This neat and all but I think there's a bigger issue here. Anthropic (and whoever Anthropic wants) can do this kind of work with Claude, but if you or I try to do it, we will get blocked. This is a fun exercise, but extend this to something much more nefarious and you can see a moat widening between the model providers, their government partners, and the public.

The only thing that bridges this moat is continued advancement of open models.

While this confirms the method of production it doesn't say anything about their selection, especially since they were, apparently, generated over a period of months. Specifically you cannot see those candidates that were generated and discarded.

"It is still conceivable that these curves were selected to have a specific property in principle by searching over timestamps to the random number generator."

Yes.

"However, you would only need to do that if you were going to disclose the timestamp as some evidence that the seed was innocuously generated."

Does not logically follow when "doing and saying nothing" will completely suffice.

“In under half an hour, Claude discovered the origins of the NIST P-192, P-224, P-256, P-384 and P-521 seeds. None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp!”

Gorgeous. I wonder if the NSA employee who did this suffered a head injury or has been quietly giggling to themselves for the last quarter century.

> The fifth binary seed, B-163, fits nothing Claude has tried and remains unexplained.

The simplest explanation would be that it was generated the same way as the others, but somebody mistyped a digit somewhere along the way to publishing, and therefore a solution could not be found with the assumption that the number is correct.

13 years of tinfoil hats for srand48(time(NULL)

So it’s pretty clear that Anthropic is privately trying to break cryptography.

This is devastating news... for an entire generation of NIST cryptography conspiracy theories.

> is it suspicious that such an obvious thing wasn’t discovered in 25 years?

Ouch. The implied judgment of us humans stings there.

More and more it is the relentlessness of the models that strikes me. Leave no stone unturned! Go through ALL of these old boxes. Someone said they thought maybe it was over there somewhere >>shrug<<

I think it's only a matter of time before we decrypt the Voynich manuscript and the fourth message of Kryptos.

https://beinecke.library.yale.edu/beinecke/collections/beine...

https://allthatsinteresting.com/kryptos

> None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp!

Could they not be both?

I find it so ridiculous that they (seemingly) forcefully try to state references to dedicated researchers who devoted much of their lives to the problem, while the LLM does not even know which trained papers were effectively used. That means likely many researchers not listed were heavily influencing this achievement, and Claude does not even know that they helped. And the world doesn't know.

Makes me wonder if any implementations will do the cute trick of dispensing with the seed constants and deriving them at startup from the unix timestamps. :)

"It is still conceivable that these curves were selected to have a specific property in principle by searching over timestamps to the random number generator."

Indeed! And we guess that OpenAI was gagged by the NSA because the massive proof dump on Oct. 6th did not contain cryptographic results.

I assume that Anthropic faces similar restrictions, so this seems kind of approved.

Would it have been feasible for a FOIA to reveal the origin from the primary source?

EDIT: ah, one of the linked authors tried that. They had no documentation on it. https://saweis.net/posts/nist-curve-seed-origins.html

Interesting. So there was no humorous phrase, and its probably safe from backdoors. They do look pretty random.

Setting aside the use of "an internal research model", how would one go about prompting an LLM to do this?

As one of the original bounty sponsors, I'm thrilled to pay my portion to ISRG. :)

Why did they specifically skip other apparently suitable curve candidates? The B-163 seed and the base point origins of several other curves are still not explained

On the face if it, the big leap here was Claude autonomously envisioning, and deciding to pursue, the "ancient prng + date" angle - - rather than working backwards from the premise of deliberately weakened seeds or some other popular theory. To me that shows creativity, and modelling of the situation and method of the people at the NSA.

So two questions:

1. TFA mentions the "humourous phrase hash" theory, but Claude's trajectory seems to be a long way from that. To what extent was Claude prompted in the ultimately successful direction?

2. Whats with all the "hmm..." in the internal reasoning process log? Do models really do that? And if so, why? Some weird emergent language thing, or just mimicry?

I wait for the morning that we’ll wake up to ssh keys being useless

crazy

Neat. Now they should figure out what's up with the secp256k1 curve and its weird generator point G where 1/2 G has 90 leading 0 bits.

This is huge. It means the Bitcoin and Ethereum communities can now confidently ship the opcodes and precompiled contracts to check ECDSA signatures on P-256 in addition to K-256 curves, and stop worrying about possible NSA backdoors based on the chosen seeds (quantum computers are another story).

I turned out to be right in my advocacy years ago, here is my post: https://ethereum-magicians.org/t/eip-7212-precompiled-for-se...

Not entirely related to the topic, but did someone spent some tokens trying to figure out the origins of the "Wow! Signal" (https://en.wikipedia.org/wiki/Wow!_signal) ?

Seems to me like a nothing burger? As long as there is no weakness, why should I care which PRNG shuffled bytes?

[dead]

Stochastic parrot truthers in shambles.

>“seed” parameter

>provided by the NSA with no explanation or justification.

Really? Nobody is concerned about the NSA just cheerfully dictating that? Smells very rainbow-table-y

> This is not a cryptographic break, new attack, or weakness in the ECDSA curves. In fact, this makes us more confident the curves were chosen without any backdoors or intentional weaknesses.

Uh… did you talk to any cryptographers? This is EXACTLY what a weak curve would look like. Imagine that 1 in a thousand, or one in a million keys, selected at random, are vulnerable to some withheld attack. This approach lets you vary the timestamp or number of iterations until a weak key is found, then have plausible deniability afterward. This is why modern systems choose constants in a way with no free choice of parameters (e.g. sqrt of 2 for first constant, cube root for second constant, etc.).

They even note later in the article that viable curves in the generator sequence seem to have been skipped.