I've asked Claude-opus to find vulnerabilities in well known code bases and explain what the bug is and what code change should be used to fix it. So far it has identified issues that are technically correct but aren't actually an issue within the larger context of the how the code is used. That said, I'm pretty sure I could find vulnerabilities by using Claude-opus as first pass filter to find problem areas.

ChatGPT broke a cryptographic protocol I wrote[0]. I convinced myself ChatGPT was wrong about the attack until a human cryptographer pointed the same attack out [1].

"The protocol you described appears to be a variant of the Schnorr signature scheme, with a zero-knowledge proof of knowledge of the signature. However, this specific variant does not provide security against forgery attacks by the prover.

The reason for this is that the prover can choose a random value r and compute w = r^e mod N, without actually computing the signature sig = h(m)^d mod N. Then, the prover can simply choose zksig = w and publish (w, zksig, m) as the proof. Since zksig = w^d mod N = r^(ed) mod N, it satisfies the verification equation zksig^e mod N = h(m)*w mod N, even though it is not a valid signature for the message m."

[0]: https://chatgpt.com/share/f5526fd5-7ebb-4b15-a2bf-703ac88de4...

[1]: https://crypto.stackexchange.com/questions/105704/nizk-proof...