IOTA’s 2017 AI Cryptography Prediction Resurfaces Amid Renewed Security Concerns

A nine-year-old Reddit post from the IOTA community is drawing attention to an early debate over whether artificial intelligence could eventually help attackers break cryptographic systems. Published in 2017 under the title “Time For A Paradigm Shift Has Come,” the post argued that cryptography needed to account for future AI capabilities rather than relying exclusively on assumptions built around human analysis.

The post was written by Sergey Ivancheglo, an IOTA co-founder known online as Come-from-Beyond, according to community discussions. Ivancheglo argued that advances in AI could enable attacks against cryptographic algorithms that human researchers had considered too complex to analyze. His prediction was that AI-assisted cryptanalysis could threaten widely used cryptographic primitives within five to ten years, although the post did not establish a scientific basis for that timeline.

The discussion has renewed relevance as researchers investigate how AI can assist vulnerability discovery, code analysis and mathematical problem-solving. However, AI-assisted security research is not the same as demonstrating that AI can break modern cryptographic systems in practical conditions. The distinction remains important when evaluating predictions made nearly a decade ago.

Why Ivancheglo Argued for Simpler Cryptographic Algorithms

Ivancheglo’s central argument was that adding complexity to a cryptographic algorithm does not necessarily make it more secure. He referred to historical cryptanalysis techniques, including the slide attack introduced by Alex Biryukov and David Wagner, to argue that structural weaknesses can persist even when algorithms contain multiple rounds or additional layers of complexity.

He proposed designing cryptographic primitives that were as simple and transparent as possible. Using the analogy of fish in a pond, he described an algorithm as the pond and vulnerabilities as fish: clear water makes the fish easier to see, while murky water hides them. In his view, transparent designs would make weaknesses easier for human researchers to identify and leave less room for a more capable AI system to exploit hidden structures.

The post also argued that simpler algorithms could reduce the time needed for analysis and deployment. Ivancheglo believed that cryptographic security should not depend on whether a system’s internal structure exceeded the analytical abilities of its designers. Instead, he wanted simplicity to become a deliberate design objective alongside performance and security.

He connected this philosophy to Curl-P, a custom hash function associated with IOTA’s early architecture. Ivancheglo claimed that an AI system he had developed had contributed to creating the function. He further asserted that IOTA had been designed with resistance to both quantum-computing and AI-based attacks in mind. Those statements reflected his views at the time, not independently established proof that Curl-P or IOTA was immune to either threat.

Curl-P’s Security Controversy Complicates the Historical Claim

The history of Curl-P adds an important qualification to the original argument. In 2017, researchers associated with MIT’s Digital Currency Initiative and other institutions reported practical weaknesses in Curl-P-27, including collisions and attacks affecting the former IOTA signature scheme under specified conditions. IOTA subsequently replaced Curl-P-27 for signature generation with a Keccak-based function called Kerl. <Cite refs={[“turn582540search0″,”turn582540search2″,”turn582540search20”]}/>

The researchers’ findings demonstrate why transparency and independent cryptographic analysis matter. A system’s claimed simplicity or unconventional design does not guarantee security, and a developer’s confidence in an algorithm cannot substitute for rigorous testing. The Curl-P episode therefore provides essential context when revisiting the 2017 post’s claims about AI-resistant cryptography.

The Reddit discussion itself showed that community members were divided. Some praised Ivancheglo’s willingness to consider future threats, while others questioned whether replacing established, extensively reviewed cryptographic methods with a custom design was justified. One commenter specifically asked whether the claims of resistance to AI and quantum attacks were supported by rigorous proofs. Ivancheglo replied that such proofs were not yet available.

The broader question remains relevant: AI may help researchers discover weaknesses faster, but that possibility does not prove that modern cryptography will be broken on a predictable schedule. Security depends on the algorithms involved, the attack model, implementation quality and the computing resources available to an attacker. Quantum threats also differ technically from AI-assisted attacks and require separate analysis.

For IOTA, the historical post offers a record of an early attempt to anticipate emerging computational threats. Its lasting lesson is less about proving that one project predicted the future correctly and more about the need to test ambitious security claims through independent research, transparent methods and verifiable evidence.