Yet another Hacker News

Claude reveals ECDSA curve origins

328 points ahlCVA 1 hour ago 126 comments

https://words.filippo.io/seeds-solved/

sweis 1 hour ago | parent

13 years of tinfoil hats for srand48(time(NULL)

217 1 hour ago | parent

But the friends we made along the way!...

bayarearefugee 1 hour ago | parent

> 13 years of tinfoil hats for srand48(time(NULL)

Probably not quite this given the timestamps span over almost a year (but have some clustering in August 1997).

Given that the spread suggests they weren't just now() timestamps it would actually be interesting to know what the significance of the timestamps is, if any. Though it could be something boring like randomly sampling some local file creation times.

tptacek 1 hour ago | parent

This is devastating news... for an entire generation of NIST cryptography conspiracy theories.

nickysielicki 29 minutes ago | parent

It’s perplexing that NIST chose to burn so much trust and goodwill with the independent cryptography community instead of just explaining empirically that they really had nothing up their sleeve.

tptacek 23 minutes ago | parent

It was a very different time back then.

rs_rs_rs_rs_rs 18 minutes ago | parent

"independent cryptography community" - I actually LOLed at this

I don't think that "community" would accept any kind of answer as truthful so why waste the time...

nickysielicki 15 minutes ago | parent

It’s independently verifiable. What do you mean?

sweis 12 minutes ago | parent

I think they legitimately did not know. The person who worked on it directly, Jerry Solinas, did not remember and gave an explanation that turned out to be wrong. In his defense, multiple people told the same story about hashing a phrase that was wrong.

If they did know, they could have handed over these timestamps 15 years ago and put the issue to bed.

yrjrjjrjjtjjr 7 minutes ago | parent

If they deny everything they didn't do, then whatever they don't deny will stand out.

EGreg 1 hour ago | parent

This is huge. It means the Bitcoin and Ethereum communities can now confidently ship the opcodes and precompiled contracts to check ECDSA signatures on P-256 in addition to K-256 curves, and stop worrying about possible NSA backdoors based on the chosen seeds (quantum computers are another story).

I turned out to be right in my advocacy years ago, here is my post: https://ethereum-magicians.org/t/eip-7212-precompiled-for-se...

tptacek 1 hour ago | parent

Nobody conversant with elliptic curve cryptography research believed there was a backdoor based on these seeds; for a number of reasons, best articulated by Koblitz and Menezes (who took on the question directly).

But it's nice to be able to shut the whole unproductive debate down directly.

ReptileMan 1 hour ago | parent

But what if there is a backdoor and just looped the RNG until they find the seeds that will match it. Just in case. /s

jerf 1 hour ago | parent

Taking the question seriously (when I wrote this there was no /s), since I think it is still a question some people legitimately have, it is still extremely implausible that such tight dates and such a small number of iterations are all backdoored. For backdoors to be that dense would indicate some sort of serious flaw in the algorithm as a whole as well, something so serious that it should be fairly obvious. If these were initialized from dates, each separated by some billions of years and with the iteration parameters also in the millions or billions or trillions for no apparent reason it would be time to be suspicious.

Is it impossible? It is hard to prove impossible. But this is not what I would expect backdoors to look like.

In fact this makes me think that the information about how these were generated must have been lost very early in the process, or over-compartmentalized away from the wrong people. It seems like the NSA should have been positively delighted to show that these were the origins of the seeds as they are decent "nothing up my sleeve" numbers: https://en.wikipedia.org/wiki/Nothing-up-my-sleeve_number Advertising that fact should have been advantageous to the NSA if that is indeed how they were generated, so my best guess is that the parts of the NSA that should have been showing us that must not have themselves known.

clipsy 1 hour ago | parent

If there’s one thing everyone knows about conspiracy theorists, it’s that they’re willing to accept concrete disproof of their theories. /s

slowin 1 hour ago | parent

This neat and all but I think there's a bigger issue here. Anthropic (and whoever Anthropic wants) can do this kind of work with Claude, but if you or I try to do it, we will get blocked. This is a fun exercise, but extend this to something much more nefarious and you can see a moat widening between the model providers, their government partners, and the public.

The only thing that bridges this moat is continued advancement of open models.

ronsor 1 hour ago | parent

I know Anthropic models have a lot of insane, paranoid filters, but I don't remember them blocking cryptography work last I checked (some 3 months ago now).

AkshatJ27 1 hour ago | parent

3 months ago is like years ago in the current AI landscape

AtNightWeCode 1 hour ago | parent

The cyber filter blocks really basic stuff all the time. People who are pro that bs should be forced to only eat with a spoon for the rest of their life.

therein 50 minutes ago | parent

If you have a variable `const char *shellcode` in a fizzbuzz function, it is enough for it to lose its mind.

AtNightWeCode 43 minutes ago | parent

It stopped me from doing basic bit operations. I have looked around and others have the same problem.

sillysaurusx 3 minutes ago | parent

For me it refused to move Claude transcripts from point A to point B on my local machine. It kept getting flagged as reasoning extraction or something. The line of "It's my machine, I can move files wherever I want" shouldn't be crossed. Someday file managers are going to go extinct and LLMs will organize everything, and they shouldn't choose what files you can and can't access on your own computer.

vessenes 50 minutes ago | parent

I routinely get rejected on elliptic curve related requests; often I can talk Claude back into some work on it. But it is surprisingly sensitive to talking about research cryptography in my experience. I’m not in their cyber program.

comex 1 hour ago | parent

I'm skeptical that this particular task would get blocked, though I could be wrong. But I agree that the moat is a problem in the general case.

richwater 1 hour ago | parent

It doesn't matter what is blocked today, it matters what is blocked tomorrow.

If we allow these providers to promote regulatory capture they become the arbiter of what anyone is "allowed" to do

A_D_E_P_T 1 hour ago | parent

I don't know about cryptography, but if you try anything in organic chemistry or biology, you virtually always get flagged and downgraded.

As this is going on, Anthropic has opened up their own biology lab.

> https://www.reuters.com/world/anthropic-quietly-sets-up-biol...

There is very much a situation where people in frontier labs have access to exceptional capabilities that are being kept from the rest of us, and they're using it to strip-mine technical and scientific problems.

derwiki 1 hour ago | parent

Strip mining is a great phrase here, thank you

Bluestein 1 hour ago | parent

Agree.-

They sure as hell ain't stripteasing :)

handfuloflight 51 minutes ago | parent

The strip teasing is all of their capability gating.

Bluestein 30 minutes ago | parent

Come to think of it, indeed.-

A_D_E_P_T 57 minutes ago | parent

I can't take any credit for it. I believe Terence Tao coined it first. He also wrote a bit about it here: https://mathstodon.xyz/@tao/117237320796901560

alwillis 36 minutes ago | parent

> There is very much a situation where people in frontier labs have access to exceptional capabilities that are being kept from the rest of us, and they're using it to strip-mine technical and scientific problems.

If these capabilities were available to the public, someone somewhere would make a biological weapon or create a virus we've never seen before that could kill many millions of people.

Stanford researchers have demonstrated it’s possible [1].

[1]: "AI creates 16 new viruses from scratch, showing promise for drug resistance and drawing warnings about potential for misuse" - https://www.cnn.com/2026/08/06/health/ai-viruses-bacteriopha...

girvo 8 minutes ago | parent

We already have controls for that: we control access to the reagents and equipment needed. Yknow, like we always have.

Information is not dangerous. This is a ridiculous argument to me, but maybe my chemistry degree has me biased.

sillysaurusx 5 minutes ago | parent

I ran into this situation and was able to work around it by running a jailbroken Chinese model that turned out to be quite capable. I think it was Qwen.

akersten 1 hour ago | parent

At minimum we don't have access to "Claude thoughts" like the ones the article highlighted, right? That's part of the hidden reasoning?

mike_d 1 hour ago | parent

I have access to Claude's "defensive" cyber model and it appears to take no issue with the prompt, but I suspect that is because it uses today's publication as the basis for an answer.

In the past my attempts to work on crypto related problems have been met with needing the higher tier of "offensive" access.

jcomp 1 hour ago | parent

Broadly, the downgrading is still way too heavy-handed and clumsy. As of yesterday “How easy to crack is WPA2” downgraded to opus 4.8. Granted I could probably have phrased it differently and gotten a response, but the point is I shouldn’t have to. It can’t simultaneously be smart enough to reverse the ECDSA curve seed and not smart enough not to destroy the world by answering a trivial question with a scary word in it.

petesergeant 1 hour ago | parent

Fable 5.1 has downgraded me in the past week alone for the crimes of describing a coordinating server as "the C&C server" ([cyber]), for doing some statistical analysis on some toy Vigenère-ciphered text ([cyber]), and for asking it to help me find patterns in some semi-random text ([bio]), so it is fair to say I am not skeptical.

antics 1 hour ago | parent

JFYI, this is not true. I do stuff like this all the time.

st3fan 1 hour ago | parent

Anyone can do this kind of work with a model as simple as GLM 5.3 or Kimi K3

randomblock1 1 hour ago | parent

Maybe, but that's what the cyber program is for. Nobody knew if the seed was fine or a backdoor. If it was a backdoor, and Claude helped you find it as a normal person, Anthropic would get bad PR. If you're a verified security researcher, actually that's fantastic and Anthropic would get good PR and everybody claps.

Anthropic wants to IPO, they don't want another Fable shutdown situation.

To be clear I would prefer the cyber safeguards to be less restrictive, I think they're currently too much. I often go to open models because of it. But there are likelier reasons to restrict cyber than world domination.

petesergeant 1 hour ago | parent

> Anthropic would get bad PR

I think the current administration would delight in harsher penalties

areoform 55 minutes ago | parent

    > Maybe, but that's what the cyber program is for

Why?

    > and Claude helped you find it as a normal person, Anthropic would get bad PR

Why?

Why are we celebrating and encouraging the walling off of the global intellectual columns?

The idea that you can't reverse engineer things, make things, learn about biology or physics without permission is strange to me. These machines have been trained on the sum intellectual output of humanity, the global intellectual commons, and are being used to close off that commons?

I would be OK with their right to create such restrictions if they weren't lobbying the Government to restrict others, thereby ensuring that they control humanity's intellectual commons well into the future.

Who are they to say what I can learn or can't learn? Who are they to control what I can or can't do with these tools?

Perhaps I'm naive, but I think it's better for humans and the machines if we can all think, learn and build. But then again, I'm the kind of person who rejects the doomer pill.

Reject this.

Daishiman 27 minutes ago | parent

> The idea that you can't reverse engineer things, make things, learn about biology or physics without permission is strange to me. These machines have been trained on the sum intellectual output of humanity, the global intellectual commons, and are being used to close off that commons?

I mean this is the standard of biochem research right now. You can't just order 50 gallons of TNT off Amazon and neither can you get live viruses from a lab just because you want to do research.

areoform 5 minutes ago | parent

OK, so then no problem, why are Anthropic restricting my ability to learn and reason?

solyin 27 minutes ago | parent

Because there are good and bad people in the world, and if I ask Claude "how do I make cocaine" and it gives me a thorough recipe, it doesn't know if I'm being intellectually curious or trying to become the next Pablo Escobar. They're Anthropic, and because they made Claude, they get to say what we can do with it. Which, I agree, is total bullshit. If I buy a Ford car and I can do whatever I want with it. Drive to work, drive for Uber, set it on fire; plowing into a crowd of protestors is covered by existing laws against vehicular manslaughter. Ford doesn't get a say. But because cars are so ubiquitous and a known technology, there's no blowback to Ford if I commit crimes with my car that I bought from them. If I commit crimes and Claude helped, Anthropic is gonna get sued (there's already litigation against the labs for deaths), and they don't want that.

In a properly free market, we'd have regulations that prohibit labs from vertical integration so they have to release and sell a model and another company hosts it and sell access to it. Americanism, America's implementation of capitalism doesn't have such regulations though (and how would that even work?) so we're stuck with Anthropic having that power.

The fear, justified or not, is that a terrorist is going to use Claude to make sarin nerve gas and bomb subway stations, or the digital equivalent. Could you live with that on your conscience? I don't think I could, but fortunately for me, I don't work at Anthropic so don't have to answer that real life trolly problem.

saghm 52 minutes ago | parent

> But there are likelier reasons to restrict cyber than world domination.

I mean, greed alone would seem to be enough, and it would be fully worth calling out as bullshit.

landr0id 41 minutes ago | parent

>Maybe, but that's what the cyber program is for.

I have been in the cyber program since around the time it first went public and recently renewed it with the updated program.

You still trivially hit guadrails. I was trying to reverse engineer some bit of 20-year-old software that already has known, unmitigated exploits and it still downgraded me.

verdverm 26 minutes ago | parent

> that's what the cyber program is for

open weights are the better way imo, no elite gatekeepers please

Retr0id 1 hour ago | parent

I worked on this specific task myself, using Claude, and I was not blocked (although I did not succeed!)

tptacek 1 hour ago | parent

Same!

novia 1 hour ago | parent

A form of being blocked is sandbagging the models

Retr0id 57 minutes ago | parent

I saw no evidence of sandbagging. And since it was an open problem, there'd be no reasonable way to "steer away" from the correct solution.

nicce 46 minutes ago | parent

Can you be sure that the model was not constrained for you, regardless? Since they can’t help too much with cyber, they might avoid some routes to not get completely flagged and that could influence for not finding the solution.

Retr0id 41 minutes ago | parent

I have seen behaviour a little like what you describe, in other tasks. When I was cracking the keys for Sony's camera firmware updates, Claude steered away from an obfuscated library, seemingly because it thought it might be related to licensing checks. It was indeed related to licensing checks, but also firmware update decryption. I had to explicitly tell Claude to write a deobfuscator for it, which it did, and eventually I had the keys.

I later got Claude to crack their licensing checks too, by convincing it to write a "license checker" program, and then a second "test case generator" script for the license checker... (Opus 4.8 was smart enough to see what I was doing, but Opus 4.6 complied)

dogben 8 minutes ago | parent

Same. I tried it just a few days ago. This news made me almost jump out of bed.

nxobject 1 hour ago | parent

> moat widening between the model providers, their government partners, and the public.

Part of me wonders whether the NSA/other TLA has either (a) an unrestricted model from a lab with less scruples like SpaceX, or (b) an in-house model, either abliterated or with data they've bought themselves.

jamienk 1 hour ago | parent

I feel like history is repeating itself - to many people AOL, Compuserve, MSN, et al seemed superior to "the web" in the early 1990s because they dumped money into making it slicker, licensed content, provided guardrails, made it easy for non-tech people... They had slick ads, were cultural phenoms, and people would take sides with the companies and think their arguments were strong and even obvious!

novia 1 hour ago | parent

Anthropic gets zero of my money because their favorite word is no. I cannot figure out how to as an individual or a small startup request elevated permissions for the purposes of anything that they think might potentially be dangerous for someone who is not me to access. I have a background in cybersecurity. I have a background in life sciences. Can I put those skills to use to benefit humanity? Who knows.

ceejayoz 15 minutes ago | parent

> I cannot figure out how to as an individual or a small startup request elevated permissions…

https://support.claude.com/en/articles/14604842-cyber-verifi...

https://portal.anthropic.com/programs/cvp

WarmWash 15 minutes ago | parent

I imagine the path forward for the labs will be signing off on organizations/institutions rather than individuals.

The risk/reward is way lopsided towards risk for the labs to vet individuals. Much easier to get an organization and have them take the blast if someone/something goes off the rails.

I cannot in any universe see the labs putting themselves in a "We should never had given this person access" situation.

arionhardison 1 hour ago | parent

How do you know this to be true? I am not disagreeing; I genially need to understand why or if others are seeing blockers that I don't see or if I am seeing blockers that they do not see.

Are their guardrail benchmarks or anything of the sort that we can use to see where the bifurcation of permission/capability occurs?

lp92 56 minutes ago | parent

Compute has always been gated. This is nothing new. If we look at the HPC space, many of the largest clusters were restricted access and used by governments organizations. Even the ones with "public" access, not just anyone could get access to it.

varispeed 31 minutes ago | parent

Whenever I say that the rich have access to much more capable and unrestricted models I get downvotes. Yet here we have another example.

Aachen 26 minutes ago | parent

> [The model's authors] can do this kind of work with Claude, but if you or I try to do it, we will get blocked.

If this seems concerning, wait until the models get effective enough that there's no reason for them to release anything. Why offer your weights for download or grant any third party usage access when you can just do the actual job yourself and collect all that turnover?

genxy 17 minutes ago | parent

They will just have someone look at every question, they will let it pass, want a cut or deny it. Claude, you can answer this guys question, but don't tell 'em how you solved it and don't give him the best answer, give him an ok answer.

jamienk 1 hour ago | parent

More and more it is the relentlessness of the models that strikes me. Leave no stone unturned! Go through ALL of these old boxes. Someone said they thought maybe it was over there somewhere >>shrug<<

JumpCrisscross 1 hour ago | parent

“In under half an hour, Claude discovered the origins of the NIST P-192, P-224, P-256, P-384 and P-521 seeds. None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp!”

Gorgeous. I wonder if the NSA employee who did this suffered a head injury or has been quietly giggling to themselves for the last quarter century.

tptacek 1 hour ago | parent

Someone just posted this:

https://www.youtube.com/watch?v=eOQfNT6Jdkg

JumpCrisscross 1 hour ago | parent

Genuine question, how many days of your life have you had to spend on this particular tinfoil convention?

weakfish 59 minutes ago | parent

Video is meant as a joke, it’s common to edit the subtitles of this video to alternate ones

sweis 57 minutes ago | parent

Some previous discussions started based on these posts: https://blog.cryptographyengineering.com/2015/10/22/a-riddle... https://eprint.iacr.org/2015/1018

hybrid_study 1 hour ago | parent

understanding Spanish throws it off, but this is hilarious either way. LOL

guelo 49 minutes ago | parent

I understand Spanish being from Latin America but for a long time I couldn't understand a single thing he said because of the Spaniard accent and crazy laughter, and I enjoyed the memes just fine. But then few years ago I watched it with the real subtitles and something clicked in my brain so now when I watch it I mostly understand him fine. But now the memes are ruined because it's hard to hear and read two speeches at the same time. Just an annecdote about our weird brains.

tptacek 4 minutes ago | parent

Is this like what Downfall is like for Germans?

mrguyorama 49 minutes ago | parent

That's one of the best executed implementations of that joke I've seen in years.

blast 44 minutes ago | parent

> Someone

> https://www.youtube.com/@steveweis4786

FTA: This work was conducted at Anthropic by [...], and Steve Weis.

I wonder how much time he spent on the video relative to the other stuff

sweis 1 hour ago | parent

The two people were Bob Reiter and Jerry Solinas. Jerry wrote in a 2015 email to Daniel Bernstein that he thought it was a hash of the passphrase. I corroborated that story with 4 people, including two ex-NSA folks off the record.

Everyone was wrong!

I wasn't able to reach Bob. He was working in private industry as of 2018, but never responded.

myth_drannon 1 hour ago | parent

Not entirely related to the topic, but did someone spent some tokens trying to figure out the origins of the "Wow! Signal" (https://en.wikipedia.org/wiki/Wow!_signal) ?

ecshafer 1 hour ago | parent

Interesting. So there was no humorous phrase, and its probably safe from backdoors. They do look pretty random.

selfmodruntime 1 hour ago | parent

> None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp!

Could they not be both?

lanternfish 1 hour ago | parent

Extremely unlikely - these are very sparse domains.

baggy_trough 1 hour ago | parent

Stochastic parrot truthers in shambles.

adastra22 1 hour ago | parent

> This is not a cryptographic break, new attack, or weakness in the ECDSA curves. In fact, this makes us more confident the curves were chosen without any backdoors or intentional weaknesses.

Uh… did you talk to any cryptographers? This is EXACTLY what a weak curve would look like. Imagine that 1 in a thousand, or one in a million keys, selected at random, are vulnerable to some withheld attack. This approach lets you vary the timestamp or number of iterations until a weak key is found, then have plausible deniability afterward. This is why modern systems choose constants in a way with no free choice of parameters (e.g. sqrt of 2 for first constant, cube root for second constant, etc.).

They even note later in the article that viable curves in the generator sequence seem to have been skipped.

mapmeld 1 hour ago | parent

This is discussed in the post - since the NSA never mentioned how these seeds were created, it seems unlikely that they would develop a cover story that would not be shared and only opened to scrutiny many years later

john_strinlai 1 hour ago | parent

>Uh… did you talk to any cryptographers

google some of the names under the "Who we are" heading

entrope 1 hour ago | parent

> is it suspicious that such an obvious thing wasn’t discovered in 25 years?

Ouch. The implied judgment of us humans stings there.

sigmar 22 minutes ago | parent

Did that clanker call us dumb? Scorch the skies, this means war.

fidotron 1 hour ago | parent

While this confirms the method of production it doesn't say anything about their selection, especially since they were, apparently, generated over a period of months. Specifically you cannot see those candidates that were generated and discarded.

"It is still conceivable that these curves were selected to have a specific property in principle by searching over timestamps to the random number generator."

Yes.

"However, you would only need to do that if you were going to disclose the timestamp as some evidence that the seed was innocuously generated."

Does not logically follow when "doing and saying nothing" will completely suffice.

tptacek 1 hour ago | parent

God bless you for keeping this alive.

fidotron 1 hour ago | parent

It doesn't prove anything about the core part of the suspicion, which is they were selected using some undisclosed criteria, which may make them weaker or stronger than some other random numbers.

You are entirely familiar with the precedent of the DES s boxes of course, where that is exactly what happened.

JumpCrisscross 1 hour ago | parent

> which may make them weaker or stronger than some other random numbers

Are there non-trivial weaker and stronger seeds for this category of elliptic curves?

fidotron 59 minutes ago | parent

Exactly.

When they made the changes to the s boxes for differential cryptanalysis resistance the entire concept of that was essentially secret, so who knows what they know about elliptic curves.

matthewdgreen 26 minutes ago | parent

The number of weak classes of elliptic curve would have to be gargantuan for this specific search to produce some. If that many curves are bad, then ECC was a mistake.

tptacek 25 minutes ago | parent

Again, Koblitz and Menezes take this idea on directly in their paper. But I mean, at this point, nobody serious is going to take the P-curve seed conspiracy theory seriously ever again.

1230917 34 minutes ago | parent

"However, you would only need to do that if you were going to disclose the timestamp as some evidence that the seed was innocuously generated."

And the disclosure happened now through Anthropic that is 100% not going to anger the NSA before the IPO and will have permission.

bflesch 33 minutes ago | parent

If you keep posting like this you're gonna get microwaved from space ;)

cloudfudge 1 hour ago | parent

Makes me wonder if any implementations will do the cute trick of dispensing with the seed constants and deriving them at startup from the unix timestamps. :)

egl2020 1 hour ago | parent

Setting aside the use of "an internal research model", how would one go about prompting an LLM to do this?

john_strinlai 1 hour ago | parent

probably something like:

"read this: https://words.filippo.io/seeds-bounty/ then find the solution to the bounty"

hoten 1 hour ago | parent

Would it have been feasible for a FOIA to reveal the origin from the primary source?

EDIT: ah, one of the linked authors tried that. They had no documentation on it. https://saweis.net/posts/nist-curve-seed-origins.html

sweis 5 minutes ago | parent

[delayed]

teddyh 1 hour ago | parent

> The fifth binary seed, B-163, fits nothing Claude has tried and remains unexplained.

The simplest explanation would be that it was generated the same way as the others, but somebody mistyped a digit somewhere along the way to publishing, and therefore a solution could not be found with the assumption that the number is correct.

lukeify 51 minutes ago | parent

This is also why one of the Zodiac ciphers remained unsolved for so long. The dude made a mistake in his transcription.

azinman2 46 minutes ago | parent

Very well possible. I’m glad to see that this is all above board in the end, which further argues the case AGAINST conspiracy theories. Most people are just trying to do the right thing.

129-adn 1 hour ago | parent

"It is still conceivable that these curves were selected to have a specific property in principle by searching over timestamps to the random number generator."

Indeed! And we guess that OpenAI was gagged by the NSA because the massive proof dump on Oct. 6th did not contain cryptographic results.

I assume that Anthropic faces similar restrictions, so this seems kind of approved.

solyin 18 minutes ago | parent

The conspiracy theory going around the Internet is that they (the AI labs) broke cryptography in some way a la last season of HBO's Silicon Valley, and they're keeping the results under wraps until they can steal Bitcoin out of Satoshi's dead wallets, and then use that to pay for GPUs et al.

sweis 8 minutes ago | parent

[delayed]

ArcHound 1 hour ago | parent

Seems to me like a nothing burger? As long as there is no weakness, why should I care which PRNG shuffled bytes?

entrope 28 minutes ago | parent

The process to generate these was opaque, so there was some concern that the values might have been backdoored somehow like Dual_EC_DRBG was; we didn't even have confidence that they were generated from a PRNG rather than some other process. Knowing that the values were generated this way makes it much less plausible that there is such a backdoor.

Havoc 1 hour ago | parent

>“seed” parameter

>provided by the NSA with no explanation or justification.

Really? Nobody is concerned about the NSA just cheerfully dictating that? Smells very rainbow-table-y

I_am_tiberius 1 hour ago | parent

I find it so ridiculous that they (seemingly) forcefully try to state references to dedicated researchers who devoted much of their lives to the problem, while the LLM does not even know which trained papers were effectively used. That means likely many researchers not listed were heavily influencing this achievement, and Claude does not even know that they helped. And the world doesn't know.

baggy_trough 1 hour ago | parent

Sounds entirely reasonable to me. They tried to give some credit. The main contribution is the solution that Claude came up with.

I_am_tiberius 57 minutes ago | parent

> The main contribution is the solution that Claude came up with.

That's an argument that must be infuriating to all researchers who ever published a paper on that topic, because most likely Claude was trained with all of them.

baggy_trough 56 minutes ago | parent

I suppose so, but it's still the case.

nicce 51 minutes ago | parent

Maybe someone already figured it out, but it is well covered somewhere. And Claude just used it. I wonder if we ever know for sure.

tonfa 38 minutes ago | parent

Wouldn't they have claimed the bounty?

nicce 33 minutes ago | parent

If they thought it to be backdoor, why not sell for some other believer who pays more than the bounty? But anyway, not everyone is after money and fame.

whizzter 31 minutes ago | parent

Claude seems to be fairly good at bruteforcing/testing/etc on it's own, it solved a fairly intricate thing while I was busy on other things.

I've adapted a crypto-lib for TLS connections and had a mistake during negotation that truncated some algo-selection value, worked up until the other party started trialling post-quantum algorthims that apparently had algo-id's that collided with the truncated values I was using.

Claude figured out that from the code and trialling TLS handshakes.

Besides, since there was a bounty on finding the curve it seems unlikely that someone would've found out and not shared that? (unless working at a security service that figured out that it was possible to attack?)

howunfortunate 57 minutes ago | parent

This happens in academia all the time. You read a ton of papers, chat with tons of people about tons of ideas.

Later you come up some idea, you do the experiment, write the paper, search for relevant citations when you write the intro.

Honestly I think this is actually desirable. For a mind to work well and do things creatively and efficiently it can't be a simple search engine, it needs to blend and meld and reform the information.

And that means the output can't be cleanly deterministically linked to the input. Unless you just keep a log then cite everything you've ever read in your life (and all the conversations and talks too).

andyjohnson0 57 minutes ago | parent

On the face if it, the big leap here was Claude autonomously envisioning, and deciding to pursue, the "ancient prng + date" angle - - rather than working backwards from the premise of deliberately weakened seeds or some other popular theory. To me that shows creativity, and modelling of the situation and method of the people at the NSA.

So two questions:

1. TFA mentions the "humourous phrase hash" theory, but Claude's trajectory seems to be a long way from that. To what extent was Claude prompted in the ultimately successful direction?

2. Whats with all the "hmm..." in the internal reasoning process log? Do models really do that? And if so, why? Some weird emergent language thing, or just mimicry?

tptacek 21 minutes ago | parent

From the video posted upthread, the vibe I get is that they prompted Claude about the bounty and to approach it from first principles rather than building another clone of John the Ripper.

reaperhulk 53 minutes ago | parent

As one of the original bounty sponsors, I'm thrilled to pay my portion to ISRG. :)

CGMthrowaway 52 minutes ago | parent

Why did they specifically skip other apparently suitable curve candidates? The B-163 seed and the base point origins of several other curves are still not explained

theandrewbailey 49 minutes ago | parent

I think it's only a matter of time before we decrypt the Voynich manuscript and the fourth message of Kryptos.

https://beinecke.library.yale.edu/beinecke/collections/beine...

https://allthatsinteresting.com/kryptos

xurukefi 33 minutes ago | parent

Neat. Now they should figure out what's up with the secp256k1 curve and its weird generator point G where 1/2 G has 90 leading 0 bits.

ultim8k 25 minutes ago | parent

I wait for the morning that we’ll wake up to ssh keys being useless