cryptography

Anthropic announced FlashProve, a provable inference system using zkSNARKs that lets users cryptographically verify they are being served the exact AI model and weights promised, without revealing model weights. Built with Claude's help, it is claimed to be an order of magnitude faster than existing open-source solutions and has implications for model integrity, auditing, and future AI regulation.

推文称整数分解已被确定性地证明具有亚指数复杂度（最坏情况界限），并称关键进展来自 Claude 版本的 ETH 反驳工作。

研究人员发现多个 PDF 实现（如 MuPDF 和 Foxit）在生成 AES-256 文件密钥时使用了极弱的随机性——MuPDF 的密钥仅受 9 比特随机状态影响，可通过暴力枚举实现无密码解密受保护的 PDF 文档。

AdaCore 展示了利用 AI（无需直接人工干预）在 SPARK 中生成经过形式化证明的 AES、SHA-256 和 HMAC-SHA-256 实现，正确性通过四种独立方式验证，呼应 Anthropic 关于 LLM 用于形式化软件验证的研究。

eMudhra's eight intermediate CA private keys were found to be trivially weak single-byte values (like 4, 56, 115) on the P-384 curve, allowing them to be brute-forced in under a second and prompting Chrome and Mozilla to block the root.

Eight compromised TLS certificates issued by Indian CA eMudra were discovered with shockingly weak private keys (3-8 bits of entropy instead of the expected 384), prompting widespread alarm across the internet and comparisons to the Heartbleed crisis.

A detailed write-up on solving T. E. Wood's 1950 'test of survival' cryptogram, published in the Proceedings of the Society for Psychical Research, using a book-based key cipher devised by Robert Thouless. The article explains the cipher mechanics and the search method used to brute-force the key across many books.

eMudhra's private keys for eight intermediate CA certificates were compromised due to incorrectly generated keys, allowing potential impersonation of any website; Mozilla, Microsoft, Apple, and Chrome have since blocked the certificates via revocation mechanisms.

Claude reportedly helped solve a 25-year-old NSA cryptography problem, with internal reasoning logs shared showing the model questioning why such an obvious result had gone undiscovered for decades.

A university lecture (CS 463) explaining how Galois finite fields GF(2^8) underpin the Advanced Encryption Standard, covering field addition as XOR and polynomial-based multiplication for substitution tables.

An internal Anthropic research model reportedly solved the 26-year-old mystery behind the NSA's elliptic curve seed constants in under 30 minutes, with the article showcasing the model's chain-of-thought reasoning.

Anthropic's Claude deciphered how the NIST P-256 elliptic curve seed was generated, revealing it came from a standard lrand48 random number generator run with a timestamp seed — debunking long-standing suspicions of a government backdoor in the widely used web encryption curve.

博客讲述了作者在 GitHub Nomic 游戏中试图利用 merge commit 时间戳进行 timing attack 却被 GPG 签名阻止，最终朋友 Chelsea Voss 通过本地生成并推送无签名 merge commit 赢得游戏的故事。

A tweet claims that Claude figured out the long-standing mystery behind the origin of the NIST elliptic curve seed parameters, revealing they were derived from timestamps.

Anthropic researchers cracked the 25-year-old mystery of how NIST's elliptic curve seeds were generated — they came from the POSIX drand48 RNG seeded with UNIX timestamps, not hashed sentences — claiming Filippo Valsorda's full bounty and donating it to ISRG/Let's Encrypt.

Anthropic 的 Claude 在半小时内破解了长期悬而未决的谜题：NIST ECDSA 椭圆曲线的种子值并非哈希生成，而是由 C 库的 lrand48 随机数生成器以 Unix 时间戳为种子产生，这并非密码学破解，只是解开了数十年的起源争议。

Jeremy Kun 的 CKKS 同态加密教程系列新一篇，讲解密文上的加法与乘法运算（暂不含 relinearization），并附带代码实现。

财新报道：香港出生、剑桥毕业的量化工程师何卓峰（音）被控从前雇主Headlands窃取高频交易策略AP1，并与Tower合作在中国期货市场部署，2025年1月在洛杉矶被捕，纽约陪审团审判已开始，面临最高30年刑期。

A hobbyist reverses a malicious .exe disguised as a South Park episode that Sonarr auto-downloaded from public torrent trackers, uncovering a ChaCha20-encrypted in-memory PE loader, anti-debug/anti-sandbox tricks, and a second-stage infostealer that harvests browser passwords and cookies.

微软研究院发布 Magnetar，一个让 Rust、Go 和 C 程序直接生成零知识证明的通用系统，速度比现有同类系统快 10 到 39 倍，且仅依赖标准哈希函数实现抗量子安全，推动零知识证明走向主流应用。