Cardano与以太坊创始人就AI和加密货币安全问题展开激烈交锋

以太坊联合创始人Vitalik Buterin与Cardano创始人Charles Hoskinson就AI对密码学安全的长期影响展开激烈辩论

以太坊联合创始人Vitalik Buterin与Cardano创始人Charles Hoskinson进入了一场高度技术性的公开辩论，讨论加密货币领域最大的长期安全问题之一：如果人工智能极大地提高了人类攻击密码系统的能力，会发生什么？

Buterin警告：AI加速的数学研究可能比预期更快地改变密码学安全

Buterin的论点源于一个简单的担忧。AI系统可能会加速数学研究，从而发现人类尚未找到的攻击方法。他将这种可能性与整数分解的历史进行了比较。原始的分解算法看似极其困难，但数十年的数学进步产生了如数域筛法（Number Field Sieve）等算法，大幅降低了RSA的实际安全性。Buterin担心，对于椭圆曲线或基于格的密码学，可能存在类似的未被发现的技术。如果AI在短短几年内带来了几十年的数学进步，那么今天被认为安全的密码系统最终可能具有比预期更弱的实际安全性。

这也是为什么Buterin倾向于以太坊在可能的情况下向基于哈希的密码学迁移的原因之一。他明确表示：“我不建议任何人今天匆忙将资金转移到新钱包中。但是，我们应该认真对待AI加速数学带来的密码学风险，并尽量减少我们不仅对量子脆弱密码学的暴露，也对潜在AI脆弱密码学的暴露。”

从这个角度来看，新的核心风险领域不幸地包括ML-DSA、FHE（全同态加密）和格密码学。这也是为什么ECDSA可能比预期更快崩溃的原因，因此有了“使用新鲜地址”的建议。目前，大多数人仍处于“椭圆曲线被破解，哈希安全，格安全”的思维模式中。但有很大可能性，格的实际安全性将在未来两年受到AI数学研究的严重冲击。”

基本的威胁模型是：分解原本需要2^(n/2)的时间，但经过几十年的发展，聪明人找到了并优化了数域筛法，将其降低到2^O(n^(1/3))，这就是为什么RSA密钥和签名需要约400字节（而不是64字节）。如果在椭圆曲线和格密码学中也有像这样的“隐藏弱点”，而我们目前的智能不足以发现它们，但机器人很快就能做到呢？

这也是过去一年来以太坊精简路线图朝着“仅哈希”方向发展的主要原因：没有格，没有ML-DSA，没有Falcon，ZK证明中没有基于格的承诺等。精简以太坊中的签名全部基于哈希，无论是WOTS还是SPHINCS+。对于签名和证明，我们已经知道如何实现仅哈希。更大的挑战在于公钥加密——这远远超出了区块链的范围。安全通信、匿名协议等许多东西都需要公钥加密。不幸的是，现有的数学定理表明，仅靠哈希无法实现公钥加密。你必须拥有某种具有至少一种可用“结构”的陷门对象——要么是群论（包括同源映射），要么是格，要么是基于代码的，或者未来可能有更新奇的事物（局部混合？）。但对于任何具有结构的对象，你应该假设AI将在打破该结构方面取得至少一些进展。

A reasonable inference here is that if you want something to be safe in the long run, multiply the key size by 10. This is a very believable world for me, and predicting this is not extreme. If AI will bring us 50 years of mathematical results in two years, then these 50 years of mathematics are likely to include a "primitive factory-GNFS" level improvement in our ability to make exceptions. In that world, grids still existed, but they had to be significantly larger to ensure the same level of security. At these new large size, hash-based constructions will actually outperform lattice-based constructions in all use cases where hash constructions are feasible.

Of course, in theory, hashes can also be cracked (e.g., P=NP means this). But I think P=NP is very unlikely. Intuitively speaking, the probability that a mathematical object happens to have no available structures (such as the design intent of a hash) is much greater than that a mathematical object happens to have about three available structures (for elliptic curves: associative law, Schoof algorithm, pairing), and the absence of some secret that we have not yet discovered would greatly weaken its security (for elliptic curves, ECDLP and pairing security). The same goes for LWE, SVP, RLWE and the jungle of grid problems.

So so far, we have no reason to worry and start filling the byte size of the hash (if we start worrying more, we will increase the number of rounds first and then do anything about the byte size).

Summary of personal views:

• When hashing is feasible, hash-based systems are better than lattice-based systems.
• With anything based on lattice, be more paranoid about parameter sizes. Keep in mind that blockchain is only a small part of the cryptography story; this goes far beyond blockchain and applies to accessing websites, secure messaging, Tor/VPN, etc.
• Regarding privacy agreements, it is strongly recommended not to upload encrypted notes. Instead, they are sent offline through third-party mechanisms.
• If you don't find it troublesome, it's a good idea to keep funds at addresses that are not used for transactions. If it's easy, please do so. ** But be careful about migration; I personally lost more money in failed migrations than all hacking attacks combined **.
• For multi-signature wallets, it is better to confirm off-chain than on-chain, because the signer's wallet signature will not be exposed to the public, so if ECDSA is breached by AI faster than expected, at least multi-signatures can be "gracefully downgraded" to 1-of-1, where 1 is who is collecting signatures-which is much better than "anyone can take money."

He believes that hash-based constructions contain less usable mathematical structure than systems built around elliptic curves or lattices. For signatures, he points to hash-based methods such as WOTS and SPHINCS style systems. Buterin is more cautious about public-key encryption because this issue cannot simply be replaced with a hash. His personal conclusion is that in a world where AI accelerates mathematical discovery, lattice-based systems may require larger parameters to remain safe. He even raised the idea that the key size might need to be significantly increased.

Hoskinson said there was no specific basis for attack behind the warning.

Hoskinson's response was lengthy and highly critical. His main objection was that Buterin failed to point out the actual attack. Hoskinson believes that just saying that AI may discover hidden structures is not enough. In his view, security engineering should identify specific attacks, estimate their computational costs, and then adjust the parameters based on the model. Without these, he regarded the warning as speculation.

Hoskinson also questioned Buterin's comparison of lattice cryptography and the history of integer factorization. He believes that the number-field sieve method stems from very specific mathematical properties involving smooth numbers, factor bases, and congruences. If someone thinks that the lattice contains equivalent hidden weaknesses, Hoskinson said they need to explain what mathematical structure can enable it.

Hoskinson defends lattice-based cryptography

Hoskinson also explained that lattice cryptography has been intensively studied for decades. He pointed out that major advances include LLL, BKZ, lattice sieve and improved enumeration methods. His argument is that these developments have been incorporated into the choice of parameters for modern post-quantum schemes. He specifically mentioned ML-KEM and ML-DSA, which are designed around known lattice attacks and modern cost estimates.

Hoskinson also pointed out the theoretical connection between destroying certain lattice problems and solving hard geometric problems on the lattice. In his view, this gave lattice cryptography a more solid mathematical foundation than Buterin's post admitted.

Hoskinson says hash-based systems also have their own risks

Another major part of Hoskinson's response targeted Buterin's preference for hashing. Hoskinson believes that hashing is not automatically immune from structural problems. Buterin is now trying to convince all personalities that it is bad because he holds too many hash-based crypto research positions to exit. The accusation against Ge is the story of GNFS, the intuition about "structure" and a fabricated multiplier. This has never been tenable in the past few decades. It is wrong to break down analogies. The number-field sieve does not come from general ingenuity, but from very specific arithmetic-smooth numbers, factor bases, and congruent square relations stitched together by linear algebra. If you claim that GNFs are hidden in the grid, you must name the thing that plays that role. The word "structure" makes no sense. The sieve method was completed in 1993, and in the three decades since then, the size of RSA has changed little, so the lesson of decomposition is that the skeleton has been exhausted. Even the formula in the post is wrong. GNFS is exp(O(n^(1/3) (log n)^(2/3))), and if you want to adjust the parameters by analogy, you can at least get the complexity of the analogy right. Ge had their sieve era decades ago. The LLL, BKZ, pruning enumeration in 1982 was screened at 2^0.415n and 2^0.292n in 2008 and 2016 respectively. Each one is factored into the parameters the moment it appears. ML-KEM and ML-DSA are sizing these attacks, with cost models giving attackers free memory and discarding polynomial factors. The post seemed like no one had ever read it seriously. Over the past four decades, the best talents in the field have moved a constant in the index. The post also skips one thing that lattices have that GGEV and Peikert proved: cracking random LWE or SSIS instances with the correct parameters solves the problem of the approximate shortest vector on each lattice in that dimension. The "skeleton" of pure LWE will not be a trick for a certain family. It is a theorem on one of the most attacked problems in computer science. SHA-256 does not have such a theorem. Its security is that no one has been cracked yet, which is exactly the standard standard for posts to refuse to expand into categories. If you really want to worry about the structure in a lattice, look at the algebra of rings and ideal lattices. Cramer, Ducas, Peikert, and Regev (2016) and Cramer, Ducas, and Wesolowski (2017) gave quantum attacks on Ideal-SVP in the cyclic domain. Albrecht, Bai, Ducas, and Kirchrieder analyzed the NTRU. These results kill the real solution, and none of them touch ML-KEM or ML-DSA, which are modular solutions with small moduli. Ducas, Plançon, and Wesolowski showed that quantum ideal attacks are worse than ordinary BKZ in every dimension, applied structure, measured how far the attack reached, normalized outside its range, preserved FrodoKEM with no rings at all, and added HQC in 2025 so that KEM does not rely solely on lattice. Vitalik either didn't know this, or it was due to the hash encryption position that caused loss of citation. Then there is the claim that Hash's "intention" has no structure, as if the intention were proof of security. Differential cryptanalysis destroyed MD5 and SHA-1 by attacking its round function without the help of P = NP. Of each family he listed, hash is the only family whose deployed primitives have actually been cracked. The hash-only roadmap he defended runs on top of Poseidon and Poseidon2, which are low-degree polynomial mappings on small prime fields and are specifically designed to be easy to express algebra. They are the hashes with the most algebraic structures that anyone puts into production. Gröbner bases and interpolation attacks are an active area of research, and the Ethereum Foundation even funded a cryptoanalysis bounty against Poseidon. If AI were to eat structures, Poseidon would be eaten long before Module-LWE. The proof system is not much better. FRI, STIR, and WHIR rely on the unproven Reed-Solomon proximity gap conjecture under radical parameters, while Fiat-Shamir demonstrated it in the random oracle model. This is the true meaning of "hash only" in practice. And "we will fill in the rounds first" reveals the secret, because the extra rounds only defend the structure. He admitted that structure existed. The theory was also messed up. Impagliazzo and Rudich are about the black box separation of proving technology. It is not a theorem that public-key encryption "requires structure". Merkle's puzzle has given hash-only key agreement under the quadratic gap, which Barak and Mahmoody proved to be optimal in this model. "P ≠ NP so the hash is safe" is also wrong, because P ≠ NP does not mean that a one-way function exists, let alone SHA-256 is one. This gap is the five-world theme for the entire Impagliazzo. Asserting that an object with zero known structure is safer than an object with exactly three known structures is a probability statement that lacks the underlying probability model of a universal prime field elliptic curve; the record is just the opposite: every subexponential ECDLP attack since 1985 requires a special curve; everyone identifies and excludes it, and Shoup's universal group bounds accurately state what new attacks must exploit. For forty years, no one has found one. "Multiply the key size by ten" is digital superstition. Grid attack costs like 2^(c·β). A better constant means you scale the dimensions by c/c', so a 20% efficiency increase will only increase your dimensions by about 25% rather than 10 times. A sub-exponential breakthrough means no multiplier can save you, because 10^n is still sub-exponential. Neither of these situations will give you ten times. Byte is not even a safe parameter because increasing the modulus at fixed noise makes LWE easier. Parameter selection is a set of complexity formulas for security goals, and this post does not contain any formulas. "AI will bring fifty years of mathematics in two years" is not a threat model. It has no naming algorithm or cost, and it can never be falsified, because every year without a breakthrough is just "not yet time." It also cracked down on hashes as hard, and the post never explained why it should not be. The field already has a workflow for handling extraordinary claims. In 2024, a preprint claimed that a bug in LWE's quantum polynomial time algorithm was discovered in about ten days. Rainbow and SIKE fell on laptops during the NIST process, allowing lattice schemes to survive under the same public scrutiny. An AI-discovered attack follows the same flow: examine it, run it through an estimator, and then reparameterize it. The most studied post-quantum family to give up before an attack exists is panic. And it's recommended that Twitter be actively dangerous outside of encryption. He admitted that public-key encryption could not be avoided, then told TLS, Tor, VPN and messaging operators to become "more paranoid" about the only actually deployed post-quantum KEM. Harvest-now-decrypt-later is happening, and hybrid ML-KEM is already shipped in browsers and messaging applications, which is a defensive measure. Spreading suspicion, or expanding it tenfold until the handshake fails, would keep traffic on classic encryption for longer, which is exactly what he fears. "Sending encrypted notes offline through a third party" doesn't solve any problems, because sending to people you've never talked to still requires public key encryption, and now you've added a trusted party that sees your metadata and can discard your messages. Confusion of ML-DSA and FHE shows a weak grasp of the two because they live in completely different parameter regimes with different attacks. Use hash-based signatures where appropriate; the IETF has been studying XMSS for years and has made many great improvements. However, they are algebraic dead ends. It's not easy for you to do what we value in the world of elliptic curves. Security engineering means naming attacks, calculating their costs, and adjusting fixes in the context of broader business and technical goals. Vitalik has never done this before. He writes these damn posts and convinces a lot of engineers to give up extremely important research, and then we're going to stumble back to it after years of wrong attempts: Plasma, Ethereum 2.0, Casper, Accounts, etc. Now we're going to attack Ge."

The two founders had differences on how to prepare for unknown attacks

The differences were ultimately philosophical. Buterin advocates caution in the face of unknown mathematical progress. His position is that if AI suddenly becomes much stronger at mathematical discovery, cryptosystems with less visible structure may be more secure. Hoskinson wanted a more specific standard. He believes that without specific attacks, complexity estimates or reproducible results, cryptographic engineering should not give up or lose confidence in the major security family. He also believes that overly cautious warnings could have real-world consequences.

Lattice based systems have begun to be deployed to deal with the "collect now, decrypt later" attack, which collects encrypted traffic today in the hope that future quantum computers can decrypt it. Hoskinson fears that dissuading the adoption of grids without evidence may delay the transition from classical cryptography.

Hoskinson also rejected the idea of "10 times the key size"

One of Hoskinson's strongest criticisms was directed at Buterin's idea of multiplying the key size by ten. He called the method arbitrary. His argument is that cryptographic parameters should be mathematically adjusted based on how much the attack improves. For example, if the attack efficiency is increased by 20%, the correct response is not to automatically multiply the entire key size by ten. Adjustments depend on the actual relationship between attack costs, dimensions, modulus, noise, and other programme-specific parameters. Hoskinson believes that huge fixed multipliers do not represent serious cryptographic parameter choices.

总体而言，两种立场都指向同一个令人不安的现实。加密货币和更广泛的互联网正处于一个时期，密码学假设可能面临来自量子计算和日益强大的AI的压力。分歧在于工程师在出现具体的新攻击之前应多积极地做出反应。