Claude reveals ECDSA curve origins

While this confirms the method of production it doesn't say anything about their selection, especially since they were, apparently, generated over a period of months. Specifically you cannot see those candidates that were generated and discarded.

"It is still conceivable that these curves were selected to have a specific property in principle by searching over timestamps to the random number generator."

Yes.

"However, you would only need to do that if you were going to disclose the timestamp as some evidence that the seed was innocuously generated."

Does not logically follow when "doing and saying nothing" will completely suffice.

“In under half an hour, Claude discovered the origins of the NIST P-192, P-224, P-256, P-384 and P-521 seeds. None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp!”

Gorgeous. I wonder if the NSA employee who did this suffered a head injury or has been quietly giggling to themselves for the last quarter century.

> The fifth binary seed, B-163, fits nothing Claude has tried and remains unexplained.

The simplest explanation would be that it was generated the same way as the others, but somebody mistyped a digit somewhere along the way to publishing, and therefore a solution could not be found with the assumption that the number is correct.

13 years of tinfoil hats for srand48(time(NULL)

This is devastating news... for an entire generation of NIST cryptography conspiracy theories.

So it’s pretty clear that Anthropic is privately trying to break cryptography.

> is it suspicious that such an obvious thing wasn’t discovered in 25 years?

Ouch. The implied judgment of us humans stings there.

This neat and all but I think there's a bigger issue here. Anthropic (and whoever Anthropic wants) can do this kind of work with Claude, but if you or I try to do it, we will get blocked. This is a fun exercise, but extend this to something much more nefarious and you can see a moat widening between the model providers, their government partners, and the public.

The only thing that bridges this moat is continued advancement of open models.

More and more it is the relentlessness of the models that strikes me. Leave no stone unturned! Go through ALL of these old boxes. Someone said they thought maybe it was over there somewhere >>shrug<<

mda5("Sneed's Feed and Seed (Formerly Chuck's)")

I find it so ridiculous that they (seemingly) forcefully try to state references to dedicated researchers who devoted much of their lives to the problem, while the LLM does not even know which trained papers were effectively used. That means likely many researchers not listed were heavily influencing this achievement, and Claude does not even know that they helped. And the world doesn't know.

I think it's only a matter of time before we decrypt the Voynich manuscript and the fourth message of Kryptos.

https://beinecke.library.yale.edu/beinecke/collections/beine...

https://allthatsinteresting.com/kryptos

> None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp!

Could they not be both?

Makes me wonder if any implementations will do the cute trick of dispensing with the seed constants and deriving them at startup from the unix timestamps. :)

"It is still conceivable that these curves were selected to have a specific property in principle by searching over timestamps to the random number generator."

Indeed! And we guess that OpenAI was gagged by the NSA because the massive proof dump on Oct. 6th did not contain cryptographic results.

I assume that Anthropic faces similar restrictions, so this seems kind of approved.

Would it have been feasible for a FOIA to reveal the origin from the primary source?

EDIT: ah, one of the linked authors tried that. They had no documentation on it. https://saweis.net/posts/nist-curve-seed-origins.html

Interesting. So there was no humorous phrase, and its probably safe from backdoors. They do look pretty random.

Setting aside the use of "an internal research model", how would one go about prompting an LLM to do this?

I wait for the morning that we’ll wake up to ssh keys being useless

As one of the original bounty sponsors, I'm thrilled to pay my portion to ISRG. :)

> Let me be careful about the plausibility: is it suspicious that such an obvious thing wasn’t discovered in 25 years?

Alright Claude no need to rub it in.

Why did they specifically skip other apparently suitable curve candidates? The B-163 seed and the base point origins of several other curves are still not explained

crazy

On the face if it, the big leap here was Claude autonomously envisioning, and deciding to pursue, the "ancient prng + date" angle - - rather than working backwards from the premise of deliberately weakened seeds or some other popular theory. To me that shows creativity, and modelling of the situation and method of the people at the NSA.

So two questions:

1. TFA mentions the "humourous phrase hash" theory, but Claude's trajectory seems to be a long way from that. To what extent was Claude prompted in the ultimately successful direction?

2. Whats with all the "hmm..." in the internal reasoning process log? Do models really do that? And if so, why? Some weird emergent language thing, or just mimicry?

This is huge. It means the Bitcoin and Ethereum communities can now confidently ship the opcodes and precompiled contracts to check ECDSA signatures on P-256 in addition to K-256 curves, and stop worrying about possible NSA backdoors based on the chosen seeds (quantum computers are another story).

I turned out to be right in my advocacy years ago, here is my post: https://ethereum-magicians.org/t/eip-7212-precompiled-for-se...

On September 20th a friend told me that he had as significant number of Anthropic credits that were about to expire and wondered about a use for them. I do not use their products because of their relentless commitment to depriving the public access to artificial intelligence (and particularly any AI that isn't acting on their behalf) and I strongly discourage anyone else from doing so. But since he was going to use the credits for something, I tried to think of a skut work task that would be of only idle curiosity and would not help advance misanthropic's capability, enable a meaningful public announcement* for them, and was likely already probed by many others (so success would only be lottery effects). -- and basically just something so pointless I wouldn't want to waste my own compute grinding on it but might like to see the result.

So I recommended determining the origins of ECC seeds and base points. The agent worked continuously for many hours and did not uncover anything interesting that wasn't already known. I looked at the transcript and was struck by how idiotic the agent was-- significantly below the standard of intelligence I've come to expect from GLM running locally.

I'm not saying this to suggest that misanthropic hijacked someone elses work yet again-- this is an obvious question that many people have surely posed and success presumably depended on expert use (which was absolutely not applied in my friends example). But it does make me wonder if the company invisibly degraded the model performance.

[*] Seems I underestimated how trivial a result they'd bother trying to spin!

Neat. Now they should figure out what's up with the secp256k1 curve and its weird generator point G where 1/2 G has 90 leading 0 bits.

Not entirely related to the topic, but did someone spent some tokens trying to figure out the origins of the "Wow! Signal" (https://en.wikipedia.org/wiki/Wow!_signal) ?

Seems to me like a nothing burger? As long as there is no weakness, why should I care which PRNG shuffled bytes?

As unsurprised as I am by this, and as much as I suspect a lot of people could have guessed it, having Claude confirm it is still fascinating, but.

Somehow, I find these results fascinating, but also quite sad, because we used a machine to solve it at all. I feel like some half drunk motivated graduate level humans could have figured it out too.

Then again, once you know the answer, perhaps you have an obligation to share it, keeping it to yourself might be unfair to everyone else.

Honestly I’m not entirely sure how I feel about all this. I would gladly welcome any groundbreaking work Claude might do to solve hard problems and move the world forward by decades or even centuries.

But these sorts of fun problems feel like things we should avoid pointing LLMs at. They remind me of those weird programming puzzles that are difficult to solve but incredibly fun to work through.

My concern is that if Claude ends up solving all the fun problems, will humans be left with nothing but the hard, headache-inducing ones? Tao had raised a similar concern, problems that graduate students would have been expected to solve and learn the process, are now things you can simply point an LLM at.

I’m still not sure how I will ever reconcile with this feeling, about any of this. I just find it genuinely sad that we might be automating away not only the difficult work, but also the joy of figuring things out for ourselves.

Stochastic parrot truthers in shambles.

>“seed” parameter

>provided by the NSA with no explanation or justification.

Really? Nobody is concerned about the NSA just cheerfully dictating that? Smells very rainbow-table-y

> This is not a cryptographic break, new attack, or weakness in the ECDSA curves. In fact, this makes us more confident the curves were chosen without any backdoors or intentional weaknesses.

Uh… did you talk to any cryptographers? This is EXACTLY what a weak curve would look like. Imagine that 1 in a thousand, or one in a million keys, selected at random, are vulnerable to some withheld attack. This approach lets you vary the timestamp or number of iterations until a weak key is found, then have plausible deniability afterward. This is why modern systems choose constants in a way with no free choice of parameters (e.g. sqrt of 2 for first constant, cube root for second constant, etc.).

They even note later in the article that viable curves in the generator sequence seem to have been skipped.