AI Audit Reveals Bugs in Cloudflare's CIRCL Cryptography Library

Overview of Findings

zkSecurity's AI audit pipeline evaluated Cloudflare's CIRCL experimental cryptography library. It confirmed the presence of seven real bugs, highlighting vulnerabilities such as a critical float64 precision loss in threshold RSA and a complete access-control break in attribute-based encryption. All identified bugs have now been fixed in the upstream repository.

The Role of zkao

Building the zkao AI audit agent involves generating continuous insights to improve code security. The goal is to maintain an automated auditor that identifies all bugs detectable by AI. The approach requires extensive experimentation and iteration to encode the expertise of security researchers effectively.

Experimentation and Techniques

Experiments using large language models (LLMs) on open-source cryptography projects indicated the agent's capacity of detecting vulnerabilities. Two configurations were tested: LLM-only and LLM integrated with expert-maintained skills. Notably, zkao consistently identified more complex vulnerabilities than LLMs alone.

Implications for the Cryptography Field

The findings from this audit not only demonstrate the potential of AI tools to detect vulnerabilities in cryptographic code but also underscore the need for continuous improvement in such technologies. Understanding how AI models reason about cryptography can help refine auditing practices and benchmark developments.