Fun fact: Groth16 is less at risk from AI than STARKs. Now that I have your attention: We can’t, of course, assess the risk of AI breaking crypto, but we can assess everything else. And the landscape doesn’t look like what the hot takes imply. There are different kinds of cryptographic primitives. Hashes, public-key encryption/signatures, PRFs, etc. Short of P=NP type results, if AI breaks any/all of these, it won’t be all at once. Hashes are the black magic of cryptography. They take an arbitrary file/string and produce a collision-resistant fingerprint. We’ve had human-powered breaks of deployed hashes. MD2, MD5, SHA-1 have all been broken and protocols upgraded as we became less confident in those hashes. A break of SHA-256, SHA-3, or (for cryptocurrency) especially Poseidon wouldn’t be insanely out there. In contrast, RSA and elliptic curves, which underpin public-key encryption and digital signatures, have survived for decades. For symmetric key ciphers and PRFs built from them, it’s even better. DES was designed in the 1970s, and the practical attacks there are from brute forcing the keys. Ok, back to my admittedly clickbait assertion. STARKs, of course, are a type of “zero-knowledge” proof. In particular, a type of SNARK that uses hashes and error-correcting codes. Hashes show up both in the polynomial commitment, which is a Merkle tree, and in the Fiat-Shamir transform, which is used to generate random challenges for verification. Groth16, in contrast, depends on none of these. It’s elliptic curves, pairings, and some strong assumptions about how those work. And Groth16 proofs themselves are post-AI and post-quantum private, since Groth16 gives you at least statistical zero-knowledge, which does not rest on a computational assumption. In contrast, most deployed STARKs aren’t, in fact, zero-knowledge at all. They are only used for succinctness and do not give you privacy today, even without advances in AI or quantum. This is, allegedly, an easy fix (and the fix would give you PQ privacy too), but it hasn’t happened for the most part. Of course, this doesn’t matter much. In fact, if either elliptic curves or hashes were broken, most things you actually use, including applications using Groth16 or STARKs in cryptocurrency land, would have real problems. All most all applications in cryptocurrency and of zk proofs, depend on both assumptions, even if the proof itself does not. And if AI breaks part of crypto, we’d have even bigger problems for securing the internet, banking, and critical infrastructure using HTTPS/TLS and boring things like Active Directory and OAuth. So really, in a certain sense, this entire discussion is clickbait. But it’s interesting seeing people make just plain incorrect technical assertions about cryptography in the process of posting hot takes. As someone said, this entire topic of AI breaking crypto in cryptocurrency is a bit weird. It’s a bit like wanting a fallout bunker to survive global thermonuclear war. Everything is dead anyway.

Privacy tools need a Feynmanism like "if it disagrees with operational practice, it's wrong." If Signal manages not to log metadata and your favorite tool does, demand better. If shielded pools give better payment privacy, copy the design.

The actual pessicrypt: witness encryption is easier than upgrading your protocol.