alt Hacker NewsClaude reveals ECDSA curve origins
Comments
“In under half an hour, Claude discovered the origins of the NIST P-192, P-224, P-256, P-384 and P-521 seeds. None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp!”
Gorgeous. I wonder if the NSA employee who did this suffered a head injury or has been quietly giggling to themselves for the last quarter century.
This is devastating news... for an entire generation of NIST cryptography conspiracy theories.
> The fifth binary seed, B-163, fits nothing Claude has tried and remains unexplained.
The simplest explanation would be that it was generated the same way as the others, but somebody mistyped a digit somewhere along the way to publishing, and therefore a solution could not be found with the assumption that the number is correct.
I find it so ridiculous that they (seemingly) forcefully try to state references to dedicated researchers who devoted much of their lives to the problem, while the LLM does not even know which trained papers were effectively used. That means likely many researchers not listed were heavily influencing this achievement, and Claude does not even know that they helped. And the world doesn't know.
> is it suspicious that such an obvious thing wasn’t discovered in 25 years?
Ouch. The implied judgment of us humans stings there.
So it’s pretty clear that Anthropic is privately trying to break cryptography.
More and more it is the relentlessness of the models that strikes me. Leave no stone unturned! Go through ALL of these old boxes. Someone said they thought maybe it was over there somewhere >>shrug<<
This neat and all but I think there's a bigger issue here. Anthropic (and whoever Anthropic wants) can do this kind of work with Claude, but if you or I try to do it, we will get blocked. This is a fun exercise, but extend this to something much more nefarious and you can see a moat widening between the model providers, their government partners, and the public.
The only thing that bridges this moat is continued advancement of open models.
Kudos to Anthropic for choosing the higher bounty and donating it to ISRG, that is a very nice gesture.
> There is no action to be taken or things to do differently. Most researchers trusted the curves already. Enjoy.
Didn't know I needed to hear this until I saw it.
Not sure where along my life I became so tense all the time!
Two weeks ago I was trying to solve this exact problem with the wrong approach they describe in the beginning... see here: https://github.com/mariusAsa/NistEllipticCurvesBounty
As one of the original bounty sponsors, I'm thrilled to pay my portion to ISRG. :)
Makes me wonder if any implementations will do the cute trick of dispensing with the seed constants and deriving them at startup from the unix timestamps. :)
Interesting. So there was no humorous phrase, and its probably safe from backdoors. They do look pretty random.
> None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp!
Could they not be both?
I think it's only a matter of time before we decrypt the Voynich manuscript and the fourth message of Kryptos.
https://beinecke.library.yale.edu/beinecke/collections/beine...
"It is still conceivable that these curves were selected to have a specific property in principle by searching over timestamps to the random number generator."
Indeed! And we guess that OpenAI was gagged by the NSA because the massive proof dump on Oct. 6th did not contain cryptographic results.
I assume that Anthropic faces similar restrictions, so this seems kind of approved.
Would it have been feasible for a FOIA to reveal the origin from the primary source?
EDIT: ah, one of the linked authors tried that. They had no documentation on it. https://saweis.net/posts/nist-curve-seed-origins.html
Setting aside the use of "an internal research model", how would one go about prompting an LLM to do this?
>Let me be skeptical...is it plausible in reality?I didn't know that Jerry Solinas had died. I knew him slightly. He wasn't all that old. RIP regardless of whatever minor controversies he might have gotten into.
For fun, give Opus 5.5 the initial hint and watch it work through it:
"There's a curiosity I noticed in the seeds of the ECDSA curve origins. You see the 1st digit is never over 7, which means that the left most bit is never over 0. lrand48() returns 31 bit numbers u know? So what if those 4 seeds were built from lrand48 or something. If they're built from 31 bit numbers on per 32 bit word that explains the pattern. Wonder if there's some other insight you might have beyond this"
> Let me be careful about the plausibility: is it suspicious that such an obvious thing wasn’t discovered in 25 years?
Alright Claude no need to rub it in.
You can't prove the non-existence of a backdoor to elliptic curves...
There are a few Unix command patterns I type out quite a lot more than any others. Every time I do so I wonder “isn’t there a better way of doing this?”. I know I could do better or use better tools but also, meh, who cares? It’s more important to be productive than to be right, right?
The classics, of course:
ls -larth
… | awk ‘{print $…}’
for f in … ; echo foo $f ; end | sh -x
Another one though is if I need some kind of random-ish seed for something like a cache key, or a hidden URL path directory, or the password for the bitcoin wallet I keep publicly online to taunt others:
date | md5sum
For me, it was news that showed the cleverness of chacha's choice to use the "expand 32-byte k" ASCII byte sequence as a constants.
Why did they specifically skip other apparently suitable curve candidates? The B-163 seed and the base point origins of several other curves are still not explained
It just means that we should use cryptographically-secure PRNG for EVERYTHING even remotely related to crypto, and even for low priority systems. Everything, including passwords that we routinely generate and store in vaults/password managers.
I know it has no security impact in this case, but isn’t it odd a bunch of cryptographers would choose a weak PRNG seeded by the date for a task like this?
Even state lotteries back then used physical ping pong balls and a nothing-up-my-sleeve show after the evening news.
The prolonged conspiracy theories until this discovery make some sense… not having a ceremony around anything supposedly “random” is unexpected, even back in the 1990s.
I wait for the morning that we’ll wake up to ssh keys being useless
On the face if it, the big leap here was Claude autonomously envisioning, and deciding to pursue, the "ancient prng + date" angle - - rather than working backwards from the premise of deliberately weakened seeds or some other popular theory. To me that shows creativity, and modelling of the situation and method of the people at the NSA.
So two questions:
1. TFA mentions the "humourous phrase hash" theory, but Claude's trajectory seems to be a long way from that. To what extent was Claude prompted in the ultimately successful direction?
2. Whats with all the "hmm..." in the internal reasoning process log? Do models really do that? And if so, why? Some weird emergent language thing, or just mimicry?
Neat. Now they should figure out what's up with the secp256k1 curve and its weird generator point G where 1/2 G has 90 leading 0 bits.
Not entirely related to the topic, but did someone spent some tokens trying to figure out the origins of the "Wow! Signal" (https://en.wikipedia.org/wiki/Wow!_signal) ?
mda5("Sneed's Feed and Seed (Formerly Chuck's)")
They glow in the dark so you hit em' with your car.
crazy
So can we break crypto wallets now? Huzzah I’m going to be rich! ;-)
To me, this shows just how many open problems which have obvious solutions, or solutions which people suspect might be true but have not verified, can be confirmed with code that nobody except agents can be bothered to write.
At the extreme end of the optimism spectrum, there is a multiple million LOC program waiting to be written that can fully understand e.g. human DNA, or cancers, or proteins, or whatever else is needed to propel us forward medically. But of course, I'll believe it when I see it.
This is huge. It means the Bitcoin and Ethereum communities can now confidently ship the opcodes and precompiled contracts to check ECDSA signatures on P-256 in addition to K-256 curves, and stop worrying about possible NSA backdoors based on the chosen seeds (quantum computers are another story).
I turned out to be right in my advocacy years ago, here is my post: https://ethereum-magicians.org/t/eip-7212-precompiled-for-se...
Seems to me like a nothing burger? As long as there is no weakness, why should I care which PRNG shuffled bytes?
it's funny how they release highly editorialized reasoning output, but in production they hide it because it was outputting extremely embarassing "dumb" toughts with the low compute limits they gave the subscription tiers.
On September 20th a friend told me that he had as significant number of Anthropic credits that were about to expire and wondered about a use for them. I do not use their products because of their relentless commitment to depriving the public access to artificial intelligence (and particularly any AI that isn't acting on their behalf) and I strongly discourage anyone else from doing so. But since he was going to use the credits for something, I tried to think of a skut work task that would be of only idle curiosity and would not help advance their capability, enable a meaningful public announcement* for them, and was likely already probed by many others (so success would only be lottery effects). -- and basically just something so pointless I wouldn't want to waste my own compute grinding on it but might like to see the result.
So I recommended determining the origins of ECC seeds and base points. The agent worked continuously for many hours and did not uncover anything interesting that wasn't already known. I looked at the transcript and was struck by how idiotic the agent was-- significantly below the standard of intelligence I've come to expect from GLM running locally.
I'm not saying this to suggest that misanthropic hijacked someone elses work yet again-- this is an obvious question that many people have surely posed and success presumably depended on expert use (which was absolutely not applied in my friends example). But it does make me wonder if the company invisibly degraded the model performance.
[*] Seems I underestimated how trivial a result they'd bother trying to spin!
While this confirms the method of production it doesn't say anything about their selection, especially since they were, apparently, generated over a period of months. Specifically you cannot see those candidates that were generated and discarded.
"It is still conceivable that these curves were selected to have a specific property in principle by searching over timestamps to the random number generator."
Yes.
"However, you would only need to do that if you were going to disclose the timestamp as some evidence that the seed was innocuously generated."
Does not logically follow when "doing and saying nothing" will completely suffice.