Debug low-level cryptography code
Over the past few days I wrote a new Go implementation of ML-DSA, a post-quantum signature algorithm specified by NIST last summer. Task: The author implemented ML-DSA in Go and encountered verification failures. After manual debugging stalled, they used Claude Code v2.0.28 with Opus 4.1 to analyze the codebase. The AI identified a logic error where high bits were extracted twice in the Verify function. The author reviewed the finding, discarded the AI's proposed fix, and manually refactored the code for clarity.; tools: Claude Code. Human role: The original post does not say how a person stayed involved.; limitations: The author received free Claude Max access from Anthropic, introducing potential bias. The AI's proposed code fixes were described as 'mediocre' or incomplete, requiring human rewriting. The tool struggled with attention on large random-looking outputs, finding 'easier' bugs harder than complex logic errors. Human review is mandatory for final implementation..
Tools
Published on Agent Work Atlas:
Overview
Over the past few days I wrote a new Go implementation of ML-DSA, a post-quantum signature algorithm specified by NIST last summer.
Workflow
The author implemented ML-DSA in Go and encountered verification failures. After manual debugging stalled, they used Claude Code v2.0.28 with Opus 4.1 to analyze the codebase. The AI identified a logic error where high bits were extracted twice in the Verify function. The author reviewed the finding, discarded the AI's proposed fix, and manually refactored the code for clarity.
Reported result
Claude Code successfully identified three distinct low-level bugs in cryptographic implementations, including complex logic errors and constant miscalculations. The author reported that this saved significant debugging time, estimating one to two hours per bug. The AI's proposed fixes were often discarded in favor of manual refactoring, but the diagnostic accuracy was high.
Human role
The original post does not say how a person stayed involved.
Limitations
The author received free Claude Max access from Anthropic, introducing potential bias. The AI's proposed code fixes were described as 'mediocre' or incomplete, requiring human rewriting. The tool struggled with attention on large random-looking outputs, finding 'easier' bugs harder than complex logic errors. Human review is mandatory for final implementation.
Try it
I am debugging a Go implementation of [replaceable: cryptographic algorithm, e.g., ML-DSA] in [replaceable: code path, e.g., src/crypto/internal/fips140/mldsa]. Tests fail with [replaceable: error message, e.g., invalid signature]. Use Claude Code with Opus 4.1. Run tests via [replaceable: test command, e.g., bin/go test ...]. Analyze the code to find the root cause of the failure. Do not apply fixes automatically. Instead, output a detailed explanation of the bug location and logic error. I will review your analysis and implement the fix manually. Start by identifying if the issue is in Sign or Verify logic. If the bug involves data encoding, check for bit/byte length mismatches. If it involves mathematical operations, check for double application of transformations. Provide a concise summary of the bug and the specific lines involved. Wait for my confirmation before proceeding to any other tasks.
Source reports are not independently verified. Publication date is the catalog publication date, not the original article date.