Claude reveals ECDSA curve origins

sweis

13 years of tinfoil hats for srand48(time(NULL)

tptacek

This is devastating news... for an entire generation of NIST cryptography conspiracy theories.

EGreg

This is huge. It means the Bitcoin and Ethereum communities can now confidently ship the opcodes and precompiled contracts to check ECDSA signatures on P-256 in addition to K-256 curves, and stop worrying about possible NSA backdoors based on the chosen seeds (quantum computers are another story). I turned out to be right in my advocacy years ago, here is my post: https://ethereum-magicians.org/t/eip-7212-precompiled-for-se...

slowin

This neat and all but I think there's a bigger issue here. Anthropic (and whoever Anthropic wants) can do this kind of work with Claude, but if you or I try to do it, we will get blocked. This is a fun exercise, but extend this to something much more nefarious and you can see a moat widening between the model providers, their government partners, and the public. The only thing that bridges this moat is continued advancement of open models.

jamienk

More and more it is the relentlessness of the models that strikes me. Leave no stone unturned! Go through ALL of these old boxes. Someone said they thought maybe it was over there somewhere >>shrug<<

JumpCrisscross

“In under half an hour, Claude discovered the origins of the NIST P-192, P-224, P-256, P-384 and P-521 seeds. None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp!” Gorgeous. I wonder if the NSA employee who did this suffered a head injury or has been quietly giggling to themselves for the last quarter century.

myth_drannon

Not entirely related to the topic, but did someone spent some tokens trying to figure out the origins of the "Wow! Signal" ( https://en.wikipedia.org/wiki/Wow!_signal ) ?

ecshafer

Interesting. So there was no humorous phrase, and its probably safe from backdoors. They do look pretty random.

selfmodruntime

> None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp! Could they not be both?

baggy_trough

Stochastic parrot truthers in shambles.

adastra22

> This is not a cryptographic break, new attack, or weakness in the ECDSA curves. In fact, this makes us more confident the curves were chosen without any backdoors or intentional weaknesses. Uh… did you talk to any cryptographers? This is EXACTLY what a weak curve would look like. Imagine that 1 in a thousand, or one in a million keys, selected at random, are vulnerable to some withheld attack. This approach lets you vary the timestamp or number of iterations until a weak key is found, then have plausible deniability afterward. This is why modern systems choose constants in a way with no free choice of parameters (e.g. sqrt of 2 for first constant, cube root for second constant, etc.). They even note later in the article that viable curves in the generator sequence seem to have been skipped.

entrope

> is it suspicious that such an obvious thing wasn’t discovered in 25 years? Ouch. The implied judgment of us humans stings there.

fidotron

While this confirms the method of production it doesn't say anything about their selection, especially since they were, apparently, generated over a period of months. Specifically you cannot see those candidates that were generated and discarded. "It is still conceivable that these curves were selected to have a specific property in principle by searching over timestamps to the random number generator." Yes. "However, you would only need to do that if you were going to disclose the timestamp as some evidence that the seed was innocuously generated." Does not logically follow when "doing and saying nothing" will completely suffice.

cloudfudge

Makes me wonder if any implementations will do the cute trick of dispensing with the seed constants and deriving them at startup from the unix timestamps. :)

minraws

As unsurprised as I am by this, and as much as I suspect a lot of people could have guessed it, having Claude confirm it is still fascinating, but. Somehow, I find these results fascinating, but also quite sad, because we used a machine to solve it at all. I feel like some half drunk motivated graduate level humans could have figured it out too. Then again, once you know the answer, perhaps you have an obligation to share it, keeping it to yourself might be unfair to everyone else. Honestly I’m not entirely sure how I feel about all this. I would gladly welcome any groundbreaking work Claude might do to solve hard problems and move the world forward by decades or even centuries. But these sorts of fun problems feel like things we should avoid pointing LLMs at. They remind me of those weird programming puzzles that are difficult to solve but incredibly fun to work through. My concern is that if Claude ends up solving all the fun problems, will humans be left with nothing but the hard, headache-inducing ones? Tao had raised a similar concern, problems that graduate students would have been expected to solve and learn the process, are now things you can simply point an LLM at. I’m still not sure how I will ever reconcile with this feeling, about any of this. I just find it genuinely sad that we might be automating away not only the difficult work, but also the joy of figuring things out for ourselves.

egl2020

Setting aside the use of "an internal research model", how would one go about prompting an LLM to do this?

hoten

Would it have been feasible for a FOIA to reveal the origin from the primary source? EDIT: ah, one of the linked authors tried that. They had no documentation on it. https://saweis.net/posts/nist-curve-seed-origins.html

teddyh

> The fifth binary seed, B-163, fits nothing Claude has tried and remains unexplained. The simplest explanation would be that it was generated the same way as the others, but somebody mistyped a digit somewhere along the way to publishing, and therefore a solution could not be found with the assumption that the number is correct.

129-adn

"It is still conceivable that these curves were selected to have a specific property in principle by searching over timestamps to the random number generator." Indeed! And we guess that OpenAI was gagged by the NSA because the massive proof dump on Oct. 6th did not contain cryptographic results. I assume that Anthropic faces similar restrictions, so this seems kind of approved.

ArcHound

Seems to me like a nothing burger? As long as there is no weakness, why should I care which PRNG shuffled bytes?