This is pretty cool. It has no bearing on Bitcoin security, but makes for fun lore.
For curves over prime and binary fields, the specifications published a “seed” parameter whose hash value is used to define the coefficient b of the curve. The provenance of these seeds has been a long-standing question, as they were provided by the NSA with no explanation or justification.
As always, the NSA provides fertile soil for conspiracies. In this case:
The best story was that Jerry Solinas, longtime NSA employee, generated the seeds using a hash of a humorous passphrase:“I believe there was a counter rather than multiple hashing, but I don’t know details. The message was along the lines of ‘Give Bob and Jerry a raise’ or ‘Bob and Jerry rule’ or something like that. It was Bob Reiter who actually wrote the code, and he doesn’t remember the details either. Nor were we able to find archives from so long ago. If they exist, they are no doubt sitting on a hard drive near the Ark of the Covenant.”Jerry Solinas, 2015Unfortunately, Jerry died in 2023 and other colleagues at the time were not responsive, leaving open the question of how these seeds were originally derived.
But it seems the reality is pretty ho-hum:
In under half an hour, Claude discovered the origins of the NIST P-192, P-224, P-256, P-384 and P-521 seeds. None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp!
Gregory Maxwell commented on Hacker News:
Interesting story.
I am not a math or cryptography expert but recently (in the past few months) I have lost some faith that SHA-256 will hold up.
How have you lost it? Like... what triggered that?
To me (and I am not a cryptographer either but I have been working in the field since the 90s) it's always been a "everything is secure until it is not" kind of thing. So you want to have options. With Bitcoin, adapting options is probably the hardest thing.
I think the speed of AI "solving" various math proofs has been the cause of the concern.
Right. So I think the signal here, as is basically the signal with everything that AI touches, is that we need to be more proactive, more agile, and most of all, work faster.
The constraints of adapting the bitcoin protocol are in theory lighter than the constraints of disproving the birthday problem as a limit to the maximum induced weakness on a perfect hash function, and thus any gains AI can make in the speed of breaking SHA256 can be easily matched in gains in making the bitcoin protocol more resistant to such weaknesses?
I don't think there is anything here to make me less confident in elliptic curve crypto. I know that there are assumptions in it, and that I'm no math guy, but my grug brain says it isn't broken yet, and the odds of a potential flaw in SHA256 seem as likely as a flaw in any other cryptographic assumption available to us.
This is one of the new Claude 5 things. It fuzzes very often. Yesterday I asked it to review a migration I'm doing on a low-level encoding library, and it created a little fuzzing harness for both versions to see what it did differently. Pretty cool.
According to Claude, this is a result of me having a little phrase in my "review this wip" template that lists
leave no stone unturnedas an acceptance criterium. Which I actually like that it is interpreted that way.Do secp256k1's generator point next please