Claude reveals ECDSA curve origins
anthropic.com
anthropic.com
"It is still conceivable that these curves were selected to have a specific property in principle by searching over timestamps to the random number generator."
Yes.
"However, you would only need to do that if you were going to disclose the timestamp as some evidence that the seed was innocuously generated."
Does not logically follow when "doing and saying nothing" will completely suffice.
And the disclosure happened now through Anthropic that is 100% not going to anger the NSA before the IPO and will have permission.
Ghislaine Maxwell's social security number?
Well, at least now we have a way to perform that analysis! Generate a bunch of curves by varying (along any degree of freedom) the input parameters to the seed generating function and see if there's any difference between the curves that are generated.
Finding out there is a class of weak 256-bit elliptic curves so large that they can be hit randomly with 2^30 tries would be a cryptanalytic breakthrough analogous to discovering all elliptic curve cryptography is broken.
Read section 3.1 of the Koblitz and Menezes paper. It was already implausible with 160 bits of freedom. https://eprint.iacr.org/2015/1018
If you want to believe the NSA knows ECC is broken and chose to risk moving the US government to it and somehow no one figured out the same break in 30 years, you're free to do so. But pretending the seed choice plays any role in that theory is over.
More precisely: not very random tries.
It is possible such a correlation could occur. but it would be much weirder than this being the result of a random search, which would already be very weird.
1. Only a very small number of valid seeds were discarded when compared to the number of n values. It seems we don't yet know why about half of the valid seeds were discarded but the explanation of a buggy curve validity checker doesn't seem implausible to me.
2. Directly to your point, most of the prime192 and prime239 curves required larger n values to find a valid seed and they are both smaller and used an earlier timestamp.
Oof, about that...
Reporting on declassified history says the NSA pushed for a shorter DES key; the compromise was 56 bits
NSA and a suspected cryptographic backdoor: the Dual_EC_DRBG random-number generator was the subject of reporting about an NSA backdoor and an alleged payment to RSA. RSA denied knowingly weakening its products.
TLS 1.0’s CBC chaining made IVs predictable and enabled the BEAST attack. That’s a documented protocol weakness, allegedly put in there by US state actors on purpose.
This is errant nonsense. At the time SSL/TLS were designed, using CBC with block ciphers was generally considered best practice - it was not at all an unusual choice.
The US government had no need to corrupt IPSEC standardization. The IETF did the work for them without prompting.
You have far more to fear from standards bodies just acting like standards bodies (limited recent exceptions notwithstanding) than from government interference with standards. Like I said, all NSA usually needs to do is sit back and wait for standards groups to come up with Heartbleed on their own.
Quoting something implies that it has certain authority (like a crypto expert) and the correctness track record of AI generated text is obviously shaky.
use
monospace
support
Specifically, that they had a backdoor for Dual EC DRBG[1], and pushed for a shorter key lenghth for DES, to intentionally weaken it.
It is, obviously, controversial. But I think there is certainly enough there that I wouldn't be confident that the NSA wouldn't recommend something they knew to be weak in some way, even to other government organizations.
All we know is that drand48 gave values that the NSA was happy with.
>even if we assume they tried all timestamps of 1997
A confusing official story doesn't disprove anything. If anything, that would be standard operating procedure for a signals intelligence plant.
>Finding out there is a class of weak 256-bit elliptic curves so large that they can be hit randomly with 2^30 tries would be a cryptanalytic breakthrough
A breakthrough would indeed be a terrible thing to waste. If I had one, I'd make a good and boring official cover story, and stick to it! Regular old spy-craft stuff, in other words. ;)
Why couldn't we make a new curve out in the open and then agree to use it? Increment an integer counter until a majority of cryptographers are satisfied.
The fact that the seed is not explained is troubling even if we can figure out how it was derived. We now know it uses a timestamp which means we can probe even deeper and more specifically into potential rigging of the numbers. I don't think we were supposed to figure this one out. I'd be interested in seeing the properties for curves of adjacent timestamps.
Gorgeous. I wonder if the NSA employee who did this suffered a head injury or has been quietly giggling to themselves for the last quarter century.
Anyway after I moved to Andalucía I now can understand the story he tells, but I have to pay close attention!
For English speakers: North and Castille (middle) Spanish it's like vanilla Spanish. It's understood almost everywhere modulo some jargon. Kinda like English from the BBC or the NBC/NPR/CNN.
Andalusian Spamish it's like Southern English: Fast speech, ommited consonants and merged words and some loanwords from Arabic used in everyday words but for us they are like ancient Spanish (Arabic origin alcancia vs hucha). Kinda like the borrowings from Spanish in the Southern US Engish). Lasso vs lace/ribbon, aficionado vs fan and so on.
> https://www.youtube.com/@steveweis4786
FTA: This work was conducted at Anthropic by [...], and Steve Weis.
I wonder how much time he spent on the video relative to the other stuff
Everyone was wrong!
I wasn't able to reach Bob. He was working in private industry as of 2018, but never responded.
But I do agree, it is unusual actually that the code was lost.
It is also unusual that they didn't include how they derived the seed, and weren't forced to pick a randomly generated one.
I guess these are all things that would happen today but this was not so long ago to my mind so it is a surprise it didn't happen!
Don’t “rand()” PRNG libraries usually seed with current UNIX time by default iF no seed is provided?
I don't think that "community" would accept any kind of answer as truthful so why waste the time...
It has been the entire focus of the backdoor concerns since the curves were adopted over 20 years ago and is the motivation for the work behind this article.
The cryptgraphy community is pretty reasonable folks, on the whole.
If they did know, they could have handed over these timestamps 15 years ago and put the issue to bed.
If I was the NSA, I'd just make a huge rainbow table of all (timestamp hashes, passphrase hashes of every book/movie, random sentences, etc), then generate huge numbers of (seed, secret key) pairs and pick the first one that matches.
Voila. All the crypto backdoor and a side of plausible deniability if anyone decodes the seed.
Bonus points if the exact "rainbow table" algorithm couldn't recover the original seed, so that's why NSA couldn't tell us where it came from. :)
RSA was good enough for my grandfather, and it's good enough for me.
Now, do we think that's likely? Probably no more likely than then being "easily broken" for decades without being noticed by the academic cryptography community.
Probably not quite this given the timestamps span over almost a year (but have some clustering in August 1997).
Given that the spread suggests they weren't just now() timestamps it would actually be interesting to know what the significance of the timestamps is, if any. Though it could be something boring like randomly sampling some local file creation times.
The simplest explanation would be that it was generated the same way as the others, but somebody mistyped a digit somewhere along the way to publishing, and therefore a solution could not be found with the assumption that the number is correct.
I dont even mean that as a dig to the people working there (although maybe some) they're literally a military wing of the worlds most powerful empire..
Lets be honest with ourselves, their job is to spy on people, and spies try to make their job easier not harder.
Hell it seems they did lie about the origins, which should bring their entire motivation into question. They spread rumors that it was a "silly phrase", thats ridiculous.
That's an argument that must be infuriating to all researchers who ever published a paper on that topic, because most likely Claude was trained with all of them.
When do we call it the right time to stop with the pitchforks, torches and selfish tendencies and accept that many papers published were used to help train a tool that brings discoveries to light for the entirety of humanity to benefit?
Now?
If we got rid of the two significant ways for businesses to raise money that would be bad for everyone.
Sorry what? Nice deflection but knowledge for the greater good of everyone and selfish corporate greed are not in the same camps of end results, the latter being in the same category of the original reply of individuals being selfish for their discoveries.
Unlocking knowledge is just a matter of time and effort, someone will do it. Why does it matter who when we have new technologies that allows enabling everyone in advancing human knowledge?
I've adapted a crypto-lib for TLS connections and had a mistake during negotation that truncated some algo-selection value, worked up until the other party started trialling post-quantum algorthims that apparently had algo-id's that collided with the truncated values I was using.
Claude figured out that from the code and trialling TLS handshakes.
Besides, since there was a bounty on finding the curve it seems unlikely that someone would've found out and not shared that? (unless working at a security service that figured out that it was possible to attack?)
Later you come up some idea, you do the experiment, write the paper, search for relevant citations when you write the intro.
Honestly I think this is actually desirable. For a mind to work well and do things creatively and efficiently it can't be a simple search engine, it needs to blend and meld and reform the information.
And that means the output can't be cleanly deterministically linked to the input. Unless you just keep a log then cite everything you've ever read in your life (and all the conversations and talks too).
The log is the training data. The impractical thing isn't keeping the log, it's including the log as citations. For an expert human, it'd be thousands of pages. For an LLM, you might as well just put "citation: all human language ever written".
And your search includes papers mentioning the various ideas you heard about from those other people. They almost always publish _something_ about it, and in the rare cases they do not, you put them in the "thanks" section, describing which ideas they contributed to (or in very rare cases, cite an unpublished result/claim as "personal communication" from an author).
I was in academic for a number of years (Theoretical Comp Sci, then DB management systems architecture), and what I just described seems to have been the practice. It is of course possible that people neglected to cite the sources of some of their ideas, but not that I know of. The worst I could say is that several authors' work exhibited a similar approach and a person preferred to cite one of them rather than another.
NIST published recommended SEEDS in 1999 July. They spend 2 years checking 20 bytes SEEDS that were generated by casually by a hand of amateurish method.
I do not believe this claim. It just Claude hit a jackpot that happens to match 20 bytes.
Ouch. The implied judgment of us humans stings there.
The real question is "how much would it cost me to solve a similarly hard problem?" which is impossible to answer without them giving the detail on how many of these projects they are running and how many tokens they are burning, something they don't tell us.
I tend to think of the market kind of like a social media feed, i.e. engagement matters. Even if they're establishing these results at an overhead, they're doing so with money that otherwise would probably never be spent on these problems, or would only be over very long timeframes.
Whether this is sustainable is where what you describe comes in. And it may not be, but that doesn't mean it isn't impressive. Lots of cool technologies in history that failed to justify their stay.
You are right that there is nothing wrong with, e.g: Red Bull sponsoring an extreme athlete to do some crazy sport that was otherwise never going to get funding. It's true that otherwise they were never going to get funding for it, but it's advertising for Red Bull and something cool for people doing something interesting, win-win.
I think the difference is that Red Bull have a very strong income stream that funds it. Currently all these AI companies are burning investor money, and to me, that looks less like "savvy advertising" and more like "pumping the bubble".
[1] https://www.businessinsider.com/openais-math-dump-rattles-ma...
Or consider the algorithmic complexity classes underpinning all of this, not just P vs NP, but also whether quantum computers are actually a distinct class, since that is not proven yet either afaik. The reason we're moving to quantum resistant algos in the first place.
Remember when OpenAI published 700 math break throughs and absolutely none involved cryptography?
The only thing that bridges this moat is continued advancement of open models.
But EC never seemed to cause trouble somehow.
If we allow these providers to promote regulatory capture they become the arbiter of what anyone is "allowed" to do
As this is going on, Anthropic has opened up their own biology lab.
> https://www.reuters.com/world/anthropic-quietly-sets-up-biol...
There is very much a situation where people in frontier labs have access to exceptional capabilities that are being kept from the rest of us, and they're using it to strip-mine technical and scientific problems.
They sure as hell ain't stripteasing :)
If these capabilities were available to the public, someone somewhere would make a biological weapon or create a virus we've never seen before that could kill many millions of people.
Stanford researchers have demonstrated it’s possible [1].
[1]: "AI creates 16 new viruses from scratch, showing promise for drug resistance and drawing warnings about potential for misuse" - https://www.cnn.com/2026/08/06/health/ai-viruses-bacteriopha...
Information is not dangerous. This is a ridiculous argument to me, but maybe my chemistry degree has me biased.
It's the equivalent of making pipe bombs at home.
The instructions are out in the public, but that's not a problem because the idiots that make pipe bombs blow themselves up more often than they succeed in doing terrorism.
AI isn't going to magically assemble a DNA sequence for you and a computer design is not a guarantee of something that works.
AI restrictionists love to pretend that their toys will, with the power of intelligence, magically bypass fundamental limitations of reality to conjure up fantastical weapons of mass destruction if they throw enough computers at the task. Unfortunately for them, that is not how the world works.
[1] https://www.businessinsider.com/researchers-ai-apocalypse-sk...
In the past my attempts to work on crypto related problems have been met with needing the higher tier of "offensive" access.
Anthropic wants to IPO, they don't want another Fable shutdown situation.
To be clear I would prefer the cyber safeguards to be less restrictive, I think they're currently too much. I often go to open models because of it. But there are likelier reasons to restrict cyber than world domination.
I think the current administration would delight in harsher penalties
> Maybe, but that's what the cyber program is for
> and Claude helped you find it as a normal person, Anthropic would get bad PR
Why are we celebrating and encouraging the walling off of the global intellectual columns?
The idea that you can't reverse engineer things, make things, learn about biology or physics without permission is strange to me. These machines have been trained on the sum intellectual output of humanity, the global intellectual commons, and are being used to close off that commons?
I would be OK with their right to create such restrictions if they weren't lobbying the Government to restrict others, thereby ensuring that they control humanity's intellectual commons well into the future.
Who are they to say what I can learn or can't learn? Who are they to control what I can or can't do with these tools?
Perhaps I'm naive, but I think it's better for humans and the machines if we can all think, learn and build. But then again, I'm the kind of person who rejects the doomer pill.
Reject this.
I mean this is the standard of biochem research right now. You can't just order 50 gallons of TNT off Amazon and neither can you get live viruses from a lab just because you want to do research.
And really they aren't restricting any of that. I've never had Claude stop me from going to the library and reading a book.
You don't have a legal right to do anything you want with their model. And if you don't like that you are going to have to convince politicians to enact new laws to change that.
In a properly free market, we'd have regulations that prohibit labs from vertical integration so they have to release and sell a model and another company hosts it and sell access to it. Americanism, America's implementation of capitalism doesn't have such regulations though (and how would that even work?) so we're stuck with Anthropic having that power.
The fear, justified or not, is that a terrorist is going to use Claude to make sarin nerve gas and bomb subway stations, or the digital equivalent. Could you live with that on your conscience? I don't think I could, but fortunately for me, I don't work at Anthropic so don't have to answer that real life trolly problem.
I am amazed at how a technical gloss can obscure basic rights. That's legal! It's in chemistry / agronomy books, freely available in libraries. I have the right to tell you how that is done, and you have the right to read what I write.
An LLM isn't a book. You can still go buy the books you want. An LLM, especially as they get more advanced, are agents. You can ask them do to things and they can interact with tools to do things.
You're free to print a cocaine book. You're not free to incorporate it into a cocaine making machine without violating numerous laws.
If you program a computer to make cocaine for you, you're the one violating the law. If you ask an LLM to do the same for you, you're the one violating the law. The LLM's capabilities are irrelevant.
Cool, so I'll have you make an LLM that can make cosine, then I'll provide you paid access to the machine to can ask the right question to do it illegally. Then when you get caught and blame me we'll both be in court defending ourselves.
You're argument is "doesn't justify". This is a private corporation, not a government. There is no freedom of speech law involved here if the corporation says no. Now, when the government tells LLM corporations that there are limits they will gladly agree.
Next, the government will classify the LLMs as munitions and you'll be spending the next 50 years fighting on reversing that when a big chunk of the population is anti-AI enough to let them do it. After that will be bans and registration on hardware.
There are two things that you are confusing. One is what you'd like to happen in an open data world like existed after the cold war. And then there is what is going to happen, and it's going to be messy, authoritarian, and closed. And you will lose the openness that had been occurring up to this point.
There is no world in which the general public agrees to wide open access to info-hazards, and there are people that will ensure enough disasters happen to close that future.
The last thing we need is more math addicts roaming the streets
In reasonable countries, this is exactly how it works. You can own lockpicks, practice picking locks, and even publish detailed instructions on how to pick locks. It's only when you pick someone else's lock that a crime is committed.
Limiting access to tools and knowledge benefits the wealthy and privileged.
In reasonable countries, this is exactly how it works. You can own lockpicks, practice picking locks, and even publish detailed instructions on how to pick locks. It's only when you pick someone else's lock that a crime is committed.
Limiting access to tools and knowledge benefits the wealthy and privileged. Knowledge should proliferate, that is how the world has worked long before I was born and god willing that is how it will work long after I die.
That's not true. It's certainly legal to own lab equipment, but when you start combining equipment with the intent to make cocaine, you're committing a crime long before any drug is produced.
Any country who's a party to the 1988 UN Convention Against Illicit Traffic in Narcotic Drugs has such laws, including the US, UK, and most of Europe.
People have always been able to do this before Claude. The information is out there and if you use a VPN there's not much they can do. The existence of information isn't the blocker for why attacks don't happen.
Just watch the speed at which robots have been developing in the past few years. It is honestly crazy how much more stable things like bi-pedal robots have become. Coupled with things like multimodal LLMs they can accomplish quite a lot. Again most of it comes down to fine motor control and speed of decoding the world around it.
That said - there likely were the same issues with cars in early days and then we got a body of settled case law that let the car companies off the hook for this and put responsibility on the user unless a manufacturing defect was the cause.
In the case of models, knowledge has historically always been dangerous! Is the library liable if a kid figures out how to do chemistry and builds a device? What about YouTube? I find it hard to believe this would hold up in court over time. So far, the only cases I’ve seen are when AI has encouraged self-harm which does in fact seem like a legit defect.
Gatekeeping knowledge like this will only serve to enable those that break the law, not protect, in my judgment.
And just so this isn’t pure fodder for the machine - torch staple must of course infant music verb noun right? :)
I mean, greed alone would seem to be enough, and it would be fully worth calling out as bullshit.
I have been in the cyber program since around the time it first went public and recently renewed it with the updated program.
You still trivially hit guadrails. I was trying to reverse engineer some bit of 20-year-old software that already has known, unmitigated exploits and it still downgraded me.
open weights are the better way imo, no elite gatekeepers please
I later got Claude to crack their licensing checks too, by convincing it to write a "license checker" program, and then a second "test case generator" script for the license checker... (Opus 4.8 was smart enough to see what I was doing, but Opus 4.6 complied)
Part of me wonders whether the NSA/other TLA has either (a) an unrestricted model from a lab with less scruples like SpaceX, or (b) an in-house model, either abliterated or with data they've bought themselves.
https://support.claude.com/en/articles/14604842-cyber-verifi...
Dario keeps saying in interviews that AI hacking is not a problem because "the good guys will protect themselves with AI", but then gate-keeps.
I submitted the form and it was rejected without reason.
Now what?
It looks unlikely that I'll be approved, since I have no CVEs credited to me, and I do not publicly post about security concerns.
..........................................
The Cyber Verification Program is not available on free plans, so we are unable to approve you for the program.
If your plan changes, you're welcome to apply again at any time.
Regards,
The Anthropic Safeguards Team
..........................................
It looks like I will have to pay them to be considered. It has a cooldown of seven days. Check back in a week to see if my bribe works.
The risk/reward is way lopsided towards risk for the labs to vet individuals. Much easier to get an organization and have them take the blast if someone/something goes off the rails.
I cannot in any universe see the labs putting themselves in a "We should never had given this person access" situation.
Are their guardrail benchmarks or anything of the sort that we can use to see where the bifurcation of permission/capability occurs?
If this seems concerning, wait until the models get effective enough (gets work done properly at a lower energy need than humans have) that there's no reason for them to release anything. Why offer your weights for download or grant any third party usage access when you can just do the actual job yourself and collect all that turnover?
Do you trust the people who would gate these capabilities? I do not.
I don't think it will be too long before models are considered munitions and having the weights for one will require registration.
Sometimes I want a fast-forward button for life, the times are so exciting and I want to know what else 8B people can think of next but there's so far no way to turn pages faster ^^'
There are just a few places where the most high tech hardware is made. If we turned off new and unregistered hardware now it would be just a few years as most hardware fast enough to run LLMs would disappear from public hands.
It will still exist, but be in the hands of militaries and authoritarian governments. If you piddle around on the net showing off your open standards you'll be relentlessly attacked by these entities digitally. More so, those areas will be generally embargoed.
The future looks like a new cold war with a lot more digital weapons.
It's hilarious how a the trillions invested in AI companies, and their valuations are predicated on the AI labs Sherlocking entire industries, and yet CEOs, mathematicians, and everyone else are eagerly feeding the beast their most prized information.
A lot of pre-Internet businesses are still here with us, and online. The one thing the survivors did not do was hitch their wagons on a predator designed in a lab to devour them - to use mixed metaphors. Barnes & Noble didn't board up their brick-and-mortar stores to replace them with an Amazon storefront - they figured out how to use the Internet without handing over the family jewels.
The alternative is starving because someone else will.
That's why those companies are worth trillions.
There's also a thing called commodity fetishism but capitalists usually learn the hard way that things created with machines without human input miss the essence of why we're willing to pay for something. Its why a handmade watch is $100k and a casio is $100, or a handmade sweater identical to a machine made goes for 10x.
They could also just make us so poor and anxious that we beg to fight eachother in wars.
One is produced by 500 humans collaborating and the second is completely generated by an AI that can actually make a movie
A single individual or small group of people who own the GPUs profit from the AI version, and the human version provides a salary to 500 humans/families.
Which one are you buying tickets for and choosing to spend 2 hours watching?
Alright Claude no need to rub it in.
Didn't know I needed to hear this until I saw it.
Not sure where along my life I became so tense all the time!
Could they not be both?
https://beinecke.library.yale.edu/beinecke/collections/beine...
so frustratingly, if it is an ancient hoax we can't ever prove it. all we would observe is that we haven't deciphered it, but failing to decipher isn't proof that there's nothing to decipher.
I personally think it is a weird OTP (effectively). We have the book but the algorithm is so unclear it could be anything.
Indeed! And we guess that OpenAI was gagged by the NSA because the massive proof dump on Oct. 6th did not contain cryptographic results.
I assume that Anthropic faces similar restrictions, so this seems kind of approved.
And is "the key was locked away" really that crazy? Or "the key was badly generated"?
We published HAWK and McEliece attacks no problem.
EDIT: ah, one of the linked authors tried that. They had no documentation on it. https://saweis.net/posts/nist-curve-seed-origins.html
NIST closed it: https://www.muckrock.com/foi/united-states-of-america-10/ori...
NSA ignored it: https://www.muckrock.com/foi/united-states-of-america-10/ori...
I think part of it is I don't know how to write these FOIA requests in the right way they can comply with it. I think you need to be more specific.
starts to rebuild trust at least :)
what's one thing that you can actually talk about out of this that might help people to understand that's getting lost?
"read this: https://words.filippo.io/seeds-bounty/ then find the solution to the bounty"
"There's a curiosity I noticed in the seeds of the ECDSA curve origins. You see the 1st digit is never over 7, which means that the left most bit is never over 0. lrand48() returns 31 bit numbers u know? So what if those 4 seeds were built from lrand48 or something. If they're built from 31 bit numbers on per 32 bit word that explains the pattern. Wonder if there's some other insight you might have beyond this"
'Side curiosity: many of the SECG/X9.62 seeds contain the ASCII text 4D696E6768756151 75 = "MinghuaQu" (a Certicom researcher), sometimes shifted by half a byte.'
I don't see any mention of that in the article.
The seed for P-224 uses a timestamp from 1998, and they also said the four binary curve seeds were timestamps from 1984 that were doubled - someone did srand48(time / 2) not srand48(time).
Did the P-224 seed get updated later / was not provided in 1997, or is there some other reason for this? Otherwise, it looks like one third of these values need additional excuses to get them to map to the time range in question...
So yeah, it seems plausible P-224 and the B-* curves were generated at a later date.
>Let me be skeptical...is it plausible in reality?I turned out to be right in my advocacy years ago, here is my post: https://ethereum-magicians.org/t/eip-7212-precompiled-for-se...
But it's nice to be able to shut the whole unproductive debate down directly.
Is it impossible? It is hard to prove impossible. But this is not what I would expect backdoors to look like.
In fact this makes me think that the information about how these were generated must have been lost very early in the process, or over-compartmentalized away from the wrong people. It seems like the NSA should have been positively delighted to show that these were the origins of the seeds as they are decent "nothing up my sleeve" numbers: https://en.wikipedia.org/wiki/Nothing-up-my-sleeve_number Advertising that fact should have been advantageous to the NSA if that is indeed how they were generated, so my best guess is that the parts of the NSA that should have been showing us that must not have themselves known.
The classics, of course:
ls -larth
… | awk ‘{print $…}’
for f in … ; echo foo $f ; end | sh -x
Another one though is if I need some kind of random-ish seed for something like a cache key, or a hidden URL path directory, or the password for the bitcoin wallet I keep publicly online to taunt others:
date | md5sum
$ cat .inputrc
"\e\C-a": " | awk '{print $ }'\C-b\C-b\C-b"
At the extreme end of the optimism spectrum, there is a multiple million LOC program waiting to be written that can fully understand e.g. human DNA, or cancers, or proteins, or whatever else is needed to propel us forward medically. But of course, I'll believe it when I see it.
So I recommended determining the origins of ECC seeds and base points. The agent worked continuously for many hours and did not uncover anything interesting that wasn't already known. I looked at the transcript and was struck by how idiotic the agent was-- significantly below the standard of intelligence I've come to expect from GLM running locally.
I'm not saying this to suggest that misanthropic hijacked someone elses work yet again-- this is an obvious question that many people have surely posed and success presumably depended on expert use (which was absolutely not applied in my friends example). But it does make me wonder if the company invisibly degraded the model performance.
[*] Seems I underestimated how trivial a result they'd bother trying to spin!
Sandbagging is real.
Some points:
I am one of the authors of libsecp256k1, the primary implementation of the aforementioned "different elliptic curve" used widely in cryptocurrency systems. I would characterize the position differently: Secp256k1's design is rigid, or quite close to it (at least as much as anything made before being rigid was an explicit goal).
Knowing how the seeds were selected in the NIST curve does not render them rigid and were very unlikely to do so: the scheme described ends up giving them 20-25 bits of freedom, perhaps more (esp given the unexplained skip values)-- plus more bits for the 'choice of scheme'.
Of course, it seems unlikely that 25 bits of grind gives you an exploitable weakness, but that was also true for 256 bits of grind. You're dealing with an unknown-unknown, once you are concerned about the the possibility of magically weak curves which we have no reason to believe exist at all why would not also be concerned that they exist at one in a million levels and not just one in a billion? (especially given compute available at the time they probably couldn't even have ground out that many more bits).
The whole concept of rigid parameters which is now popular is that by making the selection inflexible you avoid the losing game of debating how much free grinding is too much-- the right amount is there should be no avoidable grindspace. The fact that the origin of the seed wasn't immediately apparent right away meant that there was substantial grindspace-- if nothing else the selection among the myriad possible schemes that people would have found credible.
I don't think the result meaningfully changes the reason for preferences. And more recent development has rendered the question less interesting: New systems are mostly PQ and ideally PQ hybrids. Things using ECC should likely prefer Curve448 because of better security vs performance tradeoffs and not being as close to the edge for advancing attacks. If older cryptosystems are desired, now that the GLV patent has expired secp256k1 has considerable performance benefits-- another good reason to continue using it.
The 'advantage' of many vendor P256 libs is also illusory-- people think their microcontroller ecdsa binary is "hardware accelerated" when often it's a barely competent software implementation that has serious design (e.g. timing sidechannels) and interface flaws.
I also think it's not that relevant because the systems that use secp256k1 more than anything else do so for compatibility reasons (because that's what Bitcoin originally used-- and other systems were either trying to be compatible or were slavishly copy-and-pasting and avoiding departing from Bitcoin's choices out of an abundance of caution)-- and discovering that NIST curves might be better than some feared probably has no impact.
The idea that someone would go "oh, I'll use P256 now!" when they would otherwise have used e.g. secp256k1 seemed implausible to me at the time-- and continues to do so now, having seen the conclusion. Maybe someone, somewhere does--- but meh.
Of course, finding something problematic would be incredible news-- but I don't think I was unreasonable in assigning a probability essentially zero to that. Moreover, what I was describing was my casual thoughts about someone elses disposable credits-- no one else is required to agree: Unlike some other parties (say, anthropic)-- my view that some line of research isn't good or interesting has no bearing on anyone elses ability to pursue them. :)
Cheers!
So two questions:
1. TFA mentions the "humourous phrase hash" theory, but Claude's trajectory seems to be a long way from that. To what extent was Claude prompted in the ultimately successful direction?
2. Whats with all the "hmm..." in the internal reasoning process log? Do models really do that? And if so, why? Some weird emergent language thing, or just mimicry?
Assuming that is actually the real reasoning trace (open weight model reasoning traces usually do things like switch languages or talk in non-standard English because of model drift, so it's a bit surprising that Claude wouldn't do the same) there was a study a few years ago that found base models produce better answers if you put "take a deep breath" in the prompt[1]. Maybe in the RL training stage stuff like that gets reinforced and because reasoning traces are hidden in RLHF it doesn't get selected out? My money is on it not being the real reasoning trace though.
I remember hearing this in a cryptanalysis lecture at some point, so it was not a completely novel theory.
Admittedly I am not finding written evidence of this anywhere.
Even state lotteries back then used physical ping pong balls and a nothing-up-my-sleeve show after the evening news.
The prolonged conspiracy theories until this discovery make some sense… not having a ceremony around anything supposedly “random” is unexpected, even back in the 1990s.
The starting point for finding a curve coefficient is totally arbitrary (so long as the math on the resulting curve equation checks out). Competing curves use mathematical constants like pi and e to do the same thing. It's simply a number everyone has to agree on; it has no other significance.
There is no evidence that it was backdoored.
Just seems to me like that's quite low on the priority list. I guess this result assures some people that the values are good.
There are some caveats here. There are some intrinsic properties of numbers that random numbers satisfy with high probability, e.g. having high kolmogorov complexity. But these are generally very difficult to compute, and I would personally guess you could concoct (probably artificial) scenarios where
1. picking parameters randomly yields a secure construction, but
2. there exists a parameter set with high kolmogorov complexity that is insecure.
e.g. "high kolmogorov complexity", while being a property of random numbers, is generally not viewed as nearly as useful as being randomly generated (which is exhibited by saying generator + seed = the particular number, like in this article).
And yes, knowing what numbers are bad so that we avoid them is a good goal.
Somehow, I find these results fascinating, but also quite sad, because we used a machine to solve it at all. I feel like some half drunk motivated graduate level humans could have figured it out too.
Then again, once you know the answer, perhaps you have an obligation to share it, keeping it to yourself might be unfair to everyone else.
Honestly I’m not entirely sure how I feel about all this. I would gladly welcome any groundbreaking work Claude might do to solve hard problems and move the world forward by decades or even centuries.
But these sorts of fun problems feel like things we should avoid pointing LLMs at. They remind me of those weird programming puzzles that are difficult to solve but incredibly fun to work through.
My concern is that if Claude ends up solving all the fun problems, will humans be left with nothing but the hard, headache-inducing ones? Tao had raised a similar concern, problems that graduate students would have been expected to solve and learn the process, are now things you can simply point an LLM at.
I’m still not sure how I will ever reconcile with this feeling, about any of this. I just find it genuinely sad that we might be automating away not only the difficult work, but also the joy of figuring things out for ourselves.
As people say on Twitter, the machine is coding, puzzling, playing, and unstressed; you are washing the dishes, doing the chores, managing its workload, and responsible for its mistakes. :-|
>provided by the NSA with no explanation or justification.
Really? Nobody is concerned about the NSA just cheerfully dictating that? Smells very rainbow-table-y
This is not very exciting
Uh… did you talk to any cryptographers? This is EXACTLY what a weak curve would look like. Imagine that 1 in a thousand, or one in a million keys, selected at random, are vulnerable to some withheld attack. This approach lets you vary the timestamp or number of iterations until a weak key is found, then have plausible deniability afterward. This is why modern systems choose constants in a way with no free choice of parameters (e.g. sqrt of 2 for first constant, cube root for second constant, etc.).
They even note later in the article that viable curves in the generator sequence seem to have been skipped.
google some of the names under the "Who we are" heading
Especially finding the solution that is based on using a random number generator.
It's like people seeing proof that the future was written in Harry Potter books by reading the first letter of the top of the page of a weird set of pages.
I have that right?
It claims that NIST member feed UNIX time of certain points in 1997-1998 to srand() and draw 20 bytes for n times, then use the last 20 bytes for the SEEDS.
Why NIST staff in 1999 used default rand() implementation of libc(or languages which rely on libc) at that time? Linear congruential generator was infamous for its poor quality even in 1990s.
NIST published recommended SEED value in 1999, July. Why did they use UNIX time from 1997-1998?
Why the exact date of that UNIX times are so sparse? 1 in 1997 May, 3 in 1997 Auguest, 1 in 1998 April? If they did srand(time(NULL)), it should be more closer.
The number of n'th 20 bytes thrown out is also doesn't make sense. n=139 for P-192, n=7026 for P-224 and so on. Why did they choose this numbers in particular? Why P-192 was odd and 3 digits while rest of 4 were even and 4 digits?
It seems to me, Claude simply hit a jackpot of coincidentally matching 20 bytes.
Ahaha ha hahaha haha ha haaha ha.
No.