Posted by ahlCVA 1 day ago
At the extreme end of the optimism spectrum, there is a multiple million LOC program waiting to be written that can fully understand e.g. human DNA, or cancers, or proteins, or whatever else is needed to propel us forward medically. But of course, I'll believe it when I see it.
I turned out to be right in my advocacy years ago, here is my post: https://ethereum-magicians.org/t/eip-7212-precompiled-for-se...
But it's nice to be able to shut the whole unproductive debate down directly.
Is it impossible? It is hard to prove impossible. But this is not what I would expect backdoors to look like.
In fact this makes me think that the information about how these were generated must have been lost very early in the process, or over-compartmentalized away from the wrong people. It seems like the NSA should have been positively delighted to show that these were the origins of the seeds as they are decent "nothing up my sleeve" numbers: https://en.wikipedia.org/wiki/Nothing-up-my-sleeve_number Advertising that fact should have been advantageous to the NSA if that is indeed how they were generated, so my best guess is that the parts of the NSA that should have been showing us that must not have themselves known.
Just seems to me like that's quite low on the priority list. I guess this result assures some people that the values are good.
There are some caveats here. There are some intrinsic properties of numbers that random numbers satisfy with high probability, e.g. having high kolmogorov complexity. But these are generally very difficult to compute, and I would personally guess you could concoct (probably artificial) scenarios where
1. picking parameters randomly yields a secure construction, but
2. there exists a parameter set with high kolmogorov complexity that is insecure.
e.g. "high kolmogorov complexity", while being a property of random numbers, is generally not viewed as nearly as useful as being randomly generated (which is exhibited by saying generator + seed = the particular number, like in this article).
And yes, knowing what numbers are bad so that we avoid them is a good goal.
There is no evidence that it was backdoored.
So I recommended determining the origins of ECC seeds and base points. The agent worked continuously for many hours and did not uncover anything interesting that wasn't already known. I looked at the transcript and was struck by how idiotic the agent was-- significantly below the standard of intelligence I've come to expect from GLM running locally.
I'm not saying this to suggest that misanthropic hijacked someone elses work yet again-- this is an obvious question that many people have surely posed and success presumably depended on expert use (which was absolutely not applied in my friends example). But it does make me wonder if the company invisibly degraded the model performance.
[*] Seems I underestimated how trivial a result they'd bother trying to spin!
Some points:
I am one of the authors of libsecp256k1, the primary implementation of the aforementioned "different elliptic curve" used widely in cryptocurrency systems. I would characterize the position differently: Secp256k1's design is rigid, or quite close to it (at least as much as anything made before being rigid was an explicit goal).
Knowing how the seeds were selected in the NIST curve does not render them rigid and were very unlikely to do so: the scheme described ends up giving them 20-25 bits of freedom, perhaps more (esp given the unexplained skip values)-- plus more bits for the 'choice of scheme'.
Of course, it seems unlikely that 25 bits of grind gives you an exploitable weakness, but that was also true for 256 bits of grind. You're dealing with an unknown-unknown, once you are concerned about the the possibility of magically weak curves which we have no reason to believe exist at all why would not also be concerned that they exist at one in a million levels and not just one in a billion? (especially given compute available at the time they probably couldn't even have ground out that many more bits).
The whole concept of rigid parameters which is now popular is that by making the selection inflexible you avoid the losing game of debating how much free grinding is too much-- the right amount is there should be no avoidable grindspace. The fact that the origin of the seed wasn't immediately apparent right away meant that there was substantial grindspace-- if nothing else the selection among the myriad possible schemes that people would have found credible.
I don't think the result meaningfully changes the reason for preferences. And more recent development has rendered the question less interesting: New systems are mostly PQ and ideally PQ hybrids. Things using ECC should likely prefer Curve448 because of better security vs performance tradeoffs and not being as close to the edge for advancing attacks. If older cryptosystems are desired, now that the GLV patent has expired secp256k1 has considerable performance benefits-- another good reason to continue using it.
The 'advantage' of many vendor P256 libs is also illusory-- people think their microcontroller ecdsa binary is "hardware accelerated" when often it's a barely competent software implementation that has serious design (e.g. timing sidechannels) and interface flaws.
I also think it's not that relevant because the systems that use secp256k1 more than anything else do so for compatibility reasons (because that's what Bitcoin originally used-- and other systems were either trying to be compatible or were slavishly copy-and-pasting and avoiding departing from Bitcoin's choices out of an abundance of caution)-- and discovering that NIST curves might be better than some feared probably has no impact.
The idea that someone would go "oh, I'll use P256 now!" when they would otherwise have used e.g. secp256k1 seemed implausible to me at the time-- and continues to do so now, having seen the conclusion. Maybe someone, somewhere does--- but meh.
Of course, finding something problematic would be incredible news-- but I don't think I was unreasonable in assigning a probability essentially zero to that. Moreover, what I was describing was my casual thoughts about someone elses disposable credits-- no one else is required to agree: Unlike some other parties (say, anthropic)-- my view that some line of research isn't good or interesting has no bearing on anyone elses ability to pursue them. :)
Cheers!
Sandbagging is real.