Claude reveals ECDSA curve origins (anthropic.com)
509 pointsby ahlCVA4 hours ago212 comments
fidotron 3 hours ago
While this confirms the method of production it doesn't say anything about their selection, especially since they were, apparently, generated over a period of months. Specifically you cannot see those candidates that were generated and discarded.
"It is still conceivable that these curves were selected to have a specific property in principle by searching over timestamps to the random number generator."
Yes.
"However, you would only need to do that if you were going to disclose the timestamp as some evidence that the seed was innocuously generated."
Does not logically follow when "doing and saying nothing" will completely suffice.
tptacek 3 hours ago
God bless you for keeping this alive.
fidotron 3 hours ago
It doesn't prove anything about the core part of the suspicion, which is they were selected using some undisclosed criteria, which may make them weaker or stronger than some other random numbers.
You are entirely familiar with the precedent of the DES s boxes of course, where that is exactly what happened.
JumpCrisscross 3 hours ago
> which may make them weaker or stronger than some other random numbers
Are there non-trivial weaker and stronger seeds for this category of elliptic curves?
fidotron 3 hours ago
Exactly.
When they made the changes to the s boxes for differential cryptanalysis resistance the entire concept of that was essentially secret, so who knows what they know about elliptic curves.
matthewdgreen 2 hours ago
The number of weak classes of elliptic curve would have to be gargantuan for this specific search to produce some. If that many curves are bad, then ECC was a mistake.
1sha an hour ago
drand48() could be one of hundreds of methods that were tried to produce specific values with plausible deniability and happened to produce them. The other searches were discarded.
fidotron an hour ago
Then why not turn this around and say which (hopefully small set of) specific classes of curves are known to be avoided, but otherwise have a free for all?
> If that many curves are bad, then ECC was a mistake.
I mean that is the logical conclusion from the behaviour around this approach where a few good things are effectively endorsed without justification.
The fact is any application of an algorithm that involves so much "trust me bro" on the selection of what are a large number of opaque quasi random but not quite or provably so numbers only has as much trust in it as you have in the people that created it.
tptacek 2 hours ago
Again, Koblitz and Menezes take this idea on directly in their paper. But I mean, at this point, nobody serious is going to take the P-curve seed conspiracy theory seriously ever again.
1230917 2 hours ago
"However, you would only need to do that if you were going to disclose the timestamp as some evidence that the seed was innocuously generated."
And the disclosure happened now through Anthropic that is 100% not going to anger the NSA before the IPO and will have permission.
bflesch 2 hours ago
If you keep posting like this you're gonna get microwaved from space ;)
fidotron an hour ago
I'm only posting like this because they already are.
bflesch 33 minutes ago
Check out 133784883 then, it really gets the machine going.
cookiengineer 8 minutes ago
> 133784883
Ghislaine Maxwell's social security number?
defen an hour ago
> While this confirms the method of production it doesn't say anything about their selection, especially since they were, apparently, generated over a period of months. Specifically you cannot see those candidates that were generated and discarded.
Well, at least now we have a way to perform that analysis! Generate a bunch of curves by varying (along any degree of freedom) the input parameters to the seed generating function and see if there's any difference between the curves that are generated.
connorboyle 15 minutes ago
I think it does rule out any NOBUS vulnerability with these curves, doesn't it? My thinking may be a bit sloppy here, but for a curve to be NOBUS exploitable with N-bit security by its creators, I think it would have to have a property only shared by 1/(2^N) curves. It would be impractical to hash 2^(N-1) timestamps until you find one with the desired property, for any decent size of N--which is how many you'd have to do on average before finding one with that property.
FiloSottile 11 minutes ago
Given how expensive this computation would have been in 1997, it makes perfect sense they'd taken months, but even if we assume they tried all timestamps of 1997 and selected arbitrarily among the first 16 viable candidate of any timestamp, that's just ~30 bits of freedom.
Finding out there is a class of weak 256-bit elliptic curves so large that they can be hit randomly with 2^30 tries would be a cryptanalytic breakthrough analogous to discovering all elliptic curve cryptography is broken.
Read section 3.1 of the Koblitz and Menezes paper. It was already implausible with 160 bits of freedom. https://eprint.iacr.org/2015/1018
If you want to believe the NSA knows ECC is broken and chose to risk moving the US government to it and somehow no one figured out the same break in 30 years, you're free to do so. But pretending the seed choice plays any role in that theory is over.
JumpCrisscross 3 hours ago
“In under half an hour, Claude discovered the origins of the NIST P-192, P-224, P-256, P-384 and P-521 seeds. None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp!”
Gorgeous. I wonder if the NSA employee who did this suffered a head injury or has been quietly giggling to themselves for the last quarter century.
tptacek 3 hours ago
Someone just posted this:
JumpCrisscross 3 hours ago
Genuine question, how many days of your life have you had to spend on this particular tinfoil convention?
weakfish 3 hours ago
Video is meant as a joke, it’s common to edit the subtitles of this video to alternate ones
JumpCrisscross an hour ago
Tptacek is an expert in this field. I imagine he's had to spend a considerable amount of time explaining why ECDSA probably aren't nerfed.
sweis 3 hours ago
Some previous discussions started based on these posts:
https://blog.cryptographyengineering.com/2015/10/22/a-riddle...
https://eprint.iacr.org/2015/1018
hybrid_study 3 hours ago
understanding Spanish throws it off, but this is hilarious either way. LOL
guelo 3 hours ago
I understand Spanish being from Latin America but for a long time I couldn't understand a single thing he said because of the Spaniard accent and crazy laughter, and I enjoyed the memes just fine. But then few years ago I watched it with the real subtitles and something clicked in my brain so now when I watch it I mostly understand him fine. But now the memes are ruined because it's hard to hear and read two speeches at the same time. Just an annecdote about our weird brains.
tptacek 2 hours ago
Is this like what Downfall is like for Germans?
KAMSPioneer an hour ago
Just to add here that this guy doesn't have a "standard" Spanish accent. He was from Andalucía (I don't remember where exactly), a region rather known for its accent being difficult for even native speakers to understand.
Anyway after I moved to Andalucía I now can understand the story he tells, but I have to pay close attention!
mrguyorama 3 hours ago
That's one of the best executed implementations of that joke I've seen in years.
blast 3 hours ago
> Someone
> https://www.youtube.com/@steveweis4786
FTA: This work was conducted at Anthropic by [...], and Steve Weis.
I wonder how much time he spent on the video relative to the other stuff
sweis 2 hours ago
A buddy did it with Claude, so zero time.
blast 44 minutes ago
Oh I even saw your other posts in this thread but didn't recognize the name. So much for my research skills
thadt 10 minutes ago
I mean, at least you didn’t spend the last 20 years hashing 2^51 sentences in your research.
sweis 3 hours ago
The two people were Bob Reiter and Jerry Solinas. Jerry wrote in a 2015 email to Daniel Bernstein that he thought it was a hash of the passphrase. I corroborated that story with 4 people, including two ex-NSA folks off the record.
Everyone was wrong!
I wasn't able to reach Bob. He was working in private industry as of 2018, but never responded.
Pannoniae an hour ago
or they were lying...
lifeisloving an hour ago
Kind of sus that they would spread a rumor that its a phrase. This isnt something I would forget, or confuse with a timestamp..
ACCount39 24 minutes ago
It's possible that this "phrase hash" method was used for a different case - like another, unrelated and possibly unreleased algorithm. And then it was confused for the one used for those curves.
teddyh 3 hours ago
> The fifth binary seed, B-163, fits nothing Claude has tried and remains unexplained.
The simplest explanation would be that it was generated the same way as the others, but somebody mistyped a digit somewhere along the way to publishing, and therefore a solution could not be found with the assumption that the number is correct.
lukeify 3 hours ago
This is also why one of the Zodiac ciphers remained unsolved for so long. The dude made a mistake in his transcription.
azinman2 3 hours ago
Very well possible. I’m glad to see that this is all above board in the end, which further argues the case AGAINST conspiracy theories. Most people are just trying to do the right thing.
lifeisloving an hour ago
Sorry, US intelligence agencies is not a category of organizations I would sort in the "we're just trying to do the right thing" bucket.
I dont even mean that as a dig to the people working there (although maybe some) they're literally a military wing of the worlds most powerful empire..
Lets be honest with ourselves, their job is to spy on people, and spies try to make their job easier not harder.
Hell it seems they did lie about the origins, which should bring their entire motivation into question. They spread rumors that it was a "silly phrase", thats ridiculous.
sweis 3 hours ago
13 years of tinfoil hats for srand48(time(NULL)
217 3 hours ago
But the friends we made along the way!...
bayarearefugee 3 hours ago
> 13 years of tinfoil hats for srand48(time(NULL)
Probably not quite this given the timestamps span over almost a year (but have some clustering in August 1997).
Given that the spread suggests they weren't just now() timestamps it would actually be interesting to know what the significance of the timestamps is, if any. Though it could be something boring like randomly sampling some local file creation times.
SturgeonsLaw 11 minutes ago
Those are the dates that the NSA obtained quantum computer tech from the alien crash site at Roswell, which would enable them to break the crypto they were currently building
tptacek 3 hours ago
This is devastating news... for an entire generation of NIST cryptography conspiracy theories.
nickysielicki 2 hours ago
It’s perplexing that NIST chose to burn so much trust and goodwill with the independent cryptography community instead of just explaining empirically that they really had nothing up their sleeve.
tptacek 2 hours ago
It was a very different time back then.
thoughtpeddler 20 minutes ago
What was so different, culturally?
SturgeonsLaw 8 minutes ago
Well the thing that comes to mind for me was the US gov classing encryption as a munition and placing it under export controls
thoughtpeddler 6 minutes ago
That was more early-mid 1990s, and not so much late-90s and early 2000s, when the NIST/NSA issues came about (from what I understand)
rs_rs_rs_rs_rs 2 hours ago
"independent cryptography community" - I actually LOLed at this
I don't think that "community" would accept any kind of answer as truthful so why waste the time...
nickysielicki 2 hours ago
It’s independently verifiable. What do you mean?
valleyer an hour ago
One of the top comments in this very thread suggests the seed timestamps were maybe selected specifically for purpose.
sweis 2 hours ago
I think they legitimately did not know. The person who worked on it directly, Jerry Solinas, did not remember and gave an explanation that turned out to be wrong. In his defense, multiple people told the same story about hashing a phrase that was wrong.
If they did know, they could have handed over these timestamps 15 years ago and put the issue to bed.
yrjrjjrjjtjjr 2 hours ago
If they deny everything they didn't do, then whatever they don't deny will stand out.
nickysielicki 2 hours ago
So it’s pretty clear that Anthropic is privately trying to break cryptography.
nomel an hour ago
I see it as: they're all trying really hard problems that aren't in the training data, to gauge if their models are improving, achieved by looking at problem that humans haven't been able to solve yet. The evidence to this is all the problems being publicized in the last few weeks.
Latty 33 minutes ago
Or, less favourably: they are burning a ton of tokens on any random "hard" tasks they can think of to try and generate stories about AI doing amazing things to pump the hype, infinite monkeys theorem as a playbook. You only advertise the ones you succeed on, thus pushing the idea that's what they do routinely. Stochastic "genius".
amelius 38 minutes ago
As are all companies working in quantum computing.
j2kun 19 minutes ago
If it was insecure and they found it first, that'd be better than many alternative actors who would eventually find the same exploit.
jamienk 3 hours ago
More and more it is the relentlessness of the models that strikes me. Leave no stone unturned! Go through ALL of these old boxes. Someone said they thought maybe it was over there somewhere >>shrug<<
entrope 3 hours ago
> is it suspicious that such an obvious thing wasn’t discovered in 25 years?
Ouch. The implied judgment of us humans stings there.
sigmar 2 hours ago
Did that clanker call us dumb? Scorch the skies, this means war.
why_at 27 minutes ago
Seriously though, how did nobody find this? It's not like you needed an LLM to check the random number generator. Given how much interest there was by cryptography people it is surprising.
slowin 3 hours ago
This neat and all but I think there's a bigger issue here. Anthropic (and whoever Anthropic wants) can do this kind of work with Claude, but if you or I try to do it, we will get blocked. This is a fun exercise, but extend this to something much more nefarious and you can see a moat widening between the model providers, their government partners, and the public.
The only thing that bridges this moat is continued advancement of open models.
ronsor 3 hours ago
I know Anthropic models have a lot of insane, paranoid filters, but I don't remember them blocking cryptography work last I checked (some 3 months ago now).
AkshatJ27 3 hours ago
3 months ago is like years ago in the current AI landscape
AtNightWeCode 3 hours ago
The cyber filter blocks really basic stuff all the time. People who are pro that bs should be forced to only eat with a spoon for the rest of their life.
therein 3 hours ago
If you have a variable `const char *shellcode` in a fizzbuzz function, it is enough for it to lose its mind.
AtNightWeCode 3 hours ago
It stopped me from doing basic bit operations. I have looked around and others have the same problem.
sillysaurusx 2 hours ago
For me it refused to move Claude transcripts from point A to point B on my local machine. It kept getting flagged as reasoning extraction or something. The line of "It's my machine, I can move files wherever I want" shouldn't be crossed. Someday file managers are going to go extinct and LLMs will organize everything, and they shouldn't choose what files you can and can't access on your own computer.
vessenes 3 hours ago
I routinely get rejected on elliptic curve related requests; often I can talk Claude back into some work on it. But it is surprisingly sensitive to talking about research cryptography in my experience. I’m not in their cyber program.
comex 3 hours ago
I'm skeptical that this particular task would get blocked, though I could be wrong. But I agree that the moat is a problem in the general case.
richwater 3 hours ago
It doesn't matter what is blocked today, it matters what is blocked tomorrow.
If we allow these providers to promote regulatory capture they become the arbiter of what anyone is "allowed" to do
ragequittah 38 minutes ago
I think when the open source models catch up (likely soon) we'll long for the days when companies could control it like this. I could easily see a teenager with openclaw and a single prompt causing millions of dollars in damage. Multiply that by the number of stupid people in the world and we have a problem.
A_D_E_P_T 3 hours ago
I don't know about cryptography, but if you try anything in organic chemistry or biology, you virtually always get flagged and downgraded.
As this is going on, Anthropic has opened up their own biology lab.
> https://www.reuters.com/world/anthropic-quietly-sets-up-biol...
There is very much a situation where people in frontier labs have access to exceptional capabilities that are being kept from the rest of us, and they're using it to strip-mine technical and scientific problems.
derwiki 3 hours ago
Strip mining is a great phrase here, thank you
Bluestein 3 hours ago
Agree.-
They sure as hell ain't stripteasing :)
handfuloflight 3 hours ago
The strip teasing is all of their capability gating.
Bluestein 2 hours ago
Come to think of it, indeed.-
A_D_E_P_T 3 hours ago
I can't take any credit for it. I believe Terence Tao coined it first. He also wrote a bit about it here: https://mathstodon.xyz/@tao/117237320796901560
alwillis 2 hours ago
> There is very much a situation where people in frontier labs have access to exceptional capabilities that are being kept from the rest of us, and they're using it to strip-mine technical and scientific problems.
If these capabilities were available to the public, someone somewhere would make a biological weapon or create a virus we've never seen before that could kill many millions of people.
Stanford researchers have demonstrated it’s possible [1].
[1]: "AI creates 16 new viruses from scratch, showing promise for drug resistance and drawing warnings about potential for misuse" - https://www.cnn.com/2026/08/06/health/ai-viruses-bacteriopha...
girvo 2 hours ago
We already have controls for that: we control access to the reagents and equipment needed. Yknow, like we always have.
Information is not dangerous. This is a ridiculous argument to me, but maybe my chemistry degree has me biased.
jiggawatts an hour ago
Not to mention that making an actual novel virus requires thousands of dollars of equipment, serious lab skills, and even then is so dangerous that the wannabe terrorist is more likely to infect and kill themselves than cause mass causalities.
It's the equivalent of making pipe bombs at home.
The instructions are out in the public, but that's not a problem because the idiots that make pipe bombs blow themselves up more often than they succeed in doing terrorism.
hgoel an hour ago
Biologists already addressed this idiocy a few weeks ago [1]. Making a biological weapon requires facilities that only some nation states and comparable companies, have access to.
AI isn't going to magically assemble a DNA sequence for you and a computer design is not a guarantee of something that works.
AI restrictionists love to pretend that their toys will, with the power of intelligence, magically bypass fundamental limitations of reality to conjure up fantastical weapons of mass destruction if they throw enough computers at the task. Unfortunately for them, that is not how the world works.
[1] https://www.businessinsider.com/researchers-ai-apocalypse-sk...
sillysaurusx 2 hours ago
I ran into this situation and was able to work around it by running a jailbroken Chinese model that turned out to be quite capable. I think it was Qwen.
akersten 3 hours ago
At minimum we don't have access to "Claude thoughts" like the ones the article highlighted, right? That's part of the hidden reasoning?
mike_d 3 hours ago
I have access to Claude's "defensive" cyber model and it appears to take no issue with the prompt, but I suspect that is because it uses today's publication as the basis for an answer.
In the past my attempts to work on crypto related problems have been met with needing the higher tier of "offensive" access.
jcomp 3 hours ago
Broadly, the downgrading is still way too heavy-handed and clumsy. As of yesterday “How easy to crack is WPA2” downgraded to opus 4.8. Granted I could probably have phrased it differently and gotten a response, but the point is I shouldn’t have to. It can’t simultaneously be smart enough to reverse the ECDSA curve seed and not smart enough not to destroy the world by answering a trivial question with a scary word in it.
petesergeant 3 hours ago
Fable 5.1 has downgraded me in the past week alone for the crimes of describing a coordinating server as "the C&C server" ([cyber]), for doing some statistical analysis on some toy Vigenère-ciphered text ([cyber]), and for asking it to help me find patterns in some semi-random text ([bio]), so it is fair to say I am not skeptical.
antics 3 hours ago
JFYI, this is not true. I do stuff like this all the time.
st3fan 3 hours ago
Anyone can do this kind of work with a model as simple as GLM 5.3 or Kimi K3
randomblock1 3 hours ago
Maybe, but that's what the cyber program is for. Nobody knew if the seed was fine or a backdoor. If it was a backdoor, and Claude helped you find it as a normal person, Anthropic would get bad PR. If you're a verified security researcher, actually that's fantastic and Anthropic would get good PR and everybody claps.
Anthropic wants to IPO, they don't want another Fable shutdown situation.
To be clear I would prefer the cyber safeguards to be less restrictive, I think they're currently too much. I often go to open models because of it. But there are likelier reasons to restrict cyber than world domination.
petesergeant 3 hours ago
> Anthropic would get bad PR
I think the current administration would delight in harsher penalties
areoform 3 hours ago
> Maybe, but that's what the cyber program is for
> and Claude helped you find it as a normal person, Anthropic would get bad PR
Why are we celebrating and encouraging the walling off of the global intellectual columns?
The idea that you can't reverse engineer things, make things, learn about biology or physics without permission is strange to me. These machines have been trained on the sum intellectual output of humanity, the global intellectual commons, and are being used to close off that commons?
I would be OK with their right to create such restrictions if they weren't lobbying the Government to restrict others, thereby ensuring that they control humanity's intellectual commons well into the future.
Who are they to say what I can learn or can't learn? Who are they to control what I can or can't do with these tools?
Perhaps I'm naive, but I think it's better for humans and the machines if we can all think, learn and build. But then again, I'm the kind of person who rejects the doomer pill.
Reject this.
Daishiman 2 hours ago
> The idea that you can't reverse engineer things, make things, learn about biology or physics without permission is strange to me. These machines have been trained on the sum intellectual output of humanity, the global intellectual commons, and are being used to close off that commons?
I mean this is the standard of biochem research right now. You can't just order 50 gallons of TNT off Amazon and neither can you get live viruses from a lab just because you want to do research.
areoform 2 hours ago
OK, so then no problem, why are Anthropic restricting my ability to learn and reason?
pixl97 an hour ago
Because they can and there is no law against it.
And really they aren't restricting any of that. I've never had Claude stop me from going to the library and reading a book.
You don't have a legal right to do anything you want with their model. And if you don't like that you are going to have to convince politicians to enact new laws to change that.
solyin 2 hours ago
Because there are good and bad people in the world, and if I ask Claude "how do I make cocaine" and it gives me a thorough recipe, it doesn't know if I'm being intellectually curious or trying to become the next Pablo Escobar. They're Anthropic, and because they made Claude, they get to say what we can do with it. Which, I agree, is total bullshit. If I buy a Ford car and I can do whatever I want with it. Drive to work, drive for Uber, set it on fire; plowing into a crowd of protestors is covered by existing laws against vehicular manslaughter. Ford doesn't get a say. But because cars are so ubiquitous and a known technology, there's no blowback to Ford if I commit crimes with my car that I bought from them. If I commit crimes and Claude helped, Anthropic is gonna get sued (there's already litigation against the labs for deaths), and they don't want that.
In a properly free market, we'd have regulations that prohibit labs from vertical integration so they have to release and sell a model and another company hosts it and sell access to it. Americanism, America's implementation of capitalism doesn't have such regulations though (and how would that even work?) so we're stuck with Anthropic having that power.
The fear, justified or not, is that a terrorist is going to use Claude to make sarin nerve gas and bomb subway stations, or the digital equivalent. Could you live with that on your conscience? I don't think I could, but fortunately for me, I don't work at Anthropic so don't have to answer that real life trolly problem.
whatshisface 2 hours ago
>if I ask Claude "how do I make cocaine"
I am amazed at how a technical gloss can obscure basic rights. That's legal! It's in chemistry / agronomy books, freely available in libraries. I have the right to tell you how that is done, and you have the right to read what I write.
pixl97 2 hours ago
Because this is how the world works
An LLM isn't a book. You can still go buy the books you want. An LLM, especially as they get more advanced, are agents. You can ask them do to things and they can interact with tools to do things.
You're free to print a cocaine book. You're not free to incorporate it into a cocaine making machine without violating numerous laws.
hgoel an hour ago
You can program a computer to do things and they can interact with tools to do things too. Doesn't justify restricting what you can do with them.
If you program a computer to make cocaine for you, you're the one violating the law. If you ask an LLM to do the same for you, you're the one violating the law. The LLM's capabilities are irrelevant.
pixl97 12 minutes ago
You sweet summer child.
Cool, so I'll have you make an LLM that can make cosine, then I'll provide you paid access to the machine to can ask the right question to do it illegally. Then when you get caught and blame me we'll both be in court defending ourselves.
You're argument is "doesn't justify". This is a private corporation, not a government. There is no freedom of speech law involved here if the corporation says no. Now, when the government tells LLM corporations that there are limits they will gladly agree.
Next, the government will classify the LLMs as munitions and you'll be spending the next 50 years fighting on reversing that when a big chunk of the population is anti-AI enough to let them do it. After that will be bans and registration on hardware.
There are two things that you are confusing. One is what you'd like to happen in an open data world like existed after the cold war. And then there is what is going to happen, and it's going to be messy, authoritarian, and closed. And you will lose the openness that had been occurring up to this point.
There is no world in which the general public agrees to wide open access to info-hazards, and there are people that will ensure enough disasters happen to close that future.
SR2Z an hour ago
You are entirely free to build a cocaine making machine in most countries. It is actually using it to produce cocaine that is a crime.
In reasonable countries, this is exactly how it works. You can own lockpicks, practice picking locks, and even publish detailed instructions on how to pick locks. It's only when you pick someone else's lock that a crime is committed.
Limiting access to tools and knowledge benefits the wealthy and privileged.
selimthegrim an hour ago
I have some bad news for you about what happens if the cops find you with lockpicking tools.
SR2Z an hour ago
You are entirely free to build a cocaine making machine in most countries. It is actually using it to produce cocaine that is a crime.
In reasonable countries, this is exactly how it works. You can own lockpicks, practice picking locks, and even publish detailed instructions on how to pick locks. It's only when you pick someone else's lock that a crime is committed.
Limiting access to tools and knowledge benefits the wealthy and privileged. Knowledge should proliferate, that is how the world has worked long before I was born and god willing that is how it will work long after I die.
charcircuit 2 hours ago
>use Claude to make sarin nerve gas and bomb subway stations, or the digital equivalent. Could you live with that on your conscience?
People have always been able to do this before Claude. The information is out there and if you use a VPN there's not much they can do. The existence of information isn't the blocker for why attacks don't happen.
pixl97 2 hours ago
This is so undershooting of what LLMs are capable of it's no wonder you're thinking they are just like books.
simonra 10 minutes ago
You sound highly optimistic about the capabilities of LLMs, which makes me curious about the path you see to furthering quality of life at scale. What do you see as the main obstacles to LLMs brewing me beer on demand at my home without involving me past the prompt, and when do you foresee we'll overcome them?
sailfast an hour ago
Ford actually will tell you now if you can or cannot do something with their vehicles. They’re also likely tracking you.
That said - there likely were the same issues with cars in early days and then we got a body of settled case law that let the car companies off the hook for this and put responsibility on the user unless a manufacturing defect was the cause.
In the case of models, knowledge has historically always been dangerous! Is the library liable if a kid figures out how to do chemistry and builds a device? What about YouTube? I find it hard to believe this would hold up in court over time. So far, the only cases I’ve seen are when AI has encouraged self-harm which does in fact seem like a legit defect.
Gatekeeping knowledge like this will only serve to enable those that break the law, not protect, in my judgment.
And just so this isn’t pure fodder for the machine - torch staple must of course infant music verb noun right? :)
reassess_blind 43 minutes ago
Because AI-assisted hacking is not something we should allow to run rampant with the most advanced models, prior to AI-assited cybersecurity catching up.
saghm 3 hours ago
> But there are likelier reasons to restrict cyber than world domination.
I mean, greed alone would seem to be enough, and it would be fully worth calling out as bullshit.
landr0id 3 hours ago
>Maybe, but that's what the cyber program is for.
I have been in the cyber program since around the time it first went public and recently renewed it with the updated program.
You still trivially hit guadrails. I was trying to reverse engineer some bit of 20-year-old software that already has known, unmitigated exploits and it still downgraded me.
verdverm 2 hours ago
> that's what the cyber program is for
open weights are the better way imo, no elite gatekeepers please
Retr0id 3 hours ago
I worked on this specific task myself, using Claude, and I was not blocked (although I did not succeed!)
tptacek 3 hours ago
Same!
novia 3 hours ago
A form of being blocked is sandbagging the models
Retr0id 3 hours ago
I saw no evidence of sandbagging. And since it was an open problem, there'd be no reasonable way to "steer away" from the correct solution.
nicce 3 hours ago
Can you be sure that the model was not constrained for you, regardless? Since they can’t help too much with cyber, they might avoid some routes to not get completely flagged and that could influence for not finding the solution.
Retr0id 3 hours ago
I have seen behaviour a little like what you describe, in other tasks. When I was cracking the keys for Sony's camera firmware updates, Claude steered away from an obfuscated library, seemingly because it thought it might be related to licensing checks. It was indeed related to licensing checks, but also firmware update decryption. I had to explicitly tell Claude to write a deobfuscator for it, which it did, and eventually I had the keys.
I later got Claude to crack their licensing checks too, by convincing it to write a "license checker" program, and then a second "test case generator" script for the license checker... (Opus 4.8 was smart enough to see what I was doing, but Opus 4.6 complied)
dogben 2 hours ago
Same. I tried it just a few days ago. This news made me almost jump out of bed.
nxobject 3 hours ago
> moat widening between the model providers, their government partners, and the public.
Part of me wonders whether the NSA/other TLA has either (a) an unrestricted model from a lab with less scruples like SpaceX, or (b) an in-house model, either abliterated or with data they've bought themselves.
jamienk 3 hours ago
I feel like history is repeating itself - to many people AOL, Compuserve, MSN, et al seemed superior to "the web" in the early 1990s because they dumped money into making it slicker, licensed content, provided guardrails, made it easy for non-tech people... They had slick ads, were cultural phenoms, and people would take sides with the companies and think their arguments were strong and even obvious!
novia 3 hours ago
Anthropic gets zero of my money because their favorite word is no. I cannot figure out how to as an individual or a small startup request elevated permissions for the purposes of anything that they think might potentially be dangerous for someone who is not me to access. I have a background in cybersecurity. I have a background in life sciences. Can I put those skills to use to benefit humanity? Who knows.
ceejayoz 2 hours ago
> I cannot figure out how to as an individual or a small startup request elevated permissions…
https://support.claude.com/en/articles/14604842-cyber-verifi...
jiggawatts an hour ago
"No."
Dario keeps saying in interviews that AI hacking is not a problem because "the good guys will protect themselves with AI", but then gate-keeps.
I submitted the form and it was rejected without reason.
Now what?
novia 35 minutes ago
Thank you for the link.
It looks like I will have to pay them to be considered, and even so, it looks unlikely that I'll be approved, since I have no CVEs credited to me, and I do not publicly post about security concerns.
..........................................
The Cyber Verification Program is not available on free plans, so we are unable to approve you for the program.
If your plan changes, you're welcome to apply again at any time.
Regards,
The Anthropic Safeguards Team
..........................................
It has a cooldown of seven days.
WarmWash 2 hours ago
I imagine the path forward for the labs will be signing off on organizations/institutions rather than individuals.
The risk/reward is way lopsided towards risk for the labs to vet individuals. Much easier to get an organization and have them take the blast if someone/something goes off the rails.
I cannot in any universe see the labs putting themselves in a "We should never had given this person access" situation.
arionhardison 3 hours ago
How do you know this to be true? I am not disagreeing; I genially need to understand why or if others are seeing blockers that I don't see or if I am seeing blockers that they do not see.
Are their guardrail benchmarks or anything of the sort that we can use to see where the bifurcation of permission/capability occurs?
lp92 3 hours ago
Compute has always been gated. This is nothing new. If we look at the HPC space, many of the largest clusters were restricted access and used by governments organizations. Even the ones with "public" access, not just anyone could get access to it.
varispeed 2 hours ago
Whenever I say that the rich have access to much more capable and unrestricted models I get downvotes. Yet here we have another example.
Aachen 2 hours ago
> [The model's authors] can do this kind of work with Claude, but if you or I try to do it, we will get blocked.
If this seems concerning, wait until the models get effective enough (gets work done properly at a lower energy need than humans have) that there's no reason for them to release anything. Why offer your weights for download or grant any third party usage access when you can just do the actual job yourself and collect all that turnover?
genxy 2 hours ago
They will just have someone look at every question, they will let it pass, want a cut or deny it. Claude, you can answer this guys question, but don't tell 'em how you solved it and don't give him the best answer, give him an ok answer.
zelphirkalt 2 hours ago
That's kinda unrealistic, isn't it? How will they pay for the thousands or ten thousands of employees, who need to look at every question? And most questions are just ordinary BS, that not really anyone other than the asker cares about. Giant waste of time to check all that.
shrx 2 hours ago
A lesser model can supervise.
exe34 2 hours ago
Why can't Claude do that itself?
pixl97 2 hours ago
Just wait till the AI does that to humans in general.
siva7 an hour ago
That's already happening. The public models aren't anything like their internal models.
toomuchtodo 2 hours ago
This is why open weights and continued model distillation to improve model evolution is imperative.
Do you trust the people who would gate these capabilities? I do not.
pixl97 2 hours ago
I mean I want this to, just don't get your hopes to high because it's not long till they get dashed.
I don't think it will be too long before models are considered munitions and having the weights for one will require registration.
Aachen an hour ago
Which brings us back to the war on general computation. So long as people can have computers that they control, at least in one of the countries or regions, there's no putting this cat back in the bag and we are all along for the ride
Sometimes I want a fast-forward button for life, the times are so exciting and I want to know what else 8B people can think of next but there's so far no way to turn pages faster ^^'
pixl97 8 minutes ago
This is a bit silly.
There are just a few places where the most high tech hardware is made. If we turned off new and unregistered hardware now it would be just a few years as most hardware fast enough to run LLMs would disappear from public hands.
It will still exist, but be in the hands of militaries and authoritarian governments. If you piddle around on the net showing off your open standards you'll be relentlessly attacked by these entities digitally. More so, those areas will be generally embargoed.
The future looks like a new cold war with a lot more digital weapons.
overfeed 2 hours ago
> Why offer your weights for download or grant any third party usage access when you can just do the actual job yourself and collect all that turnover?
It's hilarious how a the trillions invested in AI companies, and their valuations are predicated on the AI labs Sherlocking entire industries, and yet CEOs, mathematicians, and everyone else are eagerly feeding the beast their most prized information.
siva7 an hour ago
What else should we do? It's not like we had any choice.
gspr an hour ago
What? You have the choice of just not. Or if you absolutely must to put food on the table, you don't need to fucking cheer as you do it!
rpdillon an hour ago
This is a risky proposition if the technology is in some way revolutionary. The people who decided to "just not" with, for example, the internet often aren't doing business anymore.
vrganj 34 minutes ago
The internet was inherently decentralized. This is inherently centralizing. The direction of travel is opposite.
lifeisloving an hour ago
French Revolution and the 21st centuries version of guillotines, whatever that could be, is probably a good reason to avoid that.
There's also a thing called commodity fetishism but capitalists usually learn the hard way that things created with machines without human input miss the essence of why we're willing to pay for something. Its why a handmade watch is $100k and a casio is $100, or a handmade sweater identical to a machine made goes for 10x.
They could also just make us so poor and anxious that we beg to fight eachother in wars.
cudla100 an hour ago
Another labor theory of value patient.
lifeisloving an hour ago
Gun to your head, you have to see one of two movies with the same plot and characters. They are identical movies.
One is produced by 500 humans collaborating and the second is completely generated by an AI that can actually make a movie
A single individual or small group of people who own the GPUs profit from the AI version, and the human version provides a salary to 500 humans/families.
Which one are you buying tickets for and choosing to spend 2 hours watching?
Y_Y 25 minutes ago
> they are identical movies
kyrofa 2 hours ago
Open models are just as quick to refuse to do stuff, in my experience.
arcfour an hour ago
Why would you be blocked? I cannot imagine why you would be for this specific task unless the supposed backdoor turned out to be real.
dadrian an hour ago
As much as I dislike the guardrails, they are absolutely irrelevant to this task, and you will not get blocked.
dwedge 28 minutes ago
Moat must have been written more times in the last 12 months than in all of history before that time.
hirako2000 8 minutes ago
For all we know, it may well be a made up story.
Whatever a model says as fact that cannot be falsifiable, it pointless.
They could have generated them off some known data which may still be well kept.
I_am_tiberius 3 hours ago
I find it so ridiculous that they (seemingly) forcefully try to state references to dedicated researchers who devoted much of their lives to the problem, while the LLM does not even know which trained papers were effectively used. That means likely many researchers not listed were heavily influencing this achievement, and Claude does not even know that they helped. And the world doesn't know.
baggy_trough 3 hours ago
Sounds entirely reasonable to me. They tried to give some credit. The main contribution is the solution that Claude came up with.
I_am_tiberius 3 hours ago
> The main contribution is the solution that Claude came up with.
That's an argument that must be infuriating to all researchers who ever published a paper on that topic, because most likely Claude was trained with all of them.
baggy_trough 3 hours ago
I suppose so, but it's still the case.
lp92 2 hours ago
How is that any different from a human that learned from another researcher or paper?
nicce 3 hours ago
Maybe someone already figured it out, but it is well covered somewhere. And Claude just used it. I wonder if we ever know for sure.
tonfa 2 hours ago
Wouldn't they have claimed the bounty?
nicce 2 hours ago
If they thought it to be backdoor, why not sell for some other believer who pays more than the bounty? But anyway, not everyone is after money and fame.
whizzter 2 hours ago
Claude seems to be fairly good at bruteforcing/testing/etc on it's own, it solved a fairly intricate thing while I was busy on other things.
I've adapted a crypto-lib for TLS connections and had a mistake during negotation that truncated some algo-selection value, worked up until the other party started trialling post-quantum algorthims that apparently had algo-id's that collided with the truncated values I was using.
Claude figured out that from the code and trialling TLS handshakes.
Besides, since there was a bounty on finding the curve it seems unlikely that someone would've found out and not shared that? (unless working at a security service that figured out that it was possible to attack?)
howunfortunate 3 hours ago
This happens in academia all the time. You read a ton of papers, chat with tons of people about tons of ideas.
Later you come up some idea, you do the experiment, write the paper, search for relevant citations when you write the intro.
Honestly I think this is actually desirable. For a mind to work well and do things creatively and efficiently it can't be a simple search engine, it needs to blend and meld and reform the information.
And that means the output can't be cleanly deterministically linked to the input. Unless you just keep a log then cite everything you've ever read in your life (and all the conversations and talks too).
theandrewbailey 3 hours ago
I think it's only a matter of time before we decrypt the Voynich manuscript and the fourth message of Kryptos.
https://beinecke.library.yale.edu/beinecke/collections/beine...
sterlind 26 minutes ago
the null hypothesis for Voynich is that it was generated by some random process, like asemic writing, assembling bits from tables and copy/paste/edit. there are some reasons this is plausible (the entropy of Voynich words is low for language, there aren't scribal corrections etc), but fundamentally the "ancient hoax" hypothesis can't be proven, only disproven (since there's so much freedom of choice in generating garbage that it's not a compact explanation.)
so frustratingly, if it is an ancient hoax we can't ever prove it. all we would observe is that we haven't deciphered it, but failing to decipher isn't proof that there's nothing to decipher.
selfmodruntime 3 hours ago
> None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp!
Could they not be both?
lanternfish 3 hours ago
Extremely unlikely - these are very sparse domains.
Animats an hour ago
Somebody must have tried attacking old lost Bitcoin wallets on that basis. But so far those early day Bitcoins haven't moved.
cloudfudge 3 hours ago
Makes me wonder if any implementations will do the cute trick of dispensing with the seed constants and deriving them at startup from the unix timestamps. :)
129-adn 3 hours ago
"It is still conceivable that these curves were selected to have a specific property in principle by searching over timestamps to the random number generator."
Indeed! And we guess that OpenAI was gagged by the NSA because the massive proof dump on Oct. 6th did not contain cryptographic results.
I assume that Anthropic faces similar restrictions, so this seems kind of approved.
solyin 2 hours ago
The conspiracy theory going around the Internet is that they (the AI labs) broke cryptography in some way a la last season of HBO's Silicon Valley, and they're keeping the results under wraps until they can steal Bitcoin out of Satoshi's dead wallets, and then use that to pay for GPUs et al.
sweis 2 hours ago
I have seen nothing that would make me believe there is a "[gag] by the NSA" preventing frontier labs from publishing cryptographic results.
We published HAWK and McEliece attacks no problem.
hoten 3 hours ago
Would it have been feasible for a FOIA to reveal the origin from the primary source?
EDIT: ah, one of the linked authors tried that. They had no documentation on it. https://saweis.net/posts/nist-curve-seed-origins.html
sweis 2 hours ago
Yep.
NIST closed it: https://www.muckrock.com/foi/united-states-of-america-10/ori...
NSA ignored it: https://www.muckrock.com/foi/united-states-of-america-10/ori...
I think part of it is I don't know how to write these FOIA requests in the right way they can comply with it. I think you need to be more specific.
happyPersonR an hour ago
thank you for at least trying :)
starts to rebuild trust at least :)
what's one thing that you can actually talk about out of this that might help people to understand that's getting lost?
ecshafer 3 hours ago
Interesting. So there was no humorous phrase, and its probably safe from backdoors. They do look pretty random.
andai 30 minutes ago
mda5("Sneed's Feed and Seed (Formerly Chuck's)")
egl2020 3 hours ago
Setting aside the use of "an internal research model", how would one go about prompting an LLM to do this?
john_strinlai 3 hours ago
probably something like:
"read this: https://words.filippo.io/seeds-bounty/ then find the solution to the bounty"
ultim8k 2 hours ago
I wait for the morning that we’ll wake up to ssh keys being useless
versooth 23 minutes ago
To be clear, this is in no way close to a cryptographic attack.
reaperhulk 3 hours ago
As one of the original bounty sponsors, I'm thrilled to pay my portion to ISRG. :)
CGMthrowaway 3 hours ago
Why did they specifically skip other apparently suitable curve candidates? The B-163 seed and the base point origins of several other curves are still not explained
IshKebab 43 minutes ago
> Let me be careful about the plausibility: is it suspicious that such an obvious thing wasn’t discovered in 25 years?
Alright Claude no need to rub it in.
ceifa an hour ago
crazy
andyjohnson0 3 hours ago
On the face if it, the big leap here was Claude autonomously envisioning, and deciding to pursue, the "ancient prng + date" angle - - rather than working backwards from the premise of deliberately weakened seeds or some other popular theory. To me that shows creativity, and modelling of the situation and method of the people at the NSA.
So two questions:
1. TFA mentions the "humourous phrase hash" theory, but Claude's trajectory seems to be a long way from that. To what extent was Claude prompted in the ultimately successful direction?
2. Whats with all the "hmm..." in the internal reasoning process log? Do models really do that? And if so, why? Some weird emergent language thing, or just mimicry?
tptacek 2 hours ago
From the video posted upthread, the vibe I get is that they prompted Claude about the bounty and to approach it from first principles rather than building another clone of John the Ripper.
cyphar an hour ago
> 2. Whats with all the "hmm..." in the internal reasoning process log? Do models really do that? And if so, why? Some weird emergent language thing, or just mimicry?
Assuming that is actually the real reasoning trace (open weight model reasoning traces usually do things like switch languages or talk in non-standard English because of model drift, so it's a bit surprising that Claude wouldn't do the same) there was a study a few years ago that found base models produce better answers if you put "take a deep breath" in the prompt[1]. Maybe in the RL training stage stuff like that gets reinforced and because reasoning traces are hidden in RLHF it doesn't get selected out? My money is on it not being the real reasoning trace though.
fooker an hour ago
> the "ancient prng + date" angle
I remember hearing this in a cryptanalysis lecture at some point, so it was not a completely novel theory.
Admittedly I am not finding written evidence of this anywhere.