Top
Best
New

Posted by ahlCVA 4 hours ago

Claude reveals ECDSA curve origins(www.anthropic.com)
https://words.filippo.io/seeds-solved/
540 points | 232 commentspage 4
IshKebab 1 hour ago|
> Let me be careful about the plausibility: is it suspicious that such an obvious thing wasn’t discovered in 25 years?

Alright Claude no need to rub it in.

EGreg 4 hours ago||
This is huge. It means the Bitcoin and Ethereum communities can now confidently ship the opcodes and precompiled contracts to check ECDSA signatures on P-256 in addition to K-256 curves, and stop worrying about possible NSA backdoors based on the chosen seeds (quantum computers are another story).

I turned out to be right in my advocacy years ago, here is my post: https://ethereum-magicians.org/t/eip-7212-precompiled-for-se...

tptacek 4 hours ago||
Nobody conversant with elliptic curve cryptography research believed there was a backdoor based on these seeds; for a number of reasons, best articulated by Koblitz and Menezes (who took on the question directly).

But it's nice to be able to shut the whole unproductive debate down directly.

ReptileMan 4 hours ago||
But what if there is a backdoor and just looped the RNG until they find the seeds that will match it. Just in case. /s
jerf 4 hours ago||
Taking the question seriously (when I wrote this there was no /s), since I think it is still a question some people legitimately have, it is still extremely implausible that such tight dates and such a small number of iterations are all backdoored. For backdoors to be that dense would indicate some sort of serious flaw in the algorithm as a whole as well, something so serious that it should be fairly obvious. If these were initialized from dates, each separated by some billions of years and with the iteration parameters also in the millions or billions or trillions for no apparent reason it would be time to be suspicious.

Is it impossible? It is hard to prove impossible. But this is not what I would expect backdoors to look like.

In fact this makes me think that the information about how these were generated must have been lost very early in the process, or over-compartmentalized away from the wrong people. It seems like the NSA should have been positively delighted to show that these were the origins of the seeds as they are decent "nothing up my sleeve" numbers: https://en.wikipedia.org/wiki/Nothing-up-my-sleeve_number Advertising that fact should have been advantageous to the NSA if that is indeed how they were generated, so my best guess is that the parts of the NSA that should have been showing us that must not have themselves known.

clipsy 4 hours ago||
If there’s one thing everyone knows about conspiracy theorists, it’s that they’re willing to accept concrete disproof of their theories. /s
ceifa 2 hours ago||
crazy
xurukefi 3 hours ago||
Neat. Now they should figure out what's up with the secp256k1 curve and its weird generator point G where 1/2 G has 90 leading 0 bits.
myth_drannon 4 hours ago||
Not entirely related to the topic, but did someone spent some tokens trying to figure out the origins of the "Wow! Signal" (https://en.wikipedia.org/wiki/Wow!_signal) ?
ArcHound 4 hours ago||
Seems to me like a nothing burger? As long as there is no weakness, why should I care which PRNG shuffled bytes?
entrope 3 hours ago|
The process to generate these was opaque, so there was some concern that the values might have been backdoored somehow like Dual_EC_DRBG was; we didn't even have confidence that they were generated from a PRNG rather than some other process. Knowing that the values were generated this way makes it much less plausible that there is such a backdoor.
ArcHound 2 hours ago|||
But you can still analyse the behaviour of the values to identify backdoor behaviour rather than insisting on uncovering the exact method od generation.

Just seems to me like that's quite low on the priority list. I guess this result assures some people that the values are good.

mswphd 4 minutes ago||
you (mostly) can't. In computing, "random" is a property of a process to generate a number, not a property of a number itself. You cannot directly analyze a number to determine it has been randomly generated.

There are some caveats here. There are some intrinsic properties of numbers that random numbers satisfy with high probability, e.g. having high kolmogorov complexity. But these are generally very difficult to compute, and I would personally guess you could concoct (probably artificial) scenarios where

1. picking parameters randomly yields a secure construction, but

2. there exists a parameter set with high kolmogorov complexity that is insecure.

e.g. "high kolmogorov complexity", while being a property of random numbers, is generally not viewed as nearly as useful as being randomly generated (which is exhibited by saying generator + seed = the particular number, like in this article).

charcircuit 2 hours ago|||
>like Dual_EC_DRBG was

There is no evidence that it was backdoored.

nullc 2 hours ago||
On September 20th a friend told me that he had as significant number of Anthropic credits that were about to expire and wondered about a use for them. I do not use their products because of their relentless commitment to depriving the public access to artificial intelligence (and particularly any AI that isn't acting on their behalf) and I strongly discourage anyone else from doing so. But since he was going to use the credits for something, I tried to think of a skut work task that would be of only idle curiosity and would not help advance their capability, enable a meaningful public announcement* for them, and was likely already probed by many others (so success would only be lottery effects). -- and basically just something so pointless I wouldn't want to waste my own compute grinding on it but might like to see the result.

So I recommended determining the origins of ECC seeds and base points. The agent worked continuously for many hours and did not uncover anything interesting that wasn't already known. I looked at the transcript and was struck by how idiotic the agent was-- significantly below the standard of intelligence I've come to expect from GLM running locally.

I'm not saying this to suggest that misanthropic hijacked someone elses work yet again-- this is an obvious question that many people have surely posed and success presumably depended on expert use (which was absolutely not applied in my friends example). But it does make me wonder if the company invisibly degraded the model performance.

[*] Seems I underestimated how trivial a result they'd bother trying to spin!

minraws 4 hours ago||
As unsurprised as I am by this, and as much as I suspect a lot of people could have guessed it, having Claude confirm it is still fascinating, but.

Somehow, I find these results fascinating, but also quite sad, because we used a machine to solve it at all. I feel like some half drunk motivated graduate level humans could have figured it out too.

Then again, once you know the answer, perhaps you have an obligation to share it, keeping it to yourself might be unfair to everyone else.

Honestly I’m not entirely sure how I feel about all this. I would gladly welcome any groundbreaking work Claude might do to solve hard problems and move the world forward by decades or even centuries.

But these sorts of fun problems feel like things we should avoid pointing LLMs at. They remind me of those weird programming puzzles that are difficult to solve but incredibly fun to work through.

My concern is that if Claude ends up solving all the fun problems, will humans be left with nothing but the hard, headache-inducing ones? Tao had raised a similar concern, problems that graduate students would have been expected to solve and learn the process, are now things you can simply point an LLM at.

I’m still not sure how I will ever reconcile with this feeling, about any of this. I just find it genuinely sad that we might be automating away not only the difficult work, but also the joy of figuring things out for ourselves.

baggy_trough 4 hours ago|
Stochastic parrot truthers in shambles.
More comments...