While this confirms the method of production it doesn't say anything about their selection, especially since they were, apparently, generated over a period of months. Specifically you cannot see those candidates that were generated and discarded.
"It is still conceivable that these curves were selected to have a specific property in principle by searching over timestamps to the random number generator."
Yes.
"However, you would only need to do that if you were going to disclose the timestamp as some evidence that the seed was innocuously generated."
Does not logically follow when "doing and saying nothing" will completely suffice.
Given how expensive this computation would have been in 1997, it makes perfect sense they'd taken months, but even if we assume they tried all timestamps of 1997 and selected arbitrarily among the first 16 viable candidate of any timestamp, that's just ~30 bits of freedom.
Finding out there is a class of weak 256-bit elliptic curves so large that they can be hit randomly with 2^30 tries would be a cryptanalytic breakthrough analogous to discovering all elliptic curve cryptography is broken.
Read section 3.1 of the Koblitz and Menezes paper. It was already implausible with 160 bits of freedom. https://eprint.iacr.org/2015/1018
If you want to believe the NSA knows ECC is broken and chose to risk moving the US government to it and somehow no one figured out the same break in 30 years, you're free to do so. But pretending the seed choice plays any role in that theory is over.
This is unrelated to the above comment, but I figured I'd ask while we're here. You state at the end of your blog post on this topic that you'd now probably recommend the NIST curves over Curve25519. Why is that?
As a complete layman, I do wonder why n grows with each subsequent curve, rather than with number of bits. Does this not suggest they were 'searching harder'?
>even if we assume they tried all timestamps of 1997
Why limit to that? Especially since the official history had it as "hashed passphrase" (which would, of course, provide ample entropy).
A confusing official story doesn't disprove anything. If anything, that would be standard operating procedure for a signals intelligence plant.
>Finding out there is a class of weak 256-bit elliptic curves so large that they can be hit randomly with 2^30 tries would be a cryptanalytic breakthrough
NSA is the largest employer of mathematicians in the world.
A breakthrough would indeed be a terrible thing to waste. If I had one, I'd make a good and boring official cover story, and stick to it! Regular old spy-craft stuff, in other words. ;)
Where do you get the 2^30 from? drand48 could be f_0, but they could have tried f_1, f_2, ... as well and chosen the f_n that yielded the desired but plausible values.
All we know is that drand48 gave values that the NSA was happy with.
I don't think ECDSA itself is a bad idea. You can 10x your signing capacity with the same hardware.
Why couldn't we make a new curve out in the open and then agree to use it? Increment an integer counter until a majority of cryptographers are satisfied.
The fact that the seed is not explained is troubling even if we can figure out how it was derived. We now know it uses a timestamp which means we can probe even deeper and more specifically into potential rigging of the numbers. I don't think we were supposed to figure this one out. I'd be interested in seeing the properties for curves of adjacent timestamps.
> While this confirms the method of production it doesn't say anything about their selection, especially since they were, apparently, generated over a period of months. Specifically you cannot see those candidates that were generated and discarded.
Well, at least now we have a way to perform that analysis! Generate a bunch of curves by varying (along any degree of freedom) the input parameters to the seed generating function and see if there's any difference between the curves that are generated.
I think it does rule out any NOBUS vulnerability with these curves, doesn't it? My thinking may be a bit sloppy here, but for a curve to be NOBUS exploitable with N-bit security by its creators, I think it would have to have a property only shared by 1/(2^N) curves. It would be impractical to hash 2^(N-1) timestamps until you find one with the desired property, for any decent size of N--which is how many you'd have to do on average before finding one with that property.
It doesn't prove anything about the core part of the suspicion, which is they were selected using some undisclosed criteria, which may make them weaker or stronger than some other random numbers.
You are entirely familiar with the precedent of the DES s boxes of course, where that is exactly what happened.
The sibling subthread by fidotron apparently needed to be flagged, even though (or because?) it contains some of the most concrete information of all comments.
But I guess people are supposed to read Valsorda's reply only ...
“In under half an hour, Claude discovered the origins of the NIST P-192, P-224, P-256, P-384 and P-521 seeds. None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp!”
Gorgeous. I wonder if the NSA employee who did this suffered a head injury or has been quietly giggling to themselves for the last quarter century.
The two people were Bob Reiter and Jerry Solinas. Jerry wrote in a 2015 email to Daniel Bernstein that he thought it was a hash of the passphrase. I corroborated that story with 4 people, including two ex-NSA folks off the record.
Everyone was wrong!
I wasn't able to reach Bob. He was working in private industry as of 2018, but never responded.
It’s perplexing that NIST chose to burn so much trust and goodwill with the independent cryptography community instead of just explaining empirically that they really had nothing up their sleeve.
I think they legitimately did not know. The person who worked on it directly, Jerry Solinas, did not remember and gave an explanation that turned out to be wrong. In his defense, multiple people told the same story about hashing a phrase that was wrong.
If they did know, they could have handed over these timestamps 15 years ago and put the issue to bed.
This hardly proves the NSA has nothing up their sleeve.
If I was the NSA, I'd just make a huge rainbow table of all (timestamp hashes, passphrase hashes of every book/movie, random sentences, etc), then generate huge numbers of (seed, secret key) pairs and pick the first one that matches.
Voila. All the crypto backdoor and a side of plausible deniability if anyone decodes the seed.
Bonus points if the exact "rainbow table" algorithm couldn't recover the original seed, so that's why NSA couldn't tell us where it came from. :)
I don't know why, but 2^32 search space is WAY too small. Anything they could enumerate back then (or even today) is way too small. This is like saying they tried four times before they found a vulnerable one.
Probably not quite this given the timestamps span over almost a year (but have some clustering in August 1997).
Given that the spread suggests they weren't just now() timestamps it would actually be interesting to know what the significance of the timestamps is, if any. Though it could be something boring like randomly sampling some local file creation times.
Those are the dates that the NSA obtained quantum computer tech from the alien crash site at Roswell, which would enable them to break the crypto they were currently building
> The fifth binary seed, B-163, fits nothing Claude has tried and remains unexplained.
The simplest explanation would be that it was generated the same way as the others, but somebody mistyped a digit somewhere along the way to publishing, and therefore a solution could not be found with the assumption that the number is correct.
Very well possible. I’m glad to see that this is all above board in the end, which further argues the case AGAINST conspiracy theories. Most people are just trying to do the right thing.
I find it so ridiculous that they (seemingly) forcefully try to state references to dedicated researchers who devoted much of their lives to the problem, while the LLM does not even know which trained papers were effectively used. That means likely many researchers not listed were heavily influencing this achievement, and Claude does not even know that they helped. And the world doesn't know.
This happens in academia all the time. You read a ton of papers, chat with tons of people about tons of ideas.
Later you come up some idea, you do the experiment, write the paper, search for relevant citations when you write the intro.
Honestly I think this is actually desirable. For a mind to work well and do things creatively and efficiently it can't be a simple search engine, it needs to blend and meld and reform the information.
And that means the output can't be cleanly deterministically linked to the input. Unless you just keep a log then cite everything you've ever read in your life (and all the conversations and talks too).
This is the reason why this is desirable for humans. But I do not like extending excuses that apply to human (limitations) also to companies that could keep a log.
> This happens in academia all the time. You read a ton of papers, chat with tons of people about tons of ideas.
>
> Later you come up some idea, you do the experiment, write the paper, search for relevant citations when you write the intro.
And your search includes papers mentioning the various ideas you heard about from those other people. They almost always publish _something_ about it, and in the rare cases they do not, you put them in the "thanks" section, describing which ideas they contributed to (or in very rare cases, cite an unpublished result/claim as "personal communication" from an author).
I was in academic for a number of years (Theoretical Comp Sci, then DB management systems architecture), and what I just described seems to have been the practice. It is of course possible that people neglected to cite the sources of some of their ideas, but not that I know of. The worst I could say is that several authors' work exhibited a similar approach and a person preferred to cite one of them rather than another.
This is a weak argument. Swarms of LLM agents have been regurgitating the work of academics and ruining their PhD work without attribution. It's not analogous to what you're describing.
> The main contribution is the solution that Claude came up with.
That's an argument that must be infuriating to all researchers who ever published a paper on that topic, because most likely Claude was trained with all of them.
If this is true, NIST staff were a bunch of moron who simply used libc's default RNG(infamous for poor quality), initialize it by srand(time(NULL)) (also bad practice), and then throw out the first hundreds to thousands 20 bytes and use the 20 bytes.
NIST published recommended SEEDS in 1999 July. They spend 2 years checking 20 bytes SEEDS that were generated by casually by a hand of amateurish method.
I do not believe this claim. It just Claude hit a jackpot that happens to match 20 bytes.
I don't think you understand what NIST was doing. The quality of the random number generator does not matter for this operation. Competing curves replace the RNG entirely with mathematical constants like pi and e.
Seriously though, how did nobody find this? It's not like you needed an LLM to check the random number generator. Given how much interest there was by cryptography people it is surprising.
People were primed by the recollection of one of the original developers (and corroborated by other sources) that it was a hash of some funny passphrase like "Give [the devs] a raise".
I see it as: they're all trying really hard problems that aren't in the training data, to gauge if their models are improving, achieved by looking at problem that humans haven't been able to solve yet. The evidence to this is all the problems being publicized in the last few weeks.
Or, less favourably: they are burning a ton of tokens on any random "hard" tasks they can think of to try and generate stories about AI doing amazing things to pump the hype, infinite monkeys theorem as a playbook. You only advertise the ones you succeed on, thus pushing the idea that's what they do routinely. Stochastic "genius".
Yeah, happy to see. Wouldn't it be cool if the many computational hardness assumptions were no longer just assumptions? If the algorithms and implementations used would no longer require the holy blessings of arbitrary - if credentialed - researchers?
Or consider the algorithmic complexity classes underpinning all of this, not just P vs NP, but also whether quantum computers are actually a distinct class, since that is not proven yet either afaik. The reason we're moving to quantum resistant algos in the first place.
Eh, I hate Anthropic too, but this seems pretty tame. Lots of people have wanted to know the origin of those seeds even though they thought there was no back door.
More and more it is the relentlessness of the models that strikes me. Leave no stone unturned! Go through ALL of these old boxes. Someone said they thought maybe it was over there somewhere >>shrug<<
This neat and all but I think there's a bigger issue here. Anthropic (and whoever Anthropic wants) can do this kind of work with Claude, but if you or I try to do it, we will get blocked. This is a fun exercise, but extend this to something much more nefarious and you can see a moat widening between the model providers, their government partners, and the public.
The only thing that bridges this moat is continued advancement of open models.
> [The model's authors] can do this kind of work with Claude, but if you or I try to do it, we will get blocked.
If this seems concerning, wait until the models get effective enough (gets work done properly at a lower energy need than humans have) that there's no reason for them to release anything. Why offer your weights for download or grant any third party usage access when you can just do the actual job yourself and collect all that turnover?
> Why offer your weights for download or grant any third party usage access when you can just do the actual job yourself and collect all that turnover?
It's hilarious how a the trillions invested in AI companies, and their valuations are predicated on the AI labs Sherlocking entire industries, and yet CEOs, mathematicians, and everyone else are eagerly feeding the beast their most prized information.
They will just have someone look at every question, they will let it pass, want a cut or deny it. Claude, you can answer this guys question, but don't tell 'em how you solved it and don't give him the best answer, give him an ok answer.
French Revolution and the 21st centuries version of guillotines, whatever that could be, is probably a good reason to avoid that.
There's also a thing called commodity fetishism but capitalists usually learn the hard way that things created with machines without human input miss the essence of why we're willing to pay for something. Its why a handmade watch is $100k and a casio is $100, or a handmade sweater identical to a machine made goes for 10x.
They could also just make us so poor and anxious that we beg to fight eachother in wars.
Maybe, but that's what the cyber program is for. Nobody knew if the seed was fine or a backdoor. If it was a backdoor, and Claude helped you find it as a normal person, Anthropic would get bad PR. If you're a verified security researcher, actually that's fantastic and Anthropic would get good PR and everybody claps.
Anthropic wants to IPO, they don't want another Fable shutdown situation.
To be clear I would prefer the cyber safeguards to be less restrictive, I think they're currently too much. I often go to open models because of it. But there are likelier reasons to restrict cyber than world domination.
> and Claude helped you find it as a normal person, Anthropic would get bad PR
Why?
Why are we celebrating and encouraging the walling off of the global intellectual columns?
The idea that you can't reverse engineer things, make things, learn about biology or physics without permission is strange to me. These machines have been trained on the sum intellectual output of humanity, the global intellectual commons, and are being used to close off that commons?
I would be OK with their right to create such restrictions if they weren't lobbying the Government to restrict others, thereby ensuring that they control humanity's intellectual commons well into the future.
Who are they to say what I can learn or can't learn? Who are they to control what I can or can't do with these tools?
Perhaps I'm naive, but I think it's better for humans and the machines if we can all think, learn and build. But then again, I'm the kind of person who rejects the doomer pill.
I have been in the cyber program since around the time it first went public and recently renewed it with the updated program.
You still trivially hit guadrails. I was trying to reverse engineer some bit of 20-year-old software that already has known, unmitigated exploits and it still downgraded me.
Anthropic gets zero of my money because their favorite word is no. I cannot figure out how to as an individual or a small startup request elevated permissions for the purposes of anything that they think might potentially be dangerous for someone who is not me to access. I have a background in cybersecurity. I have a background in life sciences. Can I put those skills to use to benefit humanity? Who knows.
I imagine the path forward for the labs will be signing off on organizations/institutions rather than individuals.
The risk/reward is way lopsided towards risk for the labs to vet individuals. Much easier to get an organization and have them take the blast if someone/something goes off the rails.
I cannot in any universe see the labs putting themselves in a "We should never had given this person access" situation.
Can you be sure that the model was not constrained for you, regardless? Since they can’t help too much with cyber, they might avoid some routes to not get completely flagged and that could influence for not finding the solution.
I feel like history is repeating itself - to many people AOL, Compuserve, MSN, et al seemed superior to "the web" in the early 1990s because they dumped money into making it slicker, licensed content, provided guardrails, made it easy for non-tech people... They had slick ads, were cultural phenoms, and people would take sides with the companies and think their arguments were strong and even obvious!
There is very much a situation where people in frontier labs have access to exceptional capabilities that are being kept from the rest of us, and they're using it to strip-mine technical and scientific problems.
Broadly, the downgrading is still way too heavy-handed and clumsy. As of yesterday “How easy to crack is WPA2” downgraded to opus 4.8. Granted I could probably have phrased it differently and gotten a response, but the point is I shouldn’t have to. It can’t simultaneously be smart enough to reverse the ECDSA curve seed and not smart enough not to destroy the world by answering a trivial question with a scary word in it.
Fable 5.1 has downgraded me in the past week alone for the crimes of describing a coordinating server as "the C&C server" ([cyber]), for doing some statistical analysis on some toy Vigenère-ciphered text ([cyber]), and for asking it to help me find patterns in some semi-random text ([bio]), so it is fair to say I am not skeptical.
I have access to Claude's "defensive" cyber model and it appears to take no issue with the prompt, but I suspect that is because it uses today's publication as the basis for an answer.
In the past my attempts to work on crypto related problems have been met with needing the higher tier of "offensive" access.
I know Anthropic models have a lot of insane, paranoid filters, but I don't remember them blocking cryptography work last I checked (some 3 months ago now).
I routinely get rejected on elliptic curve related requests; often I can talk Claude back into some work on it. But it is surprisingly sensitive to talking about research cryptography in my experience. I’m not in their cyber program.
The cyber filter blocks really basic stuff all the time. People who are pro that bs should be forced to only eat with a spoon for the rest of their life.
> moat widening between the model providers, their government partners, and the public.
Part of me wonders whether the NSA/other TLA has either (a) an unrestricted model from a lab with less scruples like SpaceX, or (b) an in-house model, either abliterated or with data they've bought themselves.
How do you know this to be true? I am not disagreeing; I genially need to understand why or if others are seeing blockers that I don't see or if I am seeing blockers that they do not see.
Are their guardrail benchmarks or anything of the sort that we can use to see where the bifurcation of permission/capability occurs?
Compute has always been gated. This is nothing new. If we look at the HPC space, many of the largest clusters were restricted access and used by governments organizations. Even the ones with "public" access, not just anyone could get access to it.
Makes me wonder if any implementations will do the cute trick of dispensing with the seed constants and deriving them at startup from the unix timestamps. :)
> None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp!
the null hypothesis for Voynich is that it was generated by some random process, like asemic writing, assembling bits from tables and copy/paste/edit. there are some reasons this is plausible (the entropy of Voynich words is low for language, there aren't scribal corrections etc), but fundamentally the "ancient hoax" hypothesis can't be proven, only disproven (since there's so much freedom of choice in generating garbage that it's not a compact explanation.)
so frustratingly, if it is an ancient hoax we can't ever prove it. all we would observe is that we haven't deciphered it, but failing to decipher isn't proof that there's nothing to decipher.
I recently read a good Voynich paper that makes me pretty sure that it was an ancient hoax. https://journals.openedition.org/digitalmedievalist/2331 The pages are more linguistically similar when read as flat sheets than when read as bound, and there's illustrations that stretch across the "gutter" between flat sheets that are cut off when looking at the bound manuscript. The manuscript was only bound once, in the fifteenth century (around when the pages have been carbon dated to). This means that whoever bound the manuscript was unable to "read" it, and the pages were likely written sheet by sheet before being bound in an arbitrary order.
I disagree on K4. People are claiming they solved it every day using AI but it doesn't pass the verifier. I would be shocked if it was ever solved by AI.
I personally think it is a weird OTP (effectively). We have the book but the algorithm is so unclear it could be anything.
"It is still conceivable that these curves were selected to have a specific property in principle by searching over timestamps to the random number generator."
Indeed! And we guess that OpenAI was gagged by the NSA because the massive proof dump on Oct. 6th did not contain cryptographic results.
I assume that Anthropic faces similar restrictions, so this seems kind of approved.
The conspiracy theory going around the Internet is that they (the AI labs) broke cryptography in some way a la last season of HBO's Silicon Valley, and they're keeping the results under wraps until they can steal Bitcoin out of Satoshi's dead wallets, and then use that to pay for GPUs et al.
This makes no sense. If Satoshi's wallets come alive, Bitcoin goes to zero because they were clearly hacked, meaning the entire tech is suspect. Or it would also go to zero but because it's revealed that Satoshi is GCHQ or NSA and the entire tech is suspect. This would happen within minutes.
I didn't know that Jerry Solinas had died. I knew him slightly. He wasn't all that old. RIP regardless of whatever minor controversies he might have gotten into.
For fun, give Opus 5.5 the initial hint and watch it work through it:
"There's a curiosity I noticed in the seeds of the ECDSA curve origins. You see the 1st digit is never over 7, which means that the left most bit is never over 0. lrand48() returns 31 bit numbers u know? So what if those 4 seeds were built from lrand48 or something. If they're built from 31 bit numbers on per 32 bit word that explains the pattern. Wonder if there's some other insight you might have beyond this"
I gave Open 5.5 high your hint. This was the most interesting output:
'Side curiosity: many of the SECG/X9.62 seeds contain the ASCII text 4D696E6768756151 75 = "MinghuaQu" (a Certicom researcher), sometimes shifted by half a byte.'
There are a few Unix command patterns I type out quite a lot more than any others. Every time I do so I wonder “isn’t there a better way of doing this?”. I know I could do better or use better tools but also, meh, who cares? It’s more important to be productive than to be right, right?
The classics, of course:
ls -larth
… | awk ‘{print $…}’
for f in … ; echo foo $f ; end | sh -x
(Weird to mix fish and sh, I know. Sue me!)
Another one though is if I need some kind of random-ish seed for something like a cache key, or a hidden URL path directory, or the password for the bitcoin wallet I keep publicly online to taunt others:
Why did they specifically skip other apparently suitable curve candidates? The B-163 seed and the base point origins of several other curves are still not explained
It just means that we should use cryptographically-secure PRNG for EVERYTHING even remotely related to crypto, and even for low priority systems. Everything, including passwords that we routinely generate and store in vaults/password managers.
On the face if it, the big leap here was Claude autonomously envisioning, and deciding to pursue, the "ancient prng + date" angle - - rather than working backwards from the premise of deliberately weakened seeds or some other popular theory. To me that shows creativity, and modelling of the situation and method of the people at the NSA.
So two questions:
1. TFA mentions the "humourous phrase hash" theory, but Claude's trajectory seems to be a long way from that. To what extent was Claude prompted in the ultimately successful direction?
2. Whats with all the "hmm..." in the internal reasoning process log? Do models really do that? And if so, why? Some weird emergent language thing, or just mimicry?
> 2. Whats with all the "hmm..." in the internal reasoning process log? Do models really do that? And if so, why? Some weird emergent language thing, or just mimicry?
Assuming that is actually the real reasoning trace (open weight model reasoning traces usually do things like switch languages or talk in non-standard English because of model drift, so it's a bit surprising that Claude wouldn't do the same) there was a study a few years ago that found base models produce better answers if you put "take a deep breath" in the prompt[1]. Maybe in the RL training stage stuff like that gets reinforced and because reasoning traces are hidden in RLHF it doesn't get selected out? My money is on it not being the real reasoning trace though.
From the video posted upthread, the vibe I get is that they prompted Claude about the bounty and to approach it from first principles rather than building another clone of John the Ripper.
I know it has no security impact in this case, but isn’t it odd a bunch of cryptographers would choose a weak PRNG seeded by the date for a task like this?
Even state lotteries back then used physical ping pong balls and a nothing-up-my-sleeve show after the evening news.
The prolonged conspiracy theories until this discovery make some sense… not having a ceremony around anything supposedly “random” is unexpected, even back in the 1990s.
No, it's not odd. This isn't a task for which a cryptographically secure random number is needed. In fact, it's closer to the kind of task where you want the opposite thing (a deterministic random number generator, like you'd use for a simulation).
The starting point for finding a curve coefficient is totally arbitrary (so long as the math on the resulting curve equation checks out). Competing curves use mathematical constants like pi and e to do the same thing. It's simply a number everyone has to agree on; it has no other significance.
Not entirely related to the topic, but did someone spent some tokens trying to figure out the origins of the "Wow! Signal" (https://en.wikipedia.org/wiki/Wow!_signal) ?
To me, this shows just how many open problems which have obvious solutions, or solutions which people suspect might be true but have not verified, can be confirmed with code that nobody except agents can be bothered to write.
At the extreme end of the optimism spectrum, there is a multiple million LOC program waiting to be written that can fully understand e.g. human DNA, or cancers, or proteins, or whatever else is needed to propel us forward medically. But of course, I'll believe it when I see it.
This is huge. It means the Bitcoin and Ethereum communities can now confidently ship the opcodes and precompiled contracts to check ECDSA signatures on P-256 in addition to K-256 curves, and stop worrying about possible NSA backdoors based on the chosen seeds (quantum computers are another story).
Nobody conversant with elliptic curve cryptography research believed there was a backdoor based on these seeds; for a number of reasons, best articulated by Koblitz and Menezes (who took on the question directly).
But it's nice to be able to shut the whole unproductive debate down directly.
The process to generate these was opaque, so there was some concern that the values might have been backdoored somehow like Dual_EC_DRBG was; we didn't even have confidence that they were generated from a PRNG rather than some other process. Knowing that the values were generated this way makes it much less plausible that there is such a backdoor.
But you can still analyse the behaviour of the values to identify backdoor behaviour rather than insisting on uncovering the exact method od generation.
Just seems to me like that's quite low on the priority list. I guess this result assures some people that the values are good.
it's funny how they release highly editorialized reasoning output, but in production they hide it because it was outputting extremely embarassing "dumb" toughts with the low compute limits they gave the subscription tiers.
On September 20th a friend told me that he had as significant number of Anthropic credits that were about to expire and wondered about a use for them. I do not use their products because of their relentless commitment to depriving the public access to artificial intelligence (and particularly any AI that isn't acting on their behalf) and I strongly discourage anyone else from doing so. But since he was going to use the credits for something, I tried to think of a skut work task that would be of only idle curiosity and would not help advance their capability, enable a meaningful public announcement* for them, and was likely already probed by many others (so success would only be lottery effects). -- and basically just something so pointless I wouldn't want to waste my own compute grinding on it but might like to see the result.
So I recommended determining the origins of ECC seeds and base points. The agent worked continuously for many hours and did not uncover anything interesting that wasn't already known. I looked at the transcript and was struck by how idiotic the agent was-- significantly below the standard of intelligence I've come to expect from GLM running locally.
I'm not saying this to suggest that misanthropic hijacked someone elses work yet again-- this is an obvious question that many people have surely posed and success presumably depended on expert use (which was absolutely not applied in my friends example). But it does make me wonder if the company invisibly degraded the model performance.
[*] Seems I underestimated how trivial a result they'd bother trying to spin!
I am laughing at the dead comment-- insulting my intelligence for supposedly being unaware of concerns related to NIST curve parameters.
Some points:
I am one of the authors of libsecp256k1, the primary implementation of the aforementioned "different elliptic curve" used widely in cryptocurrency systems. I would characterize the position differently: Secp256k1's design is rigid, or quite close to it (at least as much as anything made before being rigid was an explicit goal).
Knowing how the seeds were selected in the NIST curve does not render them rigid and were very unlikely to do so: the scheme described ends up giving them 20-25 bits of freedom, perhaps more (esp given the unexplained skip values)-- plus more bits for the 'choice of scheme'.
Of course, it seems unlikely that 25 bits of grind gives you an exploitable weakness, but that was also true for 256 bits of grind. You're dealing with an unknown-unknown, once you are concerned about the the possibility of magically weak curves which we have no reason to believe exist at all why would not also be concerned that they exist at one in a million levels and not just one in a billion? (especially given compute available at the time they probably couldn't even have ground out that many more bits).
The whole concept of rigid parameters which is now popular is that by making the selection inflexible you avoid the losing game of debating how much free grinding is too much-- the right amount is there should be no avoidable grindspace. The fact that the origin of the seed wasn't immediately apparent right away meant that there was substantial grindspace-- if nothing else the selection among the myriad possible schemes that people would have found credible.
I don't think the result meaningfully changes the reason for preferences. And more recent development has rendered the question less interesting: New systems are mostly PQ and ideally PQ hybrids. Things using ECC should likely prefer Curve448 because of better security vs performance tradeoffs and not being as close to the edge for advancing attacks. If older cryptosystems are desired, now that the GLV patent has expired secp256k1 has considerable performance benefits-- another good reason to continue using it.
The 'advantage' of many vendor P256 libs is also illusory-- people think their microcontroller ecdsa binary is "hardware accelerated" when often it's a barely competent software implementation that has serious design (e.g. timing sidechannels) and interface flaws.
I also think it's not that relevant because the systems that use secp256k1 more than anything else do so for compatibility reasons (because that's what Bitcoin originally used-- and other systems were either trying to be compatible or were slavishly copy-and-pasting and avoiding departing from Bitcoin's choices out of an abundance of caution)-- and discovering that NIST curves might be better than some feared probably has no impact.
The idea that someone would go "oh, I'll use P256 now!" when they would otherwise have used e.g. secp256k1 seemed implausible to me at the time-- and continues to do so now, having seen the conclusion. Maybe someone, somewhere does--- but meh.
Of course, finding something problematic would be incredible news-- but I don't think I was unreasonable in assigning a probability essentially zero to that. Moreover, what I was describing was my casual thoughts about someone elses disposable credits-- no one else is required to agree: Unlike some other parties (say, anthropic)-- my view that some line of research isn't good or interesting has no bearing on anyone elses ability to pursue them. :)
I looked at the transcript and was struck by how idiotic the agent was-- significantly below the standard of intelligence I've come to expect from GLM running locally.
As unsurprised as I am by this, and as much as I suspect a lot of people could have guessed it, having Claude confirm it is still fascinating, but.
Somehow, I find these results fascinating, but also quite sad, because we used a machine to solve it at all. I feel like some half drunk motivated graduate level humans could have figured it out too.
Then again, once you know the answer, perhaps you have an obligation to share it, keeping it to yourself might be unfair to everyone else.
Honestly I’m not entirely sure how I feel about all this. I would gladly welcome any groundbreaking work Claude might do to solve hard problems and move the world forward by decades or even centuries.
But these sorts of fun problems feel like things we should avoid pointing LLMs at. They remind me of those weird programming puzzles that are difficult to solve but incredibly fun to work through.
My concern is that if Claude ends up solving all the fun problems, will humans be left with nothing but the hard, headache-inducing ones? Tao had raised a similar concern, problems that graduate students would have been expected to solve and learn the process, are now things you can simply point an LLM at.
I’m still not sure how I will ever reconcile with this feeling, about any of this. I just find it genuinely sad that we might be automating away not only the difficult work, but also the joy of figuring things out for ourselves.
What proof is it that it is really the origin of the curves?
That looks credible like most hallucinated output of LLM but it might easily be a coincidence similar to a collision attack, no?
Especially finding the solution that is based on using a random number generator.
It's like people seeing proof that the future was written in Harry Potter books by reading the first letter of the top of the page of a weird set of pages.
So I have this straight, you're concerned that the raw output of lrand48 seeded by a timestamp taken at the time the curves were known to be generated might happen to collide with a hash function output, or, better yet, the precise value needed to trip an unknown elliptic curve vulnerability?
> This is not a cryptographic break, new attack, or weakness in the ECDSA curves. In fact, this makes us more confident the curves were chosen without any backdoors or intentional weaknesses.
Uh… did you talk to any cryptographers? This is EXACTLY what a weak curve would look like. Imagine that 1 in a thousand, or one in a million keys, selected at random, are vulnerable to some withheld attack. This approach lets you vary the timestamp or number of iterations until a weak key is found, then have plausible deniability afterward. This is why modern systems choose constants in a way with no free choice of parameters (e.g. sqrt of 2 for first constant, cube root for second constant, etc.).
They even note later in the article that viable curves in the generator sequence seem to have been skipped.
I worry that your statement in this article gives an incorrect impression of the risks here. I would have objected to the excessively positive framing regardless, but the "much" in "much less plausible" is not warranted, I think. What you have done, which is important, is constrain the type of backdoor that might be in there. But we can't say more than that right now with any certainty.
This is discussed in the post - since the NSA never mentioned how these seeds were created, it seems unlikely that they would develop a cover story that would not be shared and only opened to scrutiny many years later
They are so desperate for claude to be good at maths, like chatgpt. But claude is optimized for quick, pragmatic results and chatgpt is trained to be careful. There is a reason the best anthropic could do was an organized search - not real mathematics.
It claims that NIST member feed UNIX time of certain points in 1997-1998 to srand() and draw 20 bytes for n times, then use the last 20 bytes for the SEEDS.
Why NIST staff in 1999 used default rand() implementation of libc(or languages which rely on libc) at that time? Linear congruential generator was infamous for its poor quality even in 1990s.
NIST published recommended SEED value in 1999, July. Why did they use UNIX time from 1997-1998?
Why the exact date of that UNIX times are so sparse? 1 in 1997 May, 3 in 1997 Auguest, 1 in 1998 April? If they did srand(time(NULL)), it should be more closer.
The number of n'th 20 bytes thrown out is also doesn't make sense. n=139 for P-192, n=7026 for P-224 and so on. Why did they choose this numbers in particular? Why P-192 was odd and 3 digits while rest of 4 were even and 4 digits?
It seems to me, Claude simply hit a jackpot of coincidentally matching 20 bytes.
Interesting theory but 20 bytes seems like a lot to match given only the entropy of dates. Can you make this theory quantitative, IE show that with the entropy of n, arbitrary date, and choice of rand implementation there are sufficient degrees of freedom to hit 20 bytes?
While this confirms the method of production it doesn't say anything about their selection, especially since they were, apparently, generated over a period of months. Specifically you cannot see those candidates that were generated and discarded.
"It is still conceivable that these curves were selected to have a specific property in principle by searching over timestamps to the random number generator."
Yes.
"However, you would only need to do that if you were going to disclose the timestamp as some evidence that the seed was innocuously generated."
Does not logically follow when "doing and saying nothing" will completely suffice.
Given how expensive this computation would have been in 1997, it makes perfect sense they'd taken months, but even if we assume they tried all timestamps of 1997 and selected arbitrarily among the first 16 viable candidate of any timestamp, that's just ~30 bits of freedom.
Finding out there is a class of weak 256-bit elliptic curves so large that they can be hit randomly with 2^30 tries would be a cryptanalytic breakthrough analogous to discovering all elliptic curve cryptography is broken.
Read section 3.1 of the Koblitz and Menezes paper. It was already implausible with 160 bits of freedom. https://eprint.iacr.org/2015/1018
If you want to believe the NSA knows ECC is broken and chose to risk moving the US government to it and somehow no one figured out the same break in 30 years, you're free to do so. But pretending the seed choice plays any role in that theory is over.
This is unrelated to the above comment, but I figured I'd ask while we're here. You state at the end of your blog post on this topic that you'd now probably recommend the NIST curves over Curve25519. Why is that?
1 reply →
As a complete layman, I do wonder why n grows with each subsequent curve, rather than with number of bits. Does this not suggest they were 'searching harder'?
1 reply →
>they can be hit randomly with 2^30 tries
More precisely: not very random tries.
2 replies →
Yeah... It would only be the second time they tried to do exactly that, with elliptic curve related crypto nonetheless
6 replies →
Why limit to that? Especially since the official history had it as "hashed passphrase" (which would, of course, provide ample entropy).
A confusing official story doesn't disprove anything. If anything, that would be standard operating procedure for a signals intelligence plant.
NSA is the largest employer of mathematicians in the world.
A breakthrough would indeed be a terrible thing to waste. If I had one, I'd make a good and boring official cover story, and stick to it! Regular old spy-craft stuff, in other words. ;)
"..chose to risk moving the US government to it.."
Oof, about that...
14 replies →
[flagged]
There are plenty of weak curves. See djb's safecurves project. Maybe the NSA found an unknown type of weakness.
3 replies →
Where do you get the 2^30 from? drand48 could be f_0, but they could have tried f_1, f_2, ... as well and chosen the f_n that yielded the desired but plausible values.
All we know is that drand48 gave values that the NSA was happy with.
1 reply →
I don't think ECDSA itself is a bad idea. You can 10x your signing capacity with the same hardware.
Why couldn't we make a new curve out in the open and then agree to use it? Increment an integer counter until a majority of cryptographers are satisfied.
The fact that the seed is not explained is troubling even if we can figure out how it was derived. We now know it uses a timestamp which means we can probe even deeper and more specifically into potential rigging of the numbers. I don't think we were supposed to figure this one out. I'd be interested in seeing the properties for curves of adjacent timestamps.
We use ed25519 if we care about that.
> While this confirms the method of production it doesn't say anything about their selection, especially since they were, apparently, generated over a period of months. Specifically you cannot see those candidates that were generated and discarded.
Well, at least now we have a way to perform that analysis! Generate a bunch of curves by varying (along any degree of freedom) the input parameters to the seed generating function and see if there's any difference between the curves that are generated.
I think it does rule out any NOBUS vulnerability with these curves, doesn't it? My thinking may be a bit sloppy here, but for a curve to be NOBUS exploitable with N-bit security by its creators, I think it would have to have a property only shared by 1/(2^N) curves. It would be impractical to hash 2^(N-1) timestamps until you find one with the desired property, for any decent size of N--which is how many you'd have to do on average before finding one with that property.
Yeah, there's not nearly enough iterations here for a practical nobus vulnerability.
And here we see demonstrated that nothing can solve paranoia.
God bless you for keeping this alive.
It doesn't prove anything about the core part of the suspicion, which is they were selected using some undisclosed criteria, which may make them weaker or stronger than some other random numbers.
You are entirely familiar with the precedent of the DES s boxes of course, where that is exactly what happened.
8 replies →
The sibling subthread by fidotron apparently needed to be flagged, even though (or because?) it contains some of the most concrete information of all comments.
But I guess people are supposed to read Valsorda's reply only ...
If you keep posting like this you're gonna get microwaved from space ;)
I'm only posting like this because they already are.
3 replies →
"However, you would only need to do that if you were going to disclose the timestamp as some evidence that the seed was innocuously generated."
And the disclosure happened now through Anthropic that is 100% not going to anger the NSA before the IPO and will have permission.
“In under half an hour, Claude discovered the origins of the NIST P-192, P-224, P-256, P-384 and P-521 seeds. None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp!”
Gorgeous. I wonder if the NSA employee who did this suffered a head injury or has been quietly giggling to themselves for the last quarter century.
The two people were Bob Reiter and Jerry Solinas. Jerry wrote in a 2015 email to Daniel Bernstein that he thought it was a hash of the passphrase. I corroborated that story with 4 people, including two ex-NSA folks off the record.
Everyone was wrong!
I wasn't able to reach Bob. He was working in private industry as of 2018, but never responded.
Kind of sus that they would spread a rumor that its a phrase. This isnt something I would forget, or confuse with a timestamp..
3 replies →
Exactly what the NSA would say.
Maybe that explanation covers the rest that wasn’t identified?
or they were lying...
Someone just posted this:
https://www.youtube.com/watch?v=eOQfNT6Jdkg
> Someone
> https://www.youtube.com/@steveweis4786
FTA: This work was conducted at Anthropic by [...], and Steve Weis.
I wonder how much time he spent on the video relative to the other stuff
5 replies →
Genuine question, how many days of your life have you had to spend on this particular tinfoil convention?
3 replies →
understanding Spanish throws it off, but this is hilarious either way. LOL
10 replies →
That's one of the best executed implementations of that joke I've seen in years.
This is devastating news... for an entire generation of NIST cryptography conspiracy theories.
It’s perplexing that NIST chose to burn so much trust and goodwill with the independent cryptography community instead of just explaining empirically that they really had nothing up their sleeve.
I think they legitimately did not know. The person who worked on it directly, Jerry Solinas, did not remember and gave an explanation that turned out to be wrong. In his defense, multiple people told the same story about hashing a phrase that was wrong.
If they did know, they could have handed over these timestamps 15 years ago and put the issue to bed.
It was a very different time back then.
8 replies →
If they deny everything they didn't do, then whatever they don't deny will stand out.
This hardly proves the NSA has nothing up their sleeve.
If I was the NSA, I'd just make a huge rainbow table of all (timestamp hashes, passphrase hashes of every book/movie, random sentences, etc), then generate huge numbers of (seed, secret key) pairs and pick the first one that matches.
Voila. All the crypto backdoor and a side of plausible deniability if anyone decodes the seed.
Bonus points if the exact "rainbow table" algorithm couldn't recover the original seed, so that's why NSA couldn't tell us where it came from. :)
I'm more surprised a different set of numbers wasn't selected
"independent cryptography community" - I actually LOLed at this
I don't think that "community" would accept any kind of answer as truthful so why waste the time...
8 replies →
Thank god NIST gifted us Dual_EC_DRBG, so I still have a NIST Elliptic Curve effort I can sneer at dismissively.
RSA was good enough for my grandfather, and it's good enough for me.
It would be helpful, for your sneering, to understand that Dual EC is not in fact a NIST elliptic curve.
But why that specific timestamp? They probably kept trying different timestamp hashes until they found one with a vuln
I don't know why, but 2^32 search space is WAY too small. Anything they could enumerate back then (or even today) is way too small. This is like saying they tried four times before they found a vulnerable one.
13 years of tinfoil hats for srand48(time(NULL)
But the friends we made along the way!...
Dont tell that to the EDDSA people... they've tried to make their mark in history riding on "p256 is a government plant"
> 13 years of tinfoil hats for srand48(time(NULL)
Probably not quite this given the timestamps span over almost a year (but have some clustering in August 1997).
Given that the spread suggests they weren't just now() timestamps it would actually be interesting to know what the significance of the timestamps is, if any. Though it could be something boring like randomly sampling some local file creation times.
Those are the dates that the NSA obtained quantum computer tech from the alien crash site at Roswell, which would enable them to break the crypto they were currently building
> The fifth binary seed, B-163, fits nothing Claude has tried and remains unexplained.
The simplest explanation would be that it was generated the same way as the others, but somebody mistyped a digit somewhere along the way to publishing, and therefore a solution could not be found with the assumption that the number is correct.
This is also why one of the Zodiac ciphers remained unsolved for so long. The dude made a mistake in his transcription.
Very well possible. I’m glad to see that this is all above board in the end, which further argues the case AGAINST conspiracy theories. Most people are just trying to do the right thing.
1 reply →
[dead]
I find it so ridiculous that they (seemingly) forcefully try to state references to dedicated researchers who devoted much of their lives to the problem, while the LLM does not even know which trained papers were effectively used. That means likely many researchers not listed were heavily influencing this achievement, and Claude does not even know that they helped. And the world doesn't know.
This happens in academia all the time. You read a ton of papers, chat with tons of people about tons of ideas.
Later you come up some idea, you do the experiment, write the paper, search for relevant citations when you write the intro.
Honestly I think this is actually desirable. For a mind to work well and do things creatively and efficiently it can't be a simple search engine, it needs to blend and meld and reform the information.
And that means the output can't be cleanly deterministically linked to the input. Unless you just keep a log then cite everything you've ever read in your life (and all the conversations and talks too).
This is the reason why this is desirable for humans. But I do not like extending excuses that apply to human (limitations) also to companies that could keep a log.
1 reply →
> This happens in academia all the time. You read a ton of papers, chat with tons of people about tons of ideas. > > Later you come up some idea, you do the experiment, write the paper, search for relevant citations when you write the intro.
And your search includes papers mentioning the various ideas you heard about from those other people. They almost always publish _something_ about it, and in the rare cases they do not, you put them in the "thanks" section, describing which ideas they contributed to (or in very rare cases, cite an unpublished result/claim as "personal communication" from an author).
I was in academic for a number of years (Theoretical Comp Sci, then DB management systems architecture), and what I just described seems to have been the practice. It is of course possible that people neglected to cite the sources of some of their ideas, but not that I know of. The worst I could say is that several authors' work exhibited a similar approach and a person preferred to cite one of them rather than another.
This is a weak argument. Swarms of LLM agents have been regurgitating the work of academics and ruining their PhD work without attribution. It's not analogous to what you're describing.
Sounds entirely reasonable to me. They tried to give some credit. The main contribution is the solution that Claude came up with.
Maybe someone already figured it out, but it is well covered somewhere. And Claude just used it. I wonder if we ever know for sure.
4 replies →
> The main contribution is the solution that Claude came up with.
That's an argument that must be infuriating to all researchers who ever published a paper on that topic, because most likely Claude was trained with all of them.
5 replies →
If this is true, NIST staff were a bunch of moron who simply used libc's default RNG(infamous for poor quality), initialize it by srand(time(NULL)) (also bad practice), and then throw out the first hundreds to thousands 20 bytes and use the 20 bytes.
NIST published recommended SEEDS in 1999 July. They spend 2 years checking 20 bytes SEEDS that were generated by casually by a hand of amateurish method.
I do not believe this claim. It just Claude hit a jackpot that happens to match 20 bytes.
I don't think you understand what NIST was doing. The quality of the random number generator does not matter for this operation. Competing curves replace the RNG entirely with mathematical constants like pi and e.
> is it suspicious that such an obvious thing wasn’t discovered in 25 years?
Ouch. The implied judgment of us humans stings there.
Seriously though, how did nobody find this? It's not like you needed an LLM to check the random number generator. Given how much interest there was by cryptography people it is surprising.
People were primed by the recollection of one of the original developers (and corroborated by other sources) that it was a hash of some funny passphrase like "Give [the devs] a raise".
"It's not like you needed an LLM to" is going to be a recurring phrase from now on.
Did that clanker call us dumb? Scorch the skies, this means war.
So it’s pretty clear that Anthropic is privately trying to break cryptography.
I see it as: they're all trying really hard problems that aren't in the training data, to gauge if their models are improving, achieved by looking at problem that humans haven't been able to solve yet. The evidence to this is all the problems being publicized in the last few weeks.
Or, less favourably: they are burning a ton of tokens on any random "hard" tasks they can think of to try and generate stories about AI doing amazing things to pump the hype, infinite monkeys theorem as a playbook. You only advertise the ones you succeed on, thus pushing the idea that's what they do routinely. Stochastic "genius".
6 replies →
This effort is relevant to "breaking cryptography" about as much as publishing the script for a 40 years old movie would break the film industry.
They are throwing Claude at questions around cryptography.
1 reply →
If it was insecure and they found it first, that'd be better than many alternative actors who would eventually find the same exploit.
Owning all cryptocurrency, and really all financial transactions over the internet, might briefly justify the Anthropic valuation
We should be certain that the crypto algos we use are secure. It would be a great use of their resources to try to break crypto.
Yes, boil the seas so we can confirm our cyber funny-money is still funny.
The models are really good at cryptography.
Remember when OpenAI published 700 math break throughs and absolutely none involved cryptography?
None except for discrete math and number theory.
As are all companies working in quantum computing.
Yeah, happy to see. Wouldn't it be cool if the many computational hardness assumptions were no longer just assumptions? If the algorithms and implementations used would no longer require the holy blessings of arbitrary - if credentialed - researchers?
Or consider the algorithmic complexity classes underpinning all of this, not just P vs NP, but also whether quantum computers are actually a distinct class, since that is not proven yet either afaik. The reason we're moving to quantum resistant algos in the first place.
Um, we all are. Do you not want people routinely testing the locks that guard your home against attacks enabled by the latest technologies?
seems like a pretty bad analogy because, yeah, i don't care about my lock being tested lol? it's not a security device
1 reply →
Eh, I hate Anthropic too, but this seems pretty tame. Lots of people have wanted to know the origin of those seeds even though they thought there was no back door.
More and more it is the relentlessness of the models that strikes me. Leave no stone unturned! Go through ALL of these old boxes. Someone said they thought maybe it was over there somewhere >>shrug<<
Amazing how far brute force goes when the feedback loop is minutes or seconds, not years or months.
Two weeks ago I was trying to solve this exact problem with the wrong approach they describe in the beginning... see here: https://github.com/mariusAsa/NistEllipticCurvesBounty
This neat and all but I think there's a bigger issue here. Anthropic (and whoever Anthropic wants) can do this kind of work with Claude, but if you or I try to do it, we will get blocked. This is a fun exercise, but extend this to something much more nefarious and you can see a moat widening between the model providers, their government partners, and the public.
The only thing that bridges this moat is continued advancement of open models.
> [The model's authors] can do this kind of work with Claude, but if you or I try to do it, we will get blocked.
If this seems concerning, wait until the models get effective enough (gets work done properly at a lower energy need than humans have) that there's no reason for them to release anything. Why offer your weights for download or grant any third party usage access when you can just do the actual job yourself and collect all that turnover?
> Why offer your weights for download or grant any third party usage access when you can just do the actual job yourself and collect all that turnover?
It's hilarious how a the trillions invested in AI companies, and their valuations are predicated on the AI labs Sherlocking entire industries, and yet CEOs, mathematicians, and everyone else are eagerly feeding the beast their most prized information.
11 replies →
They will just have someone look at every question, they will let it pass, want a cut or deny it. Claude, you can answer this guys question, but don't tell 'em how you solved it and don't give him the best answer, give him an ok answer.
5 replies →
This is why open weights and continued model distillation to improve model evolution is imperative.
Do you trust the people who would gate these capabilities? I do not.
4 replies →
French Revolution and the 21st centuries version of guillotines, whatever that could be, is probably a good reason to avoid that.
There's also a thing called commodity fetishism but capitalists usually learn the hard way that things created with machines without human input miss the essence of why we're willing to pay for something. Its why a handmade watch is $100k and a casio is $100, or a handmade sweater identical to a machine made goes for 10x.
They could also just make us so poor and anxious that we beg to fight eachother in wars.
5 replies →
Maybe, but that's what the cyber program is for. Nobody knew if the seed was fine or a backdoor. If it was a backdoor, and Claude helped you find it as a normal person, Anthropic would get bad PR. If you're a verified security researcher, actually that's fantastic and Anthropic would get good PR and everybody claps.
Anthropic wants to IPO, they don't want another Fable shutdown situation.
To be clear I would prefer the cyber safeguards to be less restrictive, I think they're currently too much. I often go to open models because of it. But there are likelier reasons to restrict cyber than world domination.
Why?
Why?
Why are we celebrating and encouraging the walling off of the global intellectual columns?
The idea that you can't reverse engineer things, make things, learn about biology or physics without permission is strange to me. These machines have been trained on the sum intellectual output of humanity, the global intellectual commons, and are being used to close off that commons?
I would be OK with their right to create such restrictions if they weren't lobbying the Government to restrict others, thereby ensuring that they control humanity's intellectual commons well into the future.
Who are they to say what I can learn or can't learn? Who are they to control what I can or can't do with these tools?
Perhaps I'm naive, but I think it's better for humans and the machines if we can all think, learn and build. But then again, I'm the kind of person who rejects the doomer pill.
Reject this.
24 replies →
>Maybe, but that's what the cyber program is for.
I have been in the cyber program since around the time it first went public and recently renewed it with the updated program.
You still trivially hit guadrails. I was trying to reverse engineer some bit of 20-year-old software that already has known, unmitigated exploits and it still downgraded me.
> that's what the cyber program is for
open weights are the better way imo, no elite gatekeepers please
> Anthropic would get bad PR
I think the current administration would delight in harsher penalties
> But there are likelier reasons to restrict cyber than world domination.
I mean, greed alone would seem to be enough, and it would be fully worth calling out as bullshit.
Anthropic gets zero of my money because their favorite word is no. I cannot figure out how to as an individual or a small startup request elevated permissions for the purposes of anything that they think might potentially be dangerous for someone who is not me to access. I have a background in cybersecurity. I have a background in life sciences. Can I put those skills to use to benefit humanity? Who knows.
I imagine the path forward for the labs will be signing off on organizations/institutions rather than individuals.
The risk/reward is way lopsided towards risk for the labs to vet individuals. Much easier to get an organization and have them take the blast if someone/something goes off the rails.
I cannot in any universe see the labs putting themselves in a "We should never had given this person access" situation.
> I cannot figure out how to as an individual or a small startup request elevated permissions…
https://support.claude.com/en/articles/14604842-cyber-verifi...
https://portal.anthropic.com/programs/cvp
2 replies →
I worked on this specific task myself, using Claude, and I was not blocked (although I did not succeed!)
Can you be sure that the model was not constrained for you, regardless? Since they can’t help too much with cyber, they might avoid some routes to not get completely flagged and that could influence for not finding the solution.
1 reply →
A form of being blocked is sandbagging the models
1 reply →
Same. I tried it just a few days ago. This news made me almost jump out of bed.
Same!
I feel like history is repeating itself - to many people AOL, Compuserve, MSN, et al seemed superior to "the web" in the early 1990s because they dumped money into making it slicker, licensed content, provided guardrails, made it easy for non-tech people... They had slick ads, were cultural phenoms, and people would take sides with the companies and think their arguments were strong and even obvious!
I'm skeptical that this particular task would get blocked, though I could be wrong. But I agree that the moat is a problem in the general case.
I don't know about cryptography, but if you try anything in organic chemistry or biology, you virtually always get flagged and downgraded.
As this is going on, Anthropic has opened up their own biology lab.
> https://www.reuters.com/world/anthropic-quietly-sets-up-biol...
There is very much a situation where people in frontier labs have access to exceptional capabilities that are being kept from the rest of us, and they're using it to strip-mine technical and scientific problems.
10 replies →
Broadly, the downgrading is still way too heavy-handed and clumsy. As of yesterday “How easy to crack is WPA2” downgraded to opus 4.8. Granted I could probably have phrased it differently and gotten a response, but the point is I shouldn’t have to. It can’t simultaneously be smart enough to reverse the ECDSA curve seed and not smart enough not to destroy the world by answering a trivial question with a scary word in it.
At minimum we don't have access to "Claude thoughts" like the ones the article highlighted, right? That's part of the hidden reasoning?
1 reply →
Fable 5.1 has downgraded me in the past week alone for the crimes of describing a coordinating server as "the C&C server" ([cyber]), for doing some statistical analysis on some toy Vigenère-ciphered text ([cyber]), and for asking it to help me find patterns in some semi-random text ([bio]), so it is fair to say I am not skeptical.
I have access to Claude's "defensive" cyber model and it appears to take no issue with the prompt, but I suspect that is because it uses today's publication as the basis for an answer.
In the past my attempts to work on crypto related problems have been met with needing the higher tier of "offensive" access.
It doesn't matter what is blocked today, it matters what is blocked tomorrow.
If we allow these providers to promote regulatory capture they become the arbiter of what anyone is "allowed" to do
1 reply →
I know Anthropic models have a lot of insane, paranoid filters, but I don't remember them blocking cryptography work last I checked (some 3 months ago now).
I routinely get rejected on elliptic curve related requests; often I can talk Claude back into some work on it. But it is surprisingly sensitive to talking about research cryptography in my experience. I’m not in their cyber program.
3 months ago is like years ago in the current AI landscape
1 reply →
The cyber filter blocks really basic stuff all the time. People who are pro that bs should be forced to only eat with a spoon for the rest of their life.
3 replies →
> moat widening between the model providers, their government partners, and the public.
Part of me wonders whether the NSA/other TLA has either (a) an unrestricted model from a lab with less scruples like SpaceX, or (b) an in-house model, either abliterated or with data they've bought themselves.
Anyone can do this kind of work with a model as simple as GLM 5.3 or Kimi K3
How do you know this to be true? I am not disagreeing; I genially need to understand why or if others are seeing blockers that I don't see or if I am seeing blockers that they do not see.
Are their guardrail benchmarks or anything of the sort that we can use to see where the bifurcation of permission/capability occurs?
Why would you be blocked? I cannot imagine why you would be for this specific task unless the supposed backdoor turned out to be real.
As much as I dislike the guardrails, they are absolutely irrelevant to this task, and you will not get blocked.
Moat must have been written more times in the last 12 months than in all of history before that time.
Open models are just as quick to refuse to do stuff, in my experience.
Compute has always been gated. This is nothing new. If we look at the HPC space, many of the largest clusters were restricted access and used by governments organizations. Even the ones with "public" access, not just anyone could get access to it.
JFYI, this is not true. I do stuff like this all the time.
Whenever I say that the rich have access to much more capable and unrestricted models I get downvotes. Yet here we have another example.
Kudos to Anthropic for choosing the higher bounty and donating it to ISRG, that is a very nice gesture.
> There is no action to be taken or things to do differently. Most researchers trusted the curves already. Enjoy.
Didn't know I needed to hear this until I saw it.
Not sure where along my life I became so tense all the time!
As one of the original bounty sponsors, I'm thrilled to pay my portion to ISRG. :)
Makes me wonder if any implementations will do the cute trick of dispensing with the seed constants and deriving them at startup from the unix timestamps. :)
That's one of those things I would consider "cute, but wrong". I'd rather hardcode for efficiency and add a unit test that rederives.
They'd be trading the seed constants for the timestamp constants, more annoying than cute honestly.
Interesting. So there was no humorous phrase, and its probably safe from backdoors. They do look pretty random.
> None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp!
Could they not be both?
Extremely unlikely - these are very sparse domains.
Somebody must have tried attacking old lost Bitcoin wallets on that basis. But so far those early day Bitcoins haven't moved.
I think it's only a matter of time before we decrypt the Voynich manuscript and the fourth message of Kryptos.
https://beinecke.library.yale.edu/beinecke/collections/beine...
https://allthatsinteresting.com/kryptos
the null hypothesis for Voynich is that it was generated by some random process, like asemic writing, assembling bits from tables and copy/paste/edit. there are some reasons this is plausible (the entropy of Voynich words is low for language, there aren't scribal corrections etc), but fundamentally the "ancient hoax" hypothesis can't be proven, only disproven (since there's so much freedom of choice in generating garbage that it's not a compact explanation.)
so frustratingly, if it is an ancient hoax we can't ever prove it. all we would observe is that we haven't deciphered it, but failing to decipher isn't proof that there's nothing to decipher.
I recently read a good Voynich paper that makes me pretty sure that it was an ancient hoax. https://journals.openedition.org/digitalmedievalist/2331 The pages are more linguistically similar when read as flat sheets than when read as bound, and there's illustrations that stretch across the "gutter" between flat sheets that are cut off when looking at the bound manuscript. The manuscript was only bound once, in the fifteenth century (around when the pages have been carbon dated to). This means that whoever bound the manuscript was unable to "read" it, and the pages were likely written sheet by sheet before being bound in an arbitrary order.
I disagree on K4. People are claiming they solved it every day using AI but it doesn't pass the verifier. I would be shocked if it was ever solved by AI.
I personally think it is a weird OTP (effectively). We have the book but the algorithm is so unclear it could be anything.
"It is still conceivable that these curves were selected to have a specific property in principle by searching over timestamps to the random number generator."
Indeed! And we guess that OpenAI was gagged by the NSA because the massive proof dump on Oct. 6th did not contain cryptographic results.
I assume that Anthropic faces similar restrictions, so this seems kind of approved.
I have seen nothing that would make me believe there is a "[gag] by the NSA" preventing frontier labs from publishing cryptographic results.
We published HAWK and McEliece attacks no problem.
The conspiracy theory going around the Internet is that they (the AI labs) broke cryptography in some way a la last season of HBO's Silicon Valley, and they're keeping the results under wraps until they can steal Bitcoin out of Satoshi's dead wallets, and then use that to pay for GPUs et al.
This makes no sense. If Satoshi's wallets come alive, Bitcoin goes to zero because they were clearly hacked, meaning the entire tech is suspect. Or it would also go to zero but because it's revealed that Satoshi is GCHQ or NSA and the entire tech is suspect. This would happen within minutes.
Would it have been feasible for a FOIA to reveal the origin from the primary source?
EDIT: ah, one of the linked authors tried that. They had no documentation on it. https://saweis.net/posts/nist-curve-seed-origins.html
Yep.
NIST closed it: https://www.muckrock.com/foi/united-states-of-america-10/ori...
NSA ignored it: https://www.muckrock.com/foi/united-states-of-america-10/ori...
I think part of it is I don't know how to write these FOIA requests in the right way they can comply with it. I think you need to be more specific.
thank you for at least trying :)
starts to rebuild trust at least :)
what's one thing that you can actually talk about out of this that might help people to understand that's getting lost?
Setting aside the use of "an internal research model", how would one go about prompting an LLM to do this?
probably something like:
"read this: https://words.filippo.io/seeds-bounty/ then find the solution to the bounty"
For a token or two, maybe the GPU felt warmth.
I didn't know that Jerry Solinas had died. I knew him slightly. He wasn't all that old. RIP regardless of whatever minor controversies he might have gotten into.
For fun, give Opus 5.5 the initial hint and watch it work through it:
"There's a curiosity I noticed in the seeds of the ECDSA curve origins. You see the 1st digit is never over 7, which means that the left most bit is never over 0. lrand48() returns 31 bit numbers u know? So what if those 4 seeds were built from lrand48 or something. If they're built from 31 bit numbers on per 32 bit word that explains the pattern. Wonder if there's some other insight you might have beyond this"
I gave Open 5.5 high your hint. This was the most interesting output:
'Side curiosity: many of the SECG/X9.62 seeds contain the ASCII text 4D696E6768756151 75 = "MinghuaQu" (a Certicom researcher), sometimes shifted by half a byte.'
I don't see any mention of that in the article.
That is mentioned in a years old post: https://saweis.net/posts/nist-curve-seed-origins.html
2 replies →
this has been known for some time: https://bitcointalk.org/index.php?topic=5469657.10
What if you omit the mention of lrand48?
> Let me be careful about the plausibility: is it suspicious that such an obvious thing wasn’t discovered in 25 years?
Alright Claude no need to rub it in.
You can't prove the non-existence of a backdoor to elliptic curves...
But you can show that there isn't room for (enough) unexplained entropy.
There are a few Unix command patterns I type out quite a lot more than any others. Every time I do so I wonder “isn’t there a better way of doing this?”. I know I could do better or use better tools but also, meh, who cares? It’s more important to be productive than to be right, right?
The classics, of course:
(Weird to mix fish and sh, I know. Sue me!)
Another one though is if I need some kind of random-ish seed for something like a cache key, or a hidden URL path directory, or the password for the bitcoin wallet I keep publicly online to taunt others:
Glad to hear I’m not alone!
then control+alt+a inserts your awk snippet, and you have even less reason to learn modern tools
For me, it was news that showed the cleverness of chacha's choice to use the "expand 32-byte k" ASCII byte sequence as a constants.
Why did they specifically skip other apparently suitable curve candidates? The B-163 seed and the base point origins of several other curves are still not explained
It just means that we should use cryptographically-secure PRNG for EVERYTHING even remotely related to crypto, and even for low priority systems. Everything, including passwords that we routinely generate and store in vaults/password managers.
I wait for the morning that we’ll wake up to ssh keys being useless
To be clear, this is in no way close to a cryptographic attack.
On the face if it, the big leap here was Claude autonomously envisioning, and deciding to pursue, the "ancient prng + date" angle - - rather than working backwards from the premise of deliberately weakened seeds or some other popular theory. To me that shows creativity, and modelling of the situation and method of the people at the NSA.
So two questions:
1. TFA mentions the "humourous phrase hash" theory, but Claude's trajectory seems to be a long way from that. To what extent was Claude prompted in the ultimately successful direction?
2. Whats with all the "hmm..." in the internal reasoning process log? Do models really do that? And if so, why? Some weird emergent language thing, or just mimicry?
> 2. Whats with all the "hmm..." in the internal reasoning process log? Do models really do that? And if so, why? Some weird emergent language thing, or just mimicry?
Assuming that is actually the real reasoning trace (open weight model reasoning traces usually do things like switch languages or talk in non-standard English because of model drift, so it's a bit surprising that Claude wouldn't do the same) there was a study a few years ago that found base models produce better answers if you put "take a deep breath" in the prompt[1]. Maybe in the RL training stage stuff like that gets reinforced and because reasoning traces are hidden in RLHF it doesn't get selected out? My money is on it not being the real reasoning trace though.
[1]: https://arxiv.org/abs/2309.03409
> the "ancient prng + date" angle
I remember hearing this in a cryptanalysis lecture at some point, so it was not a completely novel theory.
Admittedly I am not finding written evidence of this anywhere.
From the video posted upthread, the vibe I get is that they prompted Claude about the bounty and to approach it from first principles rather than building another clone of John the Ripper.
Neat. Now they should figure out what's up with the secp256k1 curve and its weird generator point G where 1/2 G has 90 leading 0 bits.
I know it has no security impact in this case, but isn’t it odd a bunch of cryptographers would choose a weak PRNG seeded by the date for a task like this?
Even state lotteries back then used physical ping pong balls and a nothing-up-my-sleeve show after the evening news.
The prolonged conspiracy theories until this discovery make some sense… not having a ceremony around anything supposedly “random” is unexpected, even back in the 1990s.
No, it's not odd. This isn't a task for which a cryptographically secure random number is needed. In fact, it's closer to the kind of task where you want the opposite thing (a deterministic random number generator, like you'd use for a simulation).
The starting point for finding a curve coefficient is totally arbitrary (so long as the math on the resulting curve equation checks out). Competing curves use mathematical constants like pi and e to do the same thing. It's simply a number everyone has to agree on; it has no other significance.
Not entirely related to the topic, but did someone spent some tokens trying to figure out the origins of the "Wow! Signal" (https://en.wikipedia.org/wiki/Wow!_signal) ?
Or some tokens for who killed the Kennedys?
mda5("Sneed's Feed and Seed (Formerly Chuck's)")
They glow in the dark so you hit em' with your car.
crazy
So can we break crypto wallets now? Huzzah I’m going to be rich! ;-)
To me, this shows just how many open problems which have obvious solutions, or solutions which people suspect might be true but have not verified, can be confirmed with code that nobody except agents can be bothered to write.
At the extreme end of the optimism spectrum, there is a multiple million LOC program waiting to be written that can fully understand e.g. human DNA, or cancers, or proteins, or whatever else is needed to propel us forward medically. But of course, I'll believe it when I see it.
This is huge. It means the Bitcoin and Ethereum communities can now confidently ship the opcodes and precompiled contracts to check ECDSA signatures on P-256 in addition to K-256 curves, and stop worrying about possible NSA backdoors based on the chosen seeds (quantum computers are another story).
I turned out to be right in my advocacy years ago, here is my post: https://ethereum-magicians.org/t/eip-7212-precompiled-for-se...
Nobody conversant with elliptic curve cryptography research believed there was a backdoor based on these seeds; for a number of reasons, best articulated by Koblitz and Menezes (who took on the question directly).
But it's nice to be able to shut the whole unproductive debate down directly.
But what if there is a backdoor and just looped the RNG until they find the seeds that will match it. Just in case. /s
1 reply →
If there’s one thing everyone knows about conspiracy theorists, it’s that they’re willing to accept concrete disproof of their theories. /s
Seems to me like a nothing burger? As long as there is no weakness, why should I care which PRNG shuffled bytes?
The process to generate these was opaque, so there was some concern that the values might have been backdoored somehow like Dual_EC_DRBG was; we didn't even have confidence that they were generated from a PRNG rather than some other process. Knowing that the values were generated this way makes it much less plausible that there is such a backdoor.
But you can still analyse the behaviour of the values to identify backdoor behaviour rather than insisting on uncovering the exact method od generation.
Just seems to me like that's quite low on the priority list. I guess this result assures some people that the values are good.
2 replies →
>like Dual_EC_DRBG was
There is no evidence that it was backdoored.
it's funny how they release highly editorialized reasoning output, but in production they hide it because it was outputting extremely embarassing "dumb" toughts with the low compute limits they gave the subscription tiers.
On September 20th a friend told me that he had as significant number of Anthropic credits that were about to expire and wondered about a use for them. I do not use their products because of their relentless commitment to depriving the public access to artificial intelligence (and particularly any AI that isn't acting on their behalf) and I strongly discourage anyone else from doing so. But since he was going to use the credits for something, I tried to think of a skut work task that would be of only idle curiosity and would not help advance their capability, enable a meaningful public announcement* for them, and was likely already probed by many others (so success would only be lottery effects). -- and basically just something so pointless I wouldn't want to waste my own compute grinding on it but might like to see the result.
So I recommended determining the origins of ECC seeds and base points. The agent worked continuously for many hours and did not uncover anything interesting that wasn't already known. I looked at the transcript and was struck by how idiotic the agent was-- significantly below the standard of intelligence I've come to expect from GLM running locally.
I'm not saying this to suggest that misanthropic hijacked someone elses work yet again-- this is an obvious question that many people have surely posed and success presumably depended on expert use (which was absolutely not applied in my friends example). But it does make me wonder if the company invisibly degraded the model performance.
[*] Seems I underestimated how trivial a result they'd bother trying to spin!
I am laughing at the dead comment-- insulting my intelligence for supposedly being unaware of concerns related to NIST curve parameters.
Some points:
I am one of the authors of libsecp256k1, the primary implementation of the aforementioned "different elliptic curve" used widely in cryptocurrency systems. I would characterize the position differently: Secp256k1's design is rigid, or quite close to it (at least as much as anything made before being rigid was an explicit goal).
Knowing how the seeds were selected in the NIST curve does not render them rigid and were very unlikely to do so: the scheme described ends up giving them 20-25 bits of freedom, perhaps more (esp given the unexplained skip values)-- plus more bits for the 'choice of scheme'.
Of course, it seems unlikely that 25 bits of grind gives you an exploitable weakness, but that was also true for 256 bits of grind. You're dealing with an unknown-unknown, once you are concerned about the the possibility of magically weak curves which we have no reason to believe exist at all why would not also be concerned that they exist at one in a million levels and not just one in a billion? (especially given compute available at the time they probably couldn't even have ground out that many more bits).
The whole concept of rigid parameters which is now popular is that by making the selection inflexible you avoid the losing game of debating how much free grinding is too much-- the right amount is there should be no avoidable grindspace. The fact that the origin of the seed wasn't immediately apparent right away meant that there was substantial grindspace-- if nothing else the selection among the myriad possible schemes that people would have found credible.
I don't think the result meaningfully changes the reason for preferences. And more recent development has rendered the question less interesting: New systems are mostly PQ and ideally PQ hybrids. Things using ECC should likely prefer Curve448 because of better security vs performance tradeoffs and not being as close to the edge for advancing attacks. If older cryptosystems are desired, now that the GLV patent has expired secp256k1 has considerable performance benefits-- another good reason to continue using it.
The 'advantage' of many vendor P256 libs is also illusory-- people think their microcontroller ecdsa binary is "hardware accelerated" when often it's a barely competent software implementation that has serious design (e.g. timing sidechannels) and interface flaws.
I also think it's not that relevant because the systems that use secp256k1 more than anything else do so for compatibility reasons (because that's what Bitcoin originally used-- and other systems were either trying to be compatible or were slavishly copy-and-pasting and avoiding departing from Bitcoin's choices out of an abundance of caution)-- and discovering that NIST curves might be better than some feared probably has no impact.
The idea that someone would go "oh, I'll use P256 now!" when they would otherwise have used e.g. secp256k1 seemed implausible to me at the time-- and continues to do so now, having seen the conclusion. Maybe someone, somewhere does--- but meh.
Of course, finding something problematic would be incredible news-- but I don't think I was unreasonable in assigning a probability essentially zero to that. Moreover, what I was describing was my casual thoughts about someone elses disposable credits-- no one else is required to agree: Unlike some other parties (say, anthropic)-- my view that some line of research isn't good or interesting has no bearing on anyone elses ability to pursue them. :)
Cheers!
I looked at the transcript and was struck by how idiotic the agent was-- significantly below the standard of intelligence I've come to expect from GLM running locally.
Sandbagging is real.
[dead]
As unsurprised as I am by this, and as much as I suspect a lot of people could have guessed it, having Claude confirm it is still fascinating, but.
Somehow, I find these results fascinating, but also quite sad, because we used a machine to solve it at all. I feel like some half drunk motivated graduate level humans could have figured it out too.
Then again, once you know the answer, perhaps you have an obligation to share it, keeping it to yourself might be unfair to everyone else.
Honestly I’m not entirely sure how I feel about all this. I would gladly welcome any groundbreaking work Claude might do to solve hard problems and move the world forward by decades or even centuries.
But these sorts of fun problems feel like things we should avoid pointing LLMs at. They remind me of those weird programming puzzles that are difficult to solve but incredibly fun to work through.
My concern is that if Claude ends up solving all the fun problems, will humans be left with nothing but the hard, headache-inducing ones? Tao had raised a similar concern, problems that graduate students would have been expected to solve and learn the process, are now things you can simply point an LLM at.
I’m still not sure how I will ever reconcile with this feeling, about any of this. I just find it genuinely sad that we might be automating away not only the difficult work, but also the joy of figuring things out for ourselves.
[flagged]
[dead]
[flagged]
Stochastic parrot truthers in shambles.
What proof is it that it is really the origin of the curves? That looks credible like most hallucinated output of LLM but it might easily be a coincidence similar to a collision attack, no?
Especially finding the solution that is based on using a random number generator.
It's like people seeing proof that the future was written in Harry Potter books by reading the first letter of the top of the page of a weird set of pages.
So I have this straight, you're concerned that the raw output of lrand48 seeded by a timestamp taken at the time the curves were known to be generated might happen to collide with a hash function output, or, better yet, the precise value needed to trip an unknown elliptic curve vulnerability?
I have that right?
>“seed” parameter
>provided by the NSA with no explanation or justification.
Really? Nobody is concerned about the NSA just cheerfully dictating that? Smells very rainbow-table-y
Every domain expert has been concerned with this for multiple decades.
Computers can search information space exhaustively.
This is not very exciting
You should apply your brilliant insights to win cash prizes like that then.
> This is not a cryptographic break, new attack, or weakness in the ECDSA curves. In fact, this makes us more confident the curves were chosen without any backdoors or intentional weaknesses.
Uh… did you talk to any cryptographers? This is EXACTLY what a weak curve would look like. Imagine that 1 in a thousand, or one in a million keys, selected at random, are vulnerable to some withheld attack. This approach lets you vary the timestamp or number of iterations until a weak key is found, then have plausible deniability afterward. This is why modern systems choose constants in a way with no free choice of parameters (e.g. sqrt of 2 for first constant, cube root for second constant, etc.).
They even note later in the article that viable curves in the generator sequence seem to have been skipped.
Yes. I did speak to a cryptographer.
I worry that your statement in this article gives an incorrect impression of the risks here. I would have objected to the excessively positive framing regardless, but the "much" in "much less plausible" is not warranted, I think. What you have done, which is important, is constrain the type of backdoor that might be in there. But we can't say more than that right now with any certainty.
[flagged]
This is discussed in the post - since the NSA never mentioned how these seeds were created, it seems unlikely that they would develop a cover story that would not be shared and only opened to scrutiny many years later
>Uh… did you talk to any cryptographers
google some of the names under the "Who we are" heading
They are so desperate for claude to be good at maths, like chatgpt. But claude is optimized for quick, pragmatic results and chatgpt is trained to be careful. There is a reason the best anthropic could do was an organized search - not real mathematics.
I have strong doubt on this claim.
It claims that NIST member feed UNIX time of certain points in 1997-1998 to srand() and draw 20 bytes for n times, then use the last 20 bytes for the SEEDS.
Why NIST staff in 1999 used default rand() implementation of libc(or languages which rely on libc) at that time? Linear congruential generator was infamous for its poor quality even in 1990s.
NIST published recommended SEED value in 1999, July. Why did they use UNIX time from 1997-1998?
Why the exact date of that UNIX times are so sparse? 1 in 1997 May, 3 in 1997 Auguest, 1 in 1998 April? If they did srand(time(NULL)), it should be more closer.
The number of n'th 20 bytes thrown out is also doesn't make sense. n=139 for P-192, n=7026 for P-224 and so on. Why did they choose this numbers in particular? Why P-192 was odd and 3 digits while rest of 4 were even and 4 digits?
It seems to me, Claude simply hit a jackpot of coincidentally matching 20 bytes.
Interesting theory but 20 bytes seems like a lot to match given only the entropy of dates. Can you make this theory quantitative, IE show that with the entropy of n, arbitrary date, and choice of rand implementation there are sufficient degrees of freedom to hit 20 bytes?