Top
Best
New

Posted by ahlCVA 4 hours ago

Claude reveals ECDSA curve origins(www.anthropic.com)
https://words.filippo.io/seeds-solved/
505 points | 212 commentspage 3
ultim8k 2 hours ago|
I wait for the morning that we’ll wake up to ssh keys being useless
versooth 54 minutes ago|
To be clear, this is in no way close to a cryptographic attack.
reaperhulk 3 hours ago||
As one of the original bounty sponsors, I'm thrilled to pay my portion to ISRG. :)
CGMthrowaway 3 hours ago||
Why did they specifically skip other apparently suitable curve candidates? The B-163 seed and the base point origins of several other curves are still not explained
IshKebab 1 hour ago||
> Let me be careful about the plausibility: is it suspicious that such an obvious thing wasn’t discovered in 25 years?

Alright Claude no need to rub it in.

ceifa 1 hour ago||
crazy
andyjohnson0 3 hours ago||
On the face if it, the big leap here was Claude autonomously envisioning, and deciding to pursue, the "ancient prng + date" angle - - rather than working backwards from the premise of deliberately weakened seeds or some other popular theory. To me that shows creativity, and modelling of the situation and method of the people at the NSA.

So two questions:

1. TFA mentions the "humourous phrase hash" theory, but Claude's trajectory seems to be a long way from that. To what extent was Claude prompted in the ultimately successful direction?

2. Whats with all the "hmm..." in the internal reasoning process log? Do models really do that? And if so, why? Some weird emergent language thing, or just mimicry?

cyphar 1 hour ago||
> 2. Whats with all the "hmm..." in the internal reasoning process log? Do models really do that? And if so, why? Some weird emergent language thing, or just mimicry?

Assuming that is actually the real reasoning trace (open weight model reasoning traces usually do things like switch languages or talk in non-standard English because of model drift, so it's a bit surprising that Claude wouldn't do the same) there was a study a few years ago that found base models produce better answers if you put "take a deep breath" in the prompt[1]. Maybe in the RL training stage stuff like that gets reinforced and because reasoning traces are hidden in RLHF it doesn't get selected out? My money is on it not being the real reasoning trace though.

[1]: https://arxiv.org/abs/2309.03409

fooker 1 hour ago|||
> the "ancient prng + date" angle

I remember hearing this in a cryptanalysis lecture at some point, so it was not a completely novel theory.

Admittedly I am not finding written evidence of this anywhere.

tptacek 2 hours ago||
From the video posted upthread, the vibe I get is that they prompted Claude about the bounty and to approach it from first principles rather than building another clone of John the Ripper.
EGreg 3 hours ago|
This is huge. It means the Bitcoin and Ethereum communities can now confidently ship the opcodes and precompiled contracts to check ECDSA signatures on P-256 in addition to K-256 curves, and stop worrying about possible NSA backdoors based on the chosen seeds (quantum computers are another story).

I turned out to be right in my advocacy years ago, here is my post: https://ethereum-magicians.org/t/eip-7212-precompiled-for-se...

tptacek 3 hours ago||
Nobody conversant with elliptic curve cryptography research believed there was a backdoor based on these seeds; for a number of reasons, best articulated by Koblitz and Menezes (who took on the question directly).

But it's nice to be able to shut the whole unproductive debate down directly.

ReptileMan 3 hours ago||
But what if there is a backdoor and just looped the RNG until they find the seeds that will match it. Just in case. /s
jerf 3 hours ago||
Taking the question seriously (when I wrote this there was no /s), since I think it is still a question some people legitimately have, it is still extremely implausible that such tight dates and such a small number of iterations are all backdoored. For backdoors to be that dense would indicate some sort of serious flaw in the algorithm as a whole as well, something so serious that it should be fairly obvious. If these were initialized from dates, each separated by some billions of years and with the iteration parameters also in the millions or billions or trillions for no apparent reason it would be time to be suspicious.

Is it impossible? It is hard to prove impossible. But this is not what I would expect backdoors to look like.

In fact this makes me think that the information about how these were generated must have been lost very early in the process, or over-compartmentalized away from the wrong people. It seems like the NSA should have been positively delighted to show that these were the origins of the seeds as they are decent "nothing up my sleeve" numbers: https://en.wikipedia.org/wiki/Nothing-up-my-sleeve_number Advertising that fact should have been advantageous to the NSA if that is indeed how they were generated, so my best guess is that the parts of the NSA that should have been showing us that must not have themselves known.

clipsy 3 hours ago||
If there’s one thing everyone knows about conspiracy theorists, it’s that they’re willing to accept concrete disproof of their theories. /s
More comments...