[Paper Review] ChatGPT vs. Lightweight Security: First Work Implementing the NIST Cryptographic Standard ASCON

Alvaro Cintas Canto, Jasmin Kaur+2 more|arXiv (Cornell University)|Jun 13, 2023

Artificial Intelligence in Healthcare and Education33 citations

TL;DR

This work presents the first attempt to implement the NIST lightweight cryptographic ASCON using GPT-4, detailing a staged methodology, challenges, and a Python implementation with testing.

ABSTRACT

This study, to the best of our knowledge, is the first to explore the intersection between lightweight cryptography (LWC) and advanced artificial intelligence (AI) language models. LWC, in particular the ASCON algorithm which has been selected as the LWC standard by the National Institute of Standards and Technology (NIST) in Feb. 2023, has become increasingly significant for preserving data security given the quick expansion and resource limitations of Internet of Things (IoT) devices. On the other hand, OpenAI's large language model (LLM) ChatGPT has demonstrated significant potential in producing complex, human-like text. This paper offers a novel method for implementing the NIST LWC standard, ASCON, using the GPT-4 model. Moreover, this paper details the design and functionality of ASCON, the procedures and actual Python implementation of ASCON using ChatGPT, and a discussion of the outcomes. The results contribute valuable insights into the efficient application of advanced AI language models in cryptography, particularly in constrained environments. Source code can be found at: https://github.com/DrCintas/ASCON-with-ChatGPT.

Motivation & Objective

• Motivate the study of integrating lightweight cryptography with advanced AI language models for IoT security.
• Describe ASCON as a NIST-selected lightweight authenticated encryption standard and its relevance to resource-constrained devices.
• Propose and apply a methodology to implement ASCON-128 in Python using ChatGPT and evaluate outcomes.
• Provide insights into the practical capabilities and limitations of using LLMs to implement cryptographic algorithms.

Proposed method

• Outline a five-stage methodology to implement a cryptographic algorithm with ChatGPT (Algorithm Recognition, Algorithm Education, Algorithm Implementation, Code Execution and Testing, Code Review and Debugging).
• Detail the ASCON authenticated encryption process, including initialization, associated data processing, plaintext processing, and finalization, with its 320-bit permutations and 5-bit S-box implementation.
• Leverage GPT-4 to generate and iteratively refine Python code for ASCON-128, including helper routines (to_bytes, from_bytes, pad, xor_bytes) and permutation/rotation operations.
• Perform staged testing against a reference ASCON implementation, diagnosing discrepancies, and progressively incorporating associated data handling.
• Document and illustrate the prompting prompts and iterations used to correct critical components (initialize, ASCON_permutation, process_data, finalize).

Experimental results

Research questions

• RQ1 Can GPT-4 effectively implement a NIST lightweight cryptographic primitive (ASCON-128) in Python?
• RQ2 What are the practical challenges and limitations of using a large language model to generate correct cryptographic code?
• RQ3 How many iterative prompts and debugging steps are needed to align GPT-4 output with ASCON specifications?
• RQ4 Do the resulting implementations match the original ASCON test vectors when validated against a reference implementation.

Key findings

• The study demonstrates that implementing ASCON-128 with ChatGPT is feasible and can match test vectors to a reference implementation.
• An iterative, stage-based prompting approach is required to correct constants, rotations, and permutation logic.
• GPT-4 can generate modular code and helper routines, but initial outputs may contain multiple specification deviations requiring targeted prompts.
• The authors advocate consulting open-source projects or cryptographic experts and acknowledge potential risks in implementing cryptographic primitives from scratch.
• The work provides source code and a reproducible workflow (GitHub link) to reproduce the ASCON-with-ChatGPT implementation.
• The results emphasize that while feasible, relying solely on AI-generated cryptographic code is not advised for real-world security deployments.