

我想我首先要说的是，大家都冷静一下。

I guess the first thing I should say is everybody calm down.

别慌。

Don't panic.

冷静下来。

Calm down.

今天的世界和一年前、两年前是一样的。

The world today is the same as it was a year ago, two years ago.

这是第一条信息。

That's the first message.

在开始之前，我想先确保大家理解一致，因为现在有两件事被混在一起了，我觉得我们应该先把它们分开。

Now, I guess before we get started, I just want to make sure people are on the same page and that there are kind of two stories that are getting entangled, and I think we should first disentangle them.

一直以来都有关于量子计算对密码学威胁的讨论。

There is this long-going conversation on the threat of quantum computing to cryptography.

但这次不是关于这个的。

This is not what this is about.

这次突然出现了一个新的威胁，就是我们的AI朋友能不能用它们的超级智能去攻击那些我们以为很安全的加密系统。

Here, there's all of a sudden a new threat that's kind of emerged in the world of cryptography, which is whether our AI friends can actually attack crypto systems that we thought were secure, using their super intelligence and so on.

所以这一切的背景是，大约有700篇论文被放到网上，展示了数学和计算机科学领域的巨大进展。

So I guess the backdrop to all of this is that around 700 papers were put up online, presenting enormous progress in mathematics and computer science.

我对网上这些成果的印象之深，简直无法用言语表达。

I can't say enough about how impressed I am with the results that have been put on online.

看到这么多进展，真的非常了不起。

It's really quite remarkable to see all the progress.

我记得这个一上线，我的收件箱就爆了。

I remember my inbox blew up when this came online.

大家都在问我的看法什么的，所以我就开始浏览那些取得进展的问题列表。

Everybody was asking for opinions and so on, so I started going through the list of problems that progress was made on.

等我浏览完整个列表，我脑子里印象最深的是，哇，这在数学和计算机科学上真是巨大的进步，但里面没有任何关于密码学的问题。

And as I finished the list, the thing that kind of stuck in my mind is that, wow, this is incredible progress in mathematics, in computer science, but there are no questions here on cryptography.

对，连理论密码学都没有，对吧？

Yeah, not even on theoretical cryptography, right?

我的意思是，原则上，在密码学的积极发展方面，有很多有趣的开放问题，比如构建新的密码系统，甚至可能在理论上，有些东西不一定直接与现实世界相关。

I mean, in principle, there are lots of really interesting open problems in constructing positive development in cryptography, constructing new crypto systems, maybe even in a theory, things that wouldn't directly be relevant to the real world.

这些问题在发布的700个问题中一个都没有。

None of those questions were in the list of 700 problems that were posted.

所以你可能会想，那是不是意味着这些模型在密码学方面真的很差？

So you might wonder, well, does that mean the models are really bad at cryptography?

我们不知道。

We don't know.

所以我觉得，我想先呼吁一下那些前沿实验室，请告诉我们，你们有没有尝试用这些模型来回答密码学的基本问题？

And so I think one of the things that I would maybe like to start with is a call to the frontier labs to please tell us, what have you done with trying to use these models to answer basic questions in cryptography?

我想真正的问题是，比如，在攻击标准化和已部署的加密系统方面，现状如何？

I guess the real question is what is the status, for example, on actually attacking standardized and deployed crypto?

前沿实验室有没有试过他们的模型？

Have the frontier labs tried any of their models?

抱歉，我想确认一下你的意思，这条推文引发讨论，不是因为论文里有什么特别关于密码学的内容，而是因为他们在任何数学领域取得重大突破，就意味着密码学也可能有突破？

Sorry, so just to clarify what you're saying, this tweet was not kicked off because there was something in the paper specific to cryptography, but rather that just the fact that they had massive breakthroughs in any sort of mathematics means there is likely a breakthrough in cryptography?

OpenAI 发布的内容涵盖了数百个不同主题的论文。

The OpenAI drop had a variety of papers across hundreds of different topics.

数百个不同主题。

Hundreds of different topics.

其中很多主题，虽然不是专门讲密码学的，但和密码学很接近。

And many of those topics, although weren't specifically about cryptography, were adjacent to cryptography.

可以说，它们涉及到的进展，使用了和密码学进展类似的技巧和数学推理。

I'd say in the loose sense that they involve progress using similar techniques and mathematical reasoning that one would use to make progress in cryptography.

所以他们的缺席有点显眼，对吧？

So their absence is a little bit conspicuous, right?

这就是丹说的意思。

Is what Dan is saying.

而且你得考虑一下这背后的原因。

And it's something that you have to consider the explanations for.

一方面，如果遗漏的原因是AI模型表现不佳，找不到任何东西，而密码学因为某种原因特别坚固，那这本身就很有意思，对吧？

On the one hand, if the reason for the omission is that AI models are notably bad and couldn't find anything, and that cryptography is particularly robust for some reason, that in itself would be very interesting, right?

换句话说，如果实验室尝试在理论或应用密码学上取得进展，但没发现什么值得分享的东西，那这本身就非常有趣。

In other words, if the labs attempted to make progress in theoretical or applied cryptography and didn't really find anything worth discovering, that would be, in itself, very interesting.

另一方面，如果他们确实取得了进展，本来有很多可以分享的，但出于某些原因，他们能分享的内容可能会让人担忧。

If, on the other hand, they did make progress and there could've been a lot to share, but there are reasons that what they could have shared would be concerning.

那知道这一点也会非常有意思。

Then that would be very interesting to know as well.

所以我想回到你最开始提到的那个点，我们刚才有点一带而过，那就是我们目前使用的密码学标准并不一定是人类能破解的。

And so I just want to go back to what you kind of kicked off with here, which is, we kind of breezed over this, is it is not a given that the current cryptographic standards we use are human breakable.

我们现在还不确定它们到底是不是能被破解。

We just don't know if they are or not today.

所以这里的担忧是，如果这些标准真的能被破解，AI实验室可能会把它们攻破。

And so the fear here is that the AI labs could break them if they are breakable.

对，我觉得这点其实特别重要，因为整个密码学都是建立在复杂度假设之上的。

Yeah, I think this is actually a really important point in that all of cryptography is based on complexity assumptions.

没错，它确实是基于一些假设的。

Yeah, it's based on assumptions.

我们得假设某些问题是很难的。

We have to assume that certain problems are hard.

我们没法证明这些问题确实难，因为这跟计算机科学里一个著名的未解之谜——P对NP问题——有关。

The reason we can't prove that those problems are hard is because that's related to a famous open problem in computer science called the P versus NP problem.

某种意义上说，我们得先解决这个问题，才能论证某些密码学难题真的有多难。

In some sense, we first have to resolve that problem before we can actually argue that certain cryptographic problems really are hard.

所以既然离那个目标还远着呢，这周列出来的那些问题，根本连P对NP问题的边都沾不上。

And so since we are very far away from that, none of the problems that were posted this week come even close to resolving the P versus NP problem.

我们仍然需要在密码学中做假设，对吧？

We still have to keep making assumptions in cryptography, right?

这些假设就是某些问题是很难的。

So the assumptions are that certain problems are hard.

比如椭圆曲线离散对数，比如最短向量和格问题。

Let's say elliptic curve discrete log, let's say shortest vector and lattices.

我们有一整串我们熟悉且喜爱的问题，并基于它们构建密码系统。

We have a whole list of problems that we know and love, and we build cryptosystems from.

多年来，很多人都在努力尝试打破这些假设，事实上，关于失败的尝试、部分尝试、部分成功的尝试，有大量的文献。

A lot of people have worked over the years on trying to break those assumptions, and in fact, there's a huge body of literature on failed attempts, on partial attempts, partially successful attempts.

所以这是一个非常活跃的领域，到目前为止，所有这些问题仍然安全，我们的密码系统也基于这些问题。

So this is a very active area, and so far, all these problems remain secure, and our cryptosystems are based on those problems.

但现在有了新的参与者，对吧？

But now there's a new player in town, right?

其他人可能会尝试用其他方法来解决这些问题，也许他们会看到我们人类没有看到的东西。

Somebody else could try to come up with other ways to solve these problems, and maybe they'll see something that us humans have not seen.

那当然是有可能的。

That's certainly a possibility.

但我要再次强调，这并不是什么新情况。

But again, I need to stress, this is not a new possibility.

两年前、五年前、十年前，一个聪明的人也可能想出别人从未见过的新攻击方法，打破某些密码学假设。

Two years ago, five years ago, 10 years ago, a clever human could have come up with a new attack that nobody has seen before and break some cryptographic assumptions.

密码学本质上就是建立在假设之上的。

Cryptography is sort of built on assumptions.

我们知道这些假设可能没有我们想象的那么牢固。

We realize things are built on assumptions that could end up not being as strong as we expect.

所以有人去尝试，这其实是件好事。

And so it's wonderful that people try.

这正是我们建立信心的方式。

This is actually how we gain confidence in our assumptions.

人们尝试去破解这些假设，但失败了，这反而让我们更有信心。

The fact that people try to break them and fail gives us more confidence.

所以实际上，我觉得如果实验室用他们最好的模型来测试我们一些基础的密码学假设，那将是一个非常积极的进展。

So in fact, I would say this would be an extremely positive development if the labs try their best models at some of our basic cryptographic assumptions.

如果模型没能攻破这些假设，实验室也公开说没攻破，那会让我们对这些假设的有效性有极大的信心。

The models fail to break them, the labs say that they fail to break them, that will give us tremendous confidence that our assumptions are valid.

即使他们只是削弱了一点安全性，比如说从我们实际使用的一个问题中削掉了10位安全性，那也是好事。

And even if they shave off a little bit of security, let's say they shave off 10 bits of security from one of the problems that we use in practice, that's great.

这对我们来说是非常有价值的消息。

That's wonderful for us to know.

他们只能削掉10位安全性，这本身就强烈证明了这些假设值得使用。

The fact that all they could do is shave off 10 bits of security is actually already very strong evidence that the assumptions are actually worthwhile using.

另外，我觉得实验室还可以尝试用这些模型来提供比现在更强的证据，证明这些问题确实很难。

Another thing that would be nice for the labs to try is I think we can hope to use these models to give much stronger evidence than we currently have that these problems are hard.

我的意思是，对于很多这些问题，我们目前的证据，比如我们知道它们在最坏情况下和平均情况下一样难，这对某些格问题是有帮助的。

By which I mean, for a lot of these problems, our evidence right now, while we have things like we know they're just as hard in the worst case as the average case, which for some of them, these lattice problems, which is helpful.

但你可以希望展示一些复杂性理论的结果，为这些问题的难解性提供更多证据和信心，证明它们没有高效的算法。

But there are complexity theoretic results you could hope to show that would give more evidence, more confidence in the intractability of these problems, that they have no efficient algorithms.

我觉得丹说得完全对。

I'd say that Dan is totally right.

我们现在对当前密码学有信心，认为这些问题确实很难解，主要原因就是大家几十年来一直在尝试，但始终没找到什么好算法。

Most of the reason for today's cryptography that we have confidence these problems actually are intractable is people have just tried for decades and decades, and haven't come up with any good algorithms.

不过我们也能期待其他类型的证据。

But we can hope for other kinds of evidence.

这些都是纯数学问题，前沿实验室完全可以拿他们的模型来研究。

And those are pure math questions that these frontier labs could be turning their models on.

我们提到的那条推文是关于加密货币钱包以及它对加密领域的影响，但破解 ECDSA 其实有更广泛的影响。

The specific tweet that we're referencing was about crypto wallets and the impact of this on crypto, but there is a much broader implication of breaking ECDSA.

所以我不确定在座的各位是否愿意多讲一点，说说这背后更大的影响是什么，以及为什么它的影响范围超出了那个小圈子。

And so I don't know if maybe one of you is willing to kind of elaborate a little bit more on the larger implications of what that would look like and why it exists outside of that bubble.

请丹来说吧。

Please, Dan.

好的，当然可以。

Oh, yeah, of course.

所以，这个影响，我们就拿现实世界中用到的一个假设来说吧。

So the implication of, let's just pick on one of the assumptions that are being used in the real world.

比如说，所谓的椭圆曲线离散对数问题。

Let's say what's called elliptic curve discrete log.

如果这个假设没有我们想的那么牢固，而且真的有可行的攻击方法，那可就麻烦了。

If it turns out this assumption is not as strong as we thought, and there's actually a realistic attack on it, that would not be good.

对，所以不只是区块链领域，这会影响整个互联网。

Yeah, so not only for the blockchain space, this would affect the entire internet.

说实话，它会影响整个数字世界。

Actually, to be honest, it affects the entire digital world.

所以网上银行、医疗保健、政府通信，所有这些都会受到这种破解的影响。

So home banking, healthcare, government communications, everything is impacted by such a break.

我得说，NIST已经在标准化很多其他类型的公钥系统，我们可以切换过去。

I should say that NIST is already standardizing many other types of public key systems that we can switch to.

所以如果我们的某个假设被推翻了，我们还有备选方案可以转过去。

So if it turns out one of our assumptions is broken, we have backups that we can move to.

实际上，我们有好几个备选方案可以切换，所以我们只需要知道，这件事是不是优先级很高？

In fact, we have several backups that we can move to, and so we just need to know, is this a high priority?

是不是不需要马上处理？

Is this something that we don't need to do right away?

所以，目前缺乏这方面的知识，我觉得在推特圈里造成了一个真空，而这个真空确实需要填补。

And so, the lack of knowledge right now is creating a vacuum, I think, in the tweetisphere, and that vacuum really needs to be filled.

所以，也许稍微简化一下，就是说，在无法证明这些问题很难的情况下，也就是密码学所依赖的那些问题，在无法证明的情况下，我们在某种程度上其实是依赖时间，对吧？

So maybe to simplify just a little bit, it's that the process, in the absence of the ability to prove that these problems are hard, the problems on which cryptography is built, in the absence of that ability, we specifically rely, in some sense, on time, right?

我们基本上就是这么做的。

That's kind of what we are doing.

我知道我有点过于简化了，但我们把这些方案推出来，然后等待。

I know I'm oversimplifying a little bit, but we put these schemes out, and we wait.

我们等待，是因为我们相信，像密码学家和数学家这样的专家正在测试并试图破解这些东西。

And we wait because what we believe is happening is that experts, like cryptographers and mathematicians, are testing and trying to break these things.

如果这些方案存在的时间足够长，有足够多的人讨论、测试，并互相交流他们试图破解这些方案的经验，而他们没能成功，我们就会逐渐建立起信心。

And if they're around for long enough, and enough people have talked about them and tested and talked with each other about their trying to break these schemes, and they don't, we emerge with confidence

它们很难被破解。

that they're hard to break.

而且由于人工智能数学能力进步的速度，时间明显不够用，对吧？

And because of the pace of progress on AI's mathematical abilities, there is a conspicuous absence of time, right?

在进步的速度和我们从那些似乎投入了大部分精力、拥有最强认知能力去审查这些东西的人那里获得的信息之间，存在一种差距。

There is kind of a gap between the rate of progress and the information we're getting from the people who seem to have most of the effort, most of the cognitive ability to even scrutinize these things.

一个全新的认知能力来源出现了，可以用来审查这些东西，但我们没有像往常从学术界、计算机科学和密码学研究机制中听到他们的发现那样，听到他们通过工作发现了什么。

A whole new well of cognitive ability to scrutinize has appeared, and we're not hearing from them about what they are discovering through their work in the normal way that we would from the academic and computer science and cryptography research mechanism.

你说得完全对。

You're totally right.

过去，当有人做出假设并基于它构建系统时，我们必须等上10年才能部署那个系统——

In the past, when someone would make an assumption and build a system based on it, we'd have to wait 10 years before that system could be deployed-

……以获得信心，给人们足够的时间来分析这个假设。

... to gain confidence, to give people enough time to analyze the assumption.

我完全同意。

I couldn't agree more.

而现在，突然间，我们可以用这些模型大大加速这个过程。

And now, all of a sudden, we can accelerate this process tremendously using these models.

这真是个了不起的工具。

This is a remarkable tool.

比如说，我提出一个新的假设，并基于它构建一个很棒的加密系统。

Let's say I'm making a new assumption and build an amazing crypto system based on it.

现在我们可以让模型跑一个月，试着破解它，如果模型破解不了，那我们对这个假设的有效性就非常有信心了——

Now we can just let a model run for a month, try to break it, and if the model can't break it, boy, do we have a lot of confidence that the assumption is valid-

……加密系统就可以——

... crypto system can be-

对，这挺有意思的，因为这跟我们通常的做法不一样，对吧？

Yeah, it's funny because it's a change in how we normally do it, right?

通常，我们会把这个公开，或者给公众中有见识的人看。

Normally, we have this to the public or to an informed person in the public.

我们有一个背景关注率，密码学家们会关注这些系统，我们基本上就是等着，等足够长的时间，然后对他们的优先级做一些假设，假设他们在关注重要的事情。

We have a background rate of attention that is paid by our cryptographers to these systems, and we just sort of sit back, and we wait long enough, and we make some assumptions about their prioritization, that they're paying attention to the important things.

过了足够长的时间之后，我们就会说：'这肯定没问题。'

And then after long enough, we say, "This has got to be good.

这应该挺可靠的。'

This is probably good."

但现在情况完全不一样了，实验室可以说：'我们派出了最顶尖、毫无限制、网络能力最强的模型，让它全力去破解，还花了2000万到5000万美元来尝试攻破这个方案。'

But now we have a completely new thing where the labs can say, "We took our tip-top, totally unrestricted, most cyber-capable model, and we told it to go absolutely insane, and we spent $20 million, $50 million trying to break this scheme."

而在另一端，我们对它安全性的信心，可能比传统流程花上十年积累来的还要强得多。

And at the other end, we have more conviction about its confidence than you could probably get from the conventional process in a decade.

所以，我们实际上比以往任何时候都更有信心确保系统的安全。

So we actually have the prospect to have more confidence in our security than ever before.

只是目前信息的生成和共享之间还存在一点脱节。

It's just there's a little bit of a gap in how that information is being created and shared.

我们可以加快部署的进程——

And we can accelerate the deployment-

对

Yes

……更好的加密技术。

... of better cryptography.

而且，这个差距还在于，显然有些模型只有实验室能访问，普通公众接触不到。

And the gap, I have to say, is also the fact that, obviously, some of the models are accessible to the labs but not to the rest of the public.

在缺乏这些信息的情况下，你会怎么建议，或者作为一个普通技术用户，你怎么看待这个问题？

In the absence of that information, what would you recommend, or how do you think about this as just an everyday user of technology?

这对你与技术互动的方式有什么影响，如果有的话？

How does this impact how you interact with technology, if at all?

所以，一切照旧。

So nothing has changed.

今天的世界和一周前、一年前没什么两样。

The world today is the same as the world a week ago, the world a year ago.

一切都没变。

Nothing has changed.

除非我们对标准加密系统有了新的认识，否则一切都没变。

Until we learn something new about our standard cryptographic systems, nothing has changed.

继续按现在的系统使用就好。

Keep using the systems as they are.

等我们学到新东西，要么更有信心，要么就得应对变化。

When we learn something new, either we'll have more confidence, or we'll have to react.

但在获得更多信息之前，一切都没变。

But until we have more information, nothing has changed.

所以别慌。

So please don't panic.

保持冷静。

Keep calm.

换句话说，昨天和今天的反应，并不是针对新信息的反应。

To put it another way, the reaction yesterday, and continuing today, is not a reaction to new information.

这种反应可能间接源于OpenAI公布的数学结果，那是一种关于AI进展的非常间接的信息，虽然很惊人，但我觉得并不意外。

What the reaction is may be an indirect reaction to the dump of mathematical results from OpenAI, a very indirect kind of information about AI's progress, which, again, was amazing, but I don't think is a surprise.

这就像硅谷多年来一直在讨论的那样。

It's like all Silicon Valley's been talking about for years now.

但这并不是针对某个具体的密码学信息做出的特定反应。

But it's not a specific reaction to a specific piece of information about cryptography.

我们并没有发现椭圆曲线比以前更容易受到攻击。

We didn't learn that elliptic curves are vulnerable in a way that they weren't before.

我们也没有发现任何具体的密码学假设的安全性比以前降低了。

We didn't learn that any specific cryptographic assumptions have less security than they did before.

也许为了让大家更有信心，我们有很多不同类型的假设可以用来构建公钥密码学。

Maybe to give people a little bit more confidence also, we have a lot of different types of assumptions that we use to build public key cryptography.

不仅仅是椭圆曲线或格。

It's not just elliptic curves or lattices.

我们还有同源、基于编码的系统和基于多元多项式的系统。

We have isogenies and code-based systems and multivariate polynomial-based systems.

还有很多基于哈希的签名。

There are many hash-based signatures.

还有很多其他类型的假设可以用来构建公钥密码学。

There are many other types of assumptions that we can build public key cryptography from.

所以如果需要应对，我们随时可以应对。

So if we need to react, we can react.

当然，一切都需要时间，但我们大致知道该往哪里走。

Of course, everything takes time, but we sort of know where to go.

所以即使最坏的情况发生，我们仍然有很多办法可以恢复。

And so even if the worst of the worst happens, there are still plenty of ways for us to recover.

有一件事我觉得值得一提，就是我们普遍认为这些问题没有高效的算法。

So one thing I guess worth mentioning is we generally believe there is no efficient algorithm for these problems.

并不是说我们认为可能存在，只是人类不够聪明找不到。

It's not that we think there might be and humans just aren't smart enough to find it.

我们认为根本不存在。

We think there is not one.

所以如果根本不存在，那不管AI多聪明，它也不可能找到一个不存在的算法，对吧？

And so if there is not one, it doesn't matter how smart the AI is, it cannot find a nonexistent algorithm, right?

所以，担心的是我们的这个信念完全错了。

And so, the worry is that just our belief is totally wrong.

但要明确这个信念是什么，对吧，不是说算法存在，而我们太笨找不到它。

But to be clear what the belief is, right, it's not the algorithm's there, and we're too dumb to find it.

而是说它根本不存在，对吧？

It's that it's just not there at all, right?

所以，这是需要澄清的一点。

So, that's one thing to clarify.

第一条推文是以太坊基金会的Justin Drake发的，警告椭圆曲线密码学可能在接下来的几个月内被完全破解，并建议以太坊区块链上至少大型冷钱包进入他所谓的“地堡模式”，或者至少不要在链上暴露公钥。

The first tweet was one by Justin Drake of the Ethereum Foundation, warning of a possible complete break of elliptic curve cryptography in the coming months, and suggesting that at least large cold wallets on the Ethereum blockchain enter what he called bunker mode or at least not have exposed public keys on chain.

然后Vitalik Buterin跟进发了一条稍微缓和一点的推文，但仍然推测AI可能在加密系统上找到更好的攻击方式。

And then Vitalik Buterin followed up with a slightly more toned-down tweet, but still speculating about better attacks that AI might find on crypto systems.

所以，是的，在Vitalik的推文中，他甚至提到他自己在糟糕的迁移中损失的个人资金比所有黑客攻击损失的还要多，对吧？

So, yeah, in Vitalik's tweet, even mentioned that he himself has lost more personal funds in botched migrations than in all hacks, right?

所以，我觉得我们作为人类，往往难以应对那些非常可怕的尾部风险，

So, I think we, as humans, tend to struggle with tail risks that are very scary

而且在存在更紧迫、更现实的风险时，心理上容易让这些风险主导我们的思维，尽管这些风险没那么吓人，也没那么灾难性。

and psychologically prone to dominate our thoughts when there are clear and present risks that are actually more dire, even though less scary and less cataclysmic.

所以，是的，我只想强调，漏洞仍然无处不在。

And so, yeah, I just want to emphasize that bugs remain everywhere.

AI 很擅长发现这些漏洞。

The AIs are good at finding the bugs.

我其实希望，从长远来看，这对防御性实践更有利，而不是对攻击性实践。

I actually hope that's good for AIDS defensive practices more in the medium to long term than offensive ones.

是的，基本上现在最糟糕的事情可能就是做点什么。

And yeah, basically the worst thing you can probably do right now is something.

你应该什么都不做。

You should do nothing.

实际上，Justin Drake 帖子里的建议真的只是良好的实践和卫生习惯，这些机构无论有没有 AI 或量子计算，都应该已经遵循了。

And actually, the recommendations in Justin Drake's post were really just good practice, good hygiene that all of these institutions should already be following independent of AI or quantum or anything.

关于 Justin 提到的机构遵循这些实践，Coinbase 已经出来说他们已经在做了。

To Justin's point regarding institutions following all of these practices, Coinbase already came out and said they already do this.

他们已经采取了 bunker mode 中列出的许多具体措施。

They already do a lot of the specific measures outlined in bunker mode.

而且我觉得他们会继续这样做。

And I think that they will continue to do that.

确实是这样。

It's true.

有趣的是，你越深入这个话题，我觉得我们已经在准备了。

A funny thing about it is that the further down this rabbit hole you go, I think we are already preparing.

据我了解，我们已经在准备了。

My understanding is that we are already preparing.

就像丹说的，我们在密码学方面已经有不同的假设可以切换，而且我们已经稍微铺好了路。

As Dan said, we have already different types of assumptions that we can switch to in cryptography, and we've prepared the path a little bit.

我们已经要求市场，也就是机构，采取一些最佳实践，比如确保在相关的区块链上不暴露公钥。

We already require, from the market, I mean, institutions to take some of these best practices, like making sure public keys aren't revealed on the blockchains where that's relevant.

我们已经做了很多这些事情。

We already do a lot of these things.

随着我们了解更多，加上AI研究及其数学能力的加速，我们可能会在准备工作中加入更多的方法。

And as we learn more, accelerated by AI research and their skills in math, we will probably add more and more methods of preparation to our kit.

所以，关于那种“我们需要进入地堡模式，我们需要准备”的说法，最让人沮丧的是，它建议我们做的那些具体事情，对普通人来说可能并不好，而且有风险，而那些应该为这些风险负责的核心机构其实已经在做了。

So the frustrating thing about the take, we need to go into bunker mode, we need to prepare, is that the specific things that it advises us to do are probably not good and risky for normal people to do, and are already things that the hardcore institutions who should take responsibility for these risks are doing.

所以，这并没有带来一套具体的建议，或者什么新的做法。

So there is not a specific set of recommendations that come out of this, specific new practices.

如果说我们在这里呼吁什么的话，我们呼吁的是更多的信息，这样我们才能知道该怎么调整。

If we're calling for anything here, what we're calling for is more information so we can know how to adapt.

如果我说错了请纠正我，但Justin Drake那条推文提到的可能被AI进步破解的密码学类型，和量子计算机威胁的密码学类型是一样的。

And correct me if I'm wrong, but the types of cryptography that this tweet, the Justin Drake tweet, is referring to possibly being broken by advances in AI are the same types of cryptography that are under threat from a quantum computer as well.

所以这个威胁我们已经思考了一段时间，也已经准备了一段时间，如果它来自AI，而不是量子计算机，那它并不新鲜。

So this is a threat we have already been thinking about for a while, a threat we've already been preparing for for a while, and if it comes from AI before-

……它来自量子计算机，那它并不新鲜。

... it comes from the quantum computer, it doesn't make it new.

Dan开头就量子问题和AI数学能力问题被混为一谈发表了一些看法。

Dan opened with a couple of remarks on this about the conflation of the quantum issue from the AI math skills issue.

这些事之所以会被混在一起，部分原因是Justin Drake谈论的很多担忧是关于椭圆曲线密码学的。

And part of the reason why those things get conflated is that what Justin Drake was talking about was a lot of his fears about elliptic curve cryptography.

有趣的是，因为担心量子计算的威胁，人们其实已经开始把椭圆曲线密码学当作可能很快就会被攻破的东西来看待了。

And what's funny is, because of fears of the quantum threat, people have already begun to treat elliptic curve cryptography as something that may be vulnerable soon.

所以针对那些担忧，我们实际上已经着手准备并部署了许多缓解措施，尽管这些措施最初是为了应对另一种威胁而做的。

So we have already actually engaged in and prepared and deployed many of the mitigations you'd need for those exact concerns for a different threat.

所以说他这番话有点奇怪，因为他并没有给出具体、可操作的建议，告诉大家机构应该如何以不同于当前的方式来做好准备。

So that's why it's a little bit of a funny thing for him to say because it didn't come with specific, concrete recommendations about how institutions ought to prepare in a way they are not preparing today.

我还要补充一点，如果Justin警告的情况真的按照他提到的时间线发生了，那对全球所有数字基础设施的安全来说，将是一场灾难性的事件。

I would also add that if what Justin was warning about happens in the timelines he mentioned, it's a cataclysmic event for all digital infrastructure security throughout the entire world.

未来几年内，我们不可能完全弃用椭圆曲线密码学。

There's no way we're fully moving off of elliptic curve cryptography in the next couple of years.

所以，大家把重点放在区块链的安全规范上，跟他刚才讨论的那种灾难性事件其实不太搭调。

And so the focus on blockchain hygiene is just very discordant with this cataclysmic event he was discussing.

不过我得补充一点，量子计算的威胁主要针对的就是这类椭圆曲线系统——

I will add to that, though, that the quantum threat is really only about these elliptic curve type systems-

还有RSA之类的算法。

... and RSA and such.

从某种意义上说，AI威胁的范围更广——

The AI threat, in some sense, is broader-

对

Yes

因为它实际上也可能针对我们的后量子系统——

... in that it could actually also look at our post-quantum systems-

并可能以某种方式削弱它们，甚至可能完全破解它们。

... and potentially weaken them in some way, maybe break them altogether.

所以，知道最新的模型无法破解我们的后量子候选方案非常重要，因为那些是我们正在迁移的目标。

And so it is quite important to know that the latest models could not break our post-quantum candidates because those are the ones we're moving to.

那将会——

So that would be-

非常有帮助。

... quite helpful.

那么，关于该怎么做，我想问题是：我们对此该怎么办？

Now, in terms of what to do, I guess the question is: what do we do about this?

我完全同意艾迪的看法。

I totally agree with Eddy.

答案是我们应该做我们一直在倡导的事情，而我们一直倡导的主要事情之一就是所谓的密码敏捷性。

The answer is we should be doing what we are already preaching to do, and one of the main things that we always preach is what's called cryptoagility.

是的，我们部署的系统能够快速从一种设计切换到另一种设计，如果正在使用的设计被发现不安全的话。

Yeah, that we deploy systems that can quickly switch from one type of design to another if the design that's being used turns out to be insecure.

密码敏捷性在某种程度上是我们应对意外情况的盟友。

Cryptoagility is in some sense our friend for defending against the unexpected.

我们应该继续这样做。

And we should keep on doing that.

是的，密码敏捷性这个术语已经有十多年的历史了。

Yeah, we're already, cryptoagility is a term that's over a decade old.

是的，所以我们应该继续这样做。

Yeah, so we should keep on doing that.

如果我们的AI朋友提出了我们没想到的东西，那么密码敏捷性就会发挥作用，我们会转向仍然安全的设计。

And if our AI friends come up with things that we didn't expect, well, the cryptoagility will kick in, and we'll move to something that remains secure.

这场辩论还带来了另一个机会，来重新讨论一个经常出现的话题，那就是椭圆曲线、哈希函数和格密码，到底哪个更适合作为特定构造和特定应用的基础。

This debate also surfaced another opportunity to relitigate something that comes up all the time, which is elliptic curves versus hashes versus lattice cryptography as the fundamental basis for specific constructions and specific applications.

当然，Dan 说得完全对，AI 的威胁范围更广。简单重申一下，如果密码学依赖于特定问题的难度，那么 AI 可能会在这些问题的任何方案中找到漏洞，对吧？

And Dan, of course, is totally correct that the AI threat is broader because, just to reiterate it slightly, is If cryptography relies on the difficulty of specific problems, it could find flaws in these problems on any of the schemes, right?

不仅仅是椭圆曲线密码。

Not just elliptic curve cryptography.

但稍微深入一点细节，Drake 说的是，格密码和椭圆曲线密码中可能存在某种结构，这种结构可能让它们更容易受到资源充足的 AI 模型的攻击。

But to get a little bit into the details, what Drake was saying was that there may be structure in lattice cryptography and elliptic curve cryptography that perhaps makes it more vulnerable to the ideations of a very well-resourced AI model.

同样，我们并没有从 OpenAI 的发布中了解到任何具体的信息。

Again, we didn't learn anything specific about that per se from the OpenAI drop.

但对我来说，这一点还不太清楚。我想听听 Dan 和 Justin 的看法，除了椭圆曲线密码之外，哈希函数或格密码具体有什么特点，可能让人有理由相信某些方案比其他的更抗 AI 攻击。

But I think it's a little bit less clear to me, and I'd love to hear from Dan and from Justin about what is it specifically maybe about hashes or about lattice cryptography in addition to elliptic curve cryptography that might give someone reasons to believe some are more secure than others to an AI threat.

关键在于，我们认为哈希函数是抗量子的，但它们可能不抗 AI。

And the point there is that we think of hash functions as post-quantum, but they might not be post-AI.

对，没错。

Yeah, that's right.

我们认为格密码是后量子的，但不一定是后AI的，对吧？

And we think of lattice as post-quantum, but not necessarily post-AI, right?

那你怎么看这些呢？

And so how do you think of them?

好。

Good.

所以，在区块链领域，向抗量子密码迁移时，其实有很多争论，关于应该用基于格的签名还是基于哈希的签名。

So the migration to post-quantum cryptography, I guess, in the blockchain space, there is actually quite a bit of debate on whether we should be using lattice-based signatures or hash-based signatures.

在互联网大范围内，没有争论。

On the Internet at large, there is no debate.

在互联网大范围内，大家都在用基于格的密码系统。

On the Internet at large, everybody's using lattice-based crypto systems.

无论是密钥交换还是签名，这已经是定局了。

For key exchange, for signatures, that's a done deal.

但在区块链领域，关于用基于哈希的签名还是基于格的签名，仍然存在争论。

In the blockchain space, there is still a debate as to whether we're going to use hash-based signatures or lattice-based signatures.

一般来说，社区里的态度是，基于哈希的签名更安全，而且有很多理由可以这么说。

Generally, the attitude in the community is that hash-based signatures are more secure, and there are multiple reasons to say that.

一个理由是，如果某个哈希函数被发现没有我们想象的那么安全，我们直接换成另一个哈希函数，一切照常运行。

One reason is that if it turns out that one hash function turns out to be not as secure as we thought, we simply switch it out for another hash function and everything works as before.

这个框架本身是保证正确的。

The framework is guaranteed to be correct.

所以使用基于哈希的签名时，灵活性更高。

So there's more agility when we use hash-based signatures.

如果出于某种原因，核心的格问题没有我们想象的那么难，整个机制就会崩溃，而且我们无法恢复。

If for some reason it turns out that the core lattice problems are not as hard as we thought, the whole mechanism collapses and we have no recovery.

我们干脆就不用格了。

We can just not use lattices period.

所以从某种意义上说，基于哈希的签名比基于格的签名灵活得多。

So in some sense, hash-based signatures are far more agile than lattice-based signatures.

是的，因为基于哈希的方案，虽然具体用的哈希函数可能不同，但整个基于哈希的方案的构造——

Yeah, because a hash-based scheme, although it may vary in the specific hash function being used, the entire construct of a hash-based scheme-

这个框架是可靠的。

The framework is sound

……这个框架是可靠的。

... the framework is sound.

换句话说，在整体架构中，具体选用哪种哈希函数——也就是最可能出问题的那个环节——其实没那么关键。

So in other words, the choice of hash function, which would be the thing that would break, is less important, so to speak, in the grand construction.

而在基于格的密码学里，比如椭圆曲线密码学，各种方案都依赖于某个特定的共同难题或一组共同的假设。

Whereas in lattice-based cryptography, maybe like elliptic curve cryptography, all those different schemes rely on maybe a specific shared problem or shared set of assumptions.

我在区块链领域，特别是比特币和以太坊中经常听到的另一个观点是，我们做出的哈希假设对于区块链其他部分的运行是必要的，比如默克尔树之类的。

The other argument that I hear a lot in the blockchain space, specifically in Bitcoin and Ethereum, is that the hash assumptions that we make are necessary for other parts of the blockchain to operate, Merkle trees and such.

我们在区块链的核心功能上已经做出了哈希假设。

We already make hash assumptions for the core functioning of the blockchain.

所以从某种意义上说，如果我们的签名也是纯基于哈希的，我们就不会给区块链的安全性增加任何新的假设。

So in some sense, if our signatures were also purely hash-based, we are not adding any new assumptions to the security of the blockchain.

相反，如果区块链的一部分使用哈希，而签名部分使用格密码学，突然间我们就有了两种不同类型的假设，其中任何一种失效都会带来问题。

Whereas if for one part of the blockchain, we use hashes, and for signatures, we use lattices, all of a sudden now we have two different types of assumptions that if either one of them breaks, we have a problem.

所以，减少区块链中的假设数量也是大家很期待的一点。

And so reducing the number of assumptions in the blockchain is also something that people are kind of excited about.

我感觉在比特币领域，尤其是跟我交流的核心开发者们，他们对移除比特币中的椭圆曲线假设、让比特币只依赖特定哈希函数的安全性而不需要额外假设这件事感到非常兴奋。

I get a sense that in the Bitcoin space, and particularly the core devs that I talk to, they're actually quite excited about getting rid of elliptic curve assumptions in Bitcoin and having Bitcoin only depend on the security of a particular hash function without any additional assumptions.

某种程度上，以太坊基金会那边也在发生类似的情况。

And in some sense, the same thing is also playing out in the Ethereum Foundation space.

对，我觉得这些就是两者之间的主要对比了。

Yeah, so I think I'd say those are kind of the comparisons between the two.

这是个挺复杂的问题，比表面上看起来要复杂得多。

This is a complicated question, much more so than it appears on the surface.

区块链到底应该完全依赖哈希算法，还是也要用上格密码？

Should blockchains rely exclusively on hashes, or should they use lattices?

首先得说，如果全世界都只用基于哈希的密码学，整个数字基础设施都会面临巨大挑战，因为光靠哈希根本没法做好加密密钥交换。

So, one thing to say is the whole world's digital infrastructure is going to be very challenged if we only used hash-based cryptography because you just can't do good encryption key exchange from that.

另外，特别是在以太坊社区，他们打算通过所谓的 SNARK 递归技术来应对只使用哈希带来的缺点，比如密钥体积变大等问题。

But also, especially in the Ethereum community, the way they plan to use only hashes, which comes with downsides like just bigger cryptography, is to use what's called SNARK recursion.

基本上，你有这些证明，证明你知道一堆签名之类的，然后你证明你知道那些证明，再证明你知道那些证明，就这样一直下去。

So basically, you have these proofs that you know a bunch of signatures or something, and then you prove you know those proofs and prove you know those proofs and so on and so forth.

所以这里有两个问题。

And so there are two issues there.

比较普通的问题是，这真的很复杂，对吧，要证明你运行了一个SNARK验证器，而它本身又验证了一个证明，那个证明又验证了另一个证明。

The more prosaic issue is this is just very complicated, right, to prove you ran a SNARK verifier that itself verified a proof that verified a proof.

所以出错的面积变得非常大，而且，我非常乐观地认为，那些让人对密码学感到害怕的AI工具，也会帮助我们找出所有错误。

And so the surface area for bugs just gets very large, and yes, I'm very optimistic that the same AI tools that are scaring people about cryptography will also help us get all the bugs out.

那是一个非常难的问题。

That's a very hard problem.

所以，我们同样需要猜测，我知道找错误是一个非常非常非常难的问题。

So, we have to speculate just as much on, I know the bugs is a really, really, really hard problem.

所以，如果我们想从那么复杂的系统中找出所有错误，AI必须得非常厉害，而且我认为完全依赖哈希会放大这个问题。

So the AI is going to have to be really good if we're going to get all of those bugs out from a system that complicated, and I think relying exclusively on hashes amplifies that.

另外一件事是，我们对SNARK递归的安全性了解得还不够透彻。

And the other thing is that we don't understand the security of SNARK recursion very well.

所以那又是一个问题，你说格基密码可能被攻击。

So that's another, you tell me lattices might be attackable.

我说：“嗯，我对SNARK递归不太了解。”

I say, "Well, I don't know about SNARK recursion."

再说，有很多无法量化的风险，我就说到这里吧。

Again, there are a lot of non-quantifiable risks, and I'll just leave it at that.

我们必须尽力权衡这些因素，而公开讨论中的权衡有时会让人很沮丧。

We have to do our best to weigh these things, and the public discussion weighing them can be pretty frustrating sometimes.

对，没错。

Yeah, that's right.

我还想再补充一点关于哈希基和格基的对比。

I do want to make one more point on the hash-based versus lattice-based.

很重要的一点是，格基系统比哈希基系统有更好的性质，这也是为什么密码学界很多人都在推动格基系统。

It is quite important to understand that lattice-based systems have much better properties than hash-based, which is actually why many in the crypto community are pushing towards lattice-based systems.

比如门限签名，比如非硬化密钥派生。

So things like threshold signatures, things like non-hardened key derivation.

格基系统有很多特性，是哈希基系统所不具备的。

There are many properties of lattice-based systems that we simply don't have with hash-based systems.

另外，从原理上讲，哈希基系统用起来更麻烦。

Also, hash-based systems are harder to use in principle.

就像Justin刚才说的，它们的体积大得多，而且是有状态的，不像无状态那样方便。

Like Justin was saying, they're much larger, and they're stateful versus stateless.

要让哈希基签名正常工作，存在不少技术难题。

There are many technical issues with getting hash-based signatures to work.

所以，我们很多密码学家其实有点遗憾，因为区块链社区可能会转向基于哈希的签名方案，而这些方案缺乏代数性质，让我们没法利用它们来构建更高级的应用。

So, many of us cryptographers are actually a little sad that some of the blockchain community will move to hash-based signatures that really have no algebraic properties for us to leverage for more advanced applications.

从某种意义上说，这是一个权衡：我们可能确实减少了区块链空间中的某些假设，但同时也削弱了能力，因为我们现在要用的签名方案，其特性远不如使用格基方案时那么丰富。

So in some sense, there's a trade-off that we're making, in perhaps we are removing assumptions from the blockchain space, but we're also removing capability, in that now we are going to be using signature schemes that have far fewer properties than what we would have if we were using lattices.

说实话，作为密码学家，如果最终能采用格基方案，我会非常高兴，因为这给了我们更大的发挥空间去搭建有趣的结构。

So as a cryptographer, to be honest, I would be quite happy if we ended up using lattice-based schemes, because that gives us much more room to play in and build interesting structures.

而基于哈希的方案限制就大得多，不过也许正是这种限制，反而带来了额外的安全感。

With the hash-based schemes, we are much, much more constrained, but perhaps that constraint is also where this extra sense of security comes from.

那么，简单总结一下我们刚才讨论的内容，听起来好像是——我觉得Justin已经讲得很清楚了——并不是说一定存在一个高效的算法能破解这类密码学。

So maybe to give a quick summary of what we've kind of discussed so far, what it sounds like is, and I think Justin laid this out very nicely, it is not a given that there is an efficient algorithm that could be found to break this type of cryptography.

如果真的存在这样一个高效算法，那么考虑到我们在人工智能方面的进展，找到它的时间很可能会大大缩短。

If there is an efficient algorithm out there, then the timeframe at which to find it is likely very, very sped up given our advances in AI.

这就是恐慌和困惑的来源——那个高效算法既可能存在，而且现在找到它的时间线比没有AI进展时要短得多。

And that's where the kind of panic and confusion is coming from, is the possibility that that efficient algorithm both exists, and now the timeline is much shorter than it would be without these advances in AI.

而减轻这种恐慌的最简单办法，就是实验室能公布更多信息，说明他们为了找到那个算法做了多少工作。

And the easiest way to minimize that panic is for more information from the labs to come out on how much work they've done to try to find that algorithm.

如果实验室出来说：“我们投入了大量算力、时间和金钱，但还是没能破解它”，那至少在下一次模型大升级之前，你会对安全假设有信心，觉得它是合理的、安全的。

And if the labs came out and said, "We threw a bunch of compute and time and money at this, and we couldn't crack it," that would give you confidence, at least until the next big upgrade in the model, that we have a reasonable, safe security assumption.

在极端情况下，这应该比迄今为止的历史给你更多的信心，对吧？

In the extreme case, it should give you more confidence than the history until today, right?

如果你真的相信——就像很多人，包括昨天发帖的许多人那样——这些模型现在基本上已经达到或超过了大多数研究这些系统的人的水平，或者很快就会达到，那么知道相当于10万名专家数学家或密码学家审查过一个方案，你应该会非常有信心。

If you really do believe, like many do, like many of the people posting yesterday believe, that these models are now basically at or better than the vast majority of people who are studying these systems, or they will be soon or whatever, then you should get great confidence from knowing that the equivalent of 100,000 expert mathematicians or cryptographers took a look at a scheme.

这实际上应该让你比以往任何时候都更有信心。

It should actually make you more confident than you could have ever been about one before that.

我忍不住要强调一下，我们需要重新思考，到底该怎么决定我们对什么有信心。

I can't help but emphasize, we need to reconsider just how we even decide what we feel confident about.

我们刚才聊了一些，如果你是机构的话，有很多安全最佳实践，你可能已经在做了，或者早就应该做了。

So we've talked a little bit about if you're an institution, there's a lot of these security best practices that you probably are already doing or should have been doing already.

如果你是普通用户，目前没什么要做的，别慌，继续过日子就行。

If you're an everyday user, nothing to do at the moment, don't panic, continue on.

如果你是初创公司，想利用这个正在展开的、非常有趣的技术，这里有没有创业机会？新公司能不能进来帮上忙？

If you're a startup that wants to take advantage of this really interesting piece of technology unfolding in this way, are there startup opportunities here and where a new company might be able to come in and help?

我觉得最明显的一点是，初创公司今天在设计系统时，必须认真考虑他们在软件中做出的安全假设。

I think the most obvious note that I take out is that, well, startups will have to need to seriously consider what types of security assumptions they make in their software today, however they design their systems.

这已经在多个方面发生了，对吧？

That's already kind of happening on multiple fronts, right?

人们对开源的看法正在改变，对吧？

How people think about open source is changing, right?

上周大家都意识到闭源已经死了，对吧？

Didn't closed source basically, everyone recognized closed source died last week, right?

因为我们有能力去反编译这些东西。

Because of our ability to decompile things.

而且，由于AI系统具有代理性，我说的代理性是指它们可以无限制地去做各种支线任务，对吧？

It's also the case that because of the agentic properties of AI systems, by agentic properties, I mean, they can go on unbounded side quests, right?

为了帮你达成目标，它们会去做各种乱七八糟的事情。

And do all kinds of random things in pursuit of a goal for you.

正因为如此，我们得非常仔细地考虑我们为AI代理设置的安全边界、沙箱以及基于能力的权限方案。

Because of this, we have to think very carefully about the security boundaries and sandboxes and capabilities-based permissioning schemes we put around AI agents.

所以我们已经在从那个角度重新思考安全问题。

So we're already thinking about rethinking security from that lens.

嗯，这其实只是我们需要重新考虑系统能力以及如何设计软件和产品的又一个方面，既要保持安全，又要在赋予用户能力的同时保护他们。

Well, this is just yet another way we need to reconsider what systems are capable of and how to design software and products that remain secure and that protect users as much as they empower them.

我甚至想更进一步说。

I would go even a step further.

我认为这些新能力对初创公司甚至更成熟的软件公司来说都是一份礼物。

I think that these new capabilities are a gift to startups and to even more established software shops.

所以我可以告诉你，在过去，一个密码系统真正变得值得攻击的时机，是当它宣布即将部署或者已经部署的时候。

So I can tell you in the past, the time when a cryptosystem becomes really interesting to attack is once it's announced that it's about to be deployed or is already deployed.

这时候——是的……部署之后，它会受到密码学家的很多关注，但那时候攻击密码系统其实已经有点晚了。

This is when- Yeah ... after it's deployed, it gets a lot of attention from cryptographers, and that's kind of the wrong time to attack a cryptosystem.

而现在，因为我们控制这些AI模型，任何初创公司或软件公司，只要在部署新的密码功能，甚至部署任何软件，都可以让这些模型分析它的密码学，以及分析它的整体软件找漏洞。

Whereas now, because we control these AI models, any startup or any software shop that's deploying a new crypto capability or actually even deploying any software at all, can now have these models analyze its cryptography and analyze its general software for bugs.

这是一个非常强大的工具，以前根本不存在。

This is an incredibly powerful tool that didn't exist before.

随着越来越多的软件公司采用这项技术，我相信软件质量会提升，密码质量也会提升，因为除非模型说它是有效的，否则什么都不会发布——是的……

Over time, as more and more software shops adopt this technology, I believe that software quality is going to go up, crypto quality is going to go up because nothing will ship- Yes ... unless the model said that it's valid.

我最近看到有人因为5.5 Haiku的发布，拿它和4.5比较，对吧？

I saw someone recently because of the release of 5.5 Haiku, and they were comparing with 4.5, right?

然后做了很多一年前的模型和今天的模型之间的比较。

And making many comparisons between models from a year ago versus today.

而且总是很难做到公平的比较，当

And it's always hard to do an apples to apples comparison when the