2026-10-17 23:39:06
NIST published a set of elliptic curves for cryptography in 2000. The seeds for the curves were supplied by the NSA, and cryptographers suspected the agency may have installed backdoors in the curves. And not without reason: the NSA did insert a backdoor in the Dual_EC_DRBG random number generator.
Two days ago researchers at Anthropic [1] showed that the NIST curves were not seeded with a backdoor. The rest of this post will give the background necessary to appreciate this result.
The security of elliptic curve cryptography depends on the difficult of solving the discrete logarithm problem. In the context of elliptic curve arithmetic, the analog of exponentiation is easy but the analog of taking logarithms is hard.
In general it’s not practical to compute discrete logarithms over large elliptic curves. But it could be easy for someone with inside information to compute discrete logarithms if something about the curve was not “general.”
Specifically, the NIST curves have the form
y² = x³ − 3x + b (mod p)
for various values of p [2], and the suspicion regards the choice of b. For nearly all values of b encryption over the elliptic curve should be secure, as far as we know, but in principle someone could engineer values of b to weaken the encryption.
So where did the b‘s come from? Were they chosen in good faith?
Concern over the choice of seeds, the b‘s, grew following the Snowden revelations. Daniel J. Bernstein emailed Jerry Solinas of the NSA on September 6, 2014 asking where the seeds had come from. Solinas replied in subsequent emails. He said the seeds were generated by hashing the ASCII representation of a humorous English message, but he could no longer remember the exact message or the precise hashing procedure.
On October 5, 2023 Philippo Valsorda announced a bounty for reverse engineering the origin of the NIST elliptic curve seeds. Two days ago researchers from Anthropic claimed the bounty. Valsorda verified the results and awarded the prize. It turns out Solinas found the curve seeds in good faith, but his memory had faded over the years since the curves were published. We now know he used a date, not a phrase, as part of the process of constructing the seeds.
The NIST curves have some nice properties, such as enabling some clever tricks for arithmetic in their base fields. But adoption of the curves has been held back over suspicion regarding their origin. Now the curves have been exhonorated. As Valdorda notes
… this nicely completes the “rehabilitation arc” of NIST elliptic curve cryptography, which I would now personally recommend over Curve25519/Ed25519/X25519. Just in time for them to be retired in favor of post-quantum signatures.
[1] This does not imply that LLMs are necessarily a threat to encryption. The search for the NIST seeds required a lot of brute force. Some cleverness was required in order to come up with possibilities to check by brute force, but even that is sorta brute force at a higher level of abstraction. There has been speculation that labs are looking for weaknesses in cryptographic primitives and protocols, but that’s a different matter than searching for seeds.
[2] The curves P-192, P-224, P-256, P-384, and P-521 are built over the field of integers mod p, where the number of bits in p corresponds to the number in the name. The P-192 curve, for example, has as its base field the integers mod 2192 − 264 − 1, a 192-bit prime.
The post Cloud of suspicion lifted from NIST curves first appeared on John D. Cook.2026-10-16 22:37:07
This post began as a thread on X last night. I’ve edited the thread to turn it into a blog post, making some additions and corrections.
I’m watching 2010: The Year We Make Contact. The movie opens saying the monolith is located at the Lagrange point between Jupiter and Io. I got nerd sniped and wondered where that was.
There are five Lagrange points, but presumably the movie refers to L1 or L2 because these are near Io. Lagrange points L3, L4, and L5 are essentially in the orbit of Io, but 60, 180, and 300 degrees out of phase, all far from Io. (The book says the monolith is at L1.)
Lagrange points L1 and L2 are unstable. Maybe this is a plot hole in the movie, unless there’s an explanation coming.
(In general L1, L2, and L3 are unstable. If the ratio of the masses is large enough, L4 and L5 will be stable. More on that here. The Lagrange points L4 and L5 are indeed stable for the Jupiter-Io system. For the Sun-Earth system L1 is moderately stable over a short time span, but L1 is far less stable for the Jupiter-Io system.)
Here’s a plot of the Lagrange points.
Note that L1 and L2 are very close to Io, about 10,000 km from the moon. The L1 and L2 Lagrange points for the Earth-Sun system are not so close to Earth.
(That’s half true. Yes, Io’s L1 point is closer to it than Earth’s L1 point, in absolute distance. But in relative terms, Io’s L1 point is actually further away. I had been misled by seeing an illustration that exaggerated the distance from Earth to L1.)
2026-10-15 01:58:07
When I wrote about the harmonic triangle yesterday, I displayed the triangle left-aligned using fixed-width text because that was easier than producing the format you usually see for Pascal’s triangle and related triangles.
1
1/2 1/2
1/3 1/6 1/3
1/4 1/12 1/12 1/4
1/5 1/20 1/30 1/20 1/5
…
I asked Claude to write a LaTeX package to make it easier to create Pascal-like triangles and it did a great job, including handy features I didn’t think to ask for. You can download it here: numtriangle.sty.
I used this package to create the more attractive display below.
Here’s the LaTeX code that produced the image above.
\documentclass[border=4pt]{standalone}
\usepackage{numtriangle}
\NewTriangle{\Leibniz}{start=1, edges=1/\n, rule=\L - \P, fractions,
format=\displaystyle, xsep=2.8em, ysep=2.8em}
\begin{document}
\Leibniz[rows=5]
\end{document}
I then compiled the code to an SVG file with the following.
pdflatex leibniz.pdf pdftocairo -svg leibniz.pdf leibniz.svg
Bell’s triangle is not defined in a way that the LaTeX package supports, but I can produce the triangle by listing the content. I made the triangle left-aligned rather than centered just to show that this can be done.
The LaTeX code was the following:
\ListTriangle[shape=left]{
1; 1, 2; 2, 3, 5; 5, 7, 10, 15; 15, 20, 27, 37, 52}
Here’s a particularly photogenic image, Pascal’s triangle with odd numbers highlighted, showing the Sierpiński triangle pattern.
The code to produce the image:
\PascalTriangle[rows=16, mod=2, xsep=1.9em, ysep=1.3em,
cell style={font=\tiny, minimum size=1.2em},
highlight style={fill=orange!40}]
The post LaTeX package for Pascal-like triangles first appeared on John D. Cook.
2026-10-14 19:11:11
G. D. Chakerian [1] discovered the following generalization of the Pythagorean theorem.
Take any triangle and attach squares to each side. From each triangle vertex, extend a line perpendicular to the opposite side and extend the line through the square, as shown in the figure below. Then the areas of the rectangles with the same labels are equal.
It’s not clear at first why this is a generalization of the Pythagorean theorem, but if we make our triangle closer to a right triangle it’s easier to see the connection.
As the angle at B becomes closer to a right angle, the area of the orange triangles labeled II goes to zero. In the limit we’re left a theorem saying that the areas of the blue and green squares add up to the area of the square attached to the hypotenuse.
Update: Kirill Osenkov made an interactive version of the figure above here.
The paper [1] caught my eye because it gives a connection between a geometry problem and a circuit problem, much like this post. However, I find the theorem itself more interesting than the connection to circuits.
The first diagram is my reproduction of the first figure from the paper, with color added. I then moved the vertex A to make the connection to the Pythagorean theorem easier to see.
[1] G. D. Chakerian and M. S. Klamkin. A Generalization of the Pythagorean Theorem Seen as a Problem of Equivalent Resistances. Mathematics Magazine, Vol. 59, No. 3 (Jun., 1986), pp. 149–153.
The first line of the paper is “The following result (observed several years ago by the first author) may be viewed as a generalization of the Pythagorean Theorem.” The paper also gives two other sources of the theorem. Presumably Chakerian independently discovered a theorem that was already known.
The post A generalization of the Pythagorean theorem first appeared on John D. Cook.2026-10-14 18:00:22
What’s a connection between Edgar Allan Poe and Friedrich Wilhelm Bessel?
Poe’s story The Pit and the Pendulum describes a pendulum with a semicircular blade being lowered on a cable. This is an interesting variation on the usual harmonic oscillator because the length L of the pendulum is not constant but rather an increasing function of time L(t).
Using the small angle approximation sin(θ) ≈ θ, the equation of motion is
L θ″ + L′ θ′ + g θ = 0.
If we assume the length is increasing at a constant rate, then with a change of variables described in [1], this differential equation becomes Bessel’s equation and its solutions are Bessel functions.
The authors of [1] state that their primary interest is whether a pendulum can have the motion that Poe describes. But as they indicate in their opening sentence,
The study of the motion of a steadily descending pendulum has practical applications (e.g., to the oscillations of a load being lowered by a crane).
A more recent application would be describing the motion of a package being delivered by a Zipline drone.
[1] Robert L. Borrelli, Courtney S. Coleman, and Dana D. Hobson. Poe’s Pendulum. Mathematics Magazine, Vol. 58, No. 2 (Mar., 1985), pp. 78–83
The post Poe, Bessel, and Drones first appeared on John D. Cook.2026-10-13 21:45:18
Pascal’s triangle is the most famous triangular arrangement of numbers. I’ve written about other numerical triangles, such as Bell’s triangle and the trinomial triangle. There’s another well-known triangle that somehow I never heard of until recently: the harmonic triangle, first explored by Leibniz around 1700.
To create the harmonic triangle, start with the harmonic series
1, 1/2, 1/3, 1/4, 1/5, …
This is the first column of the triangle. Next take the differences of the terms:
(1 − 1/2), (1/2 − 1/3), (1/3 − 1/4), … = 1/2, 1/6, 1/12, …
This, shifted down one space, is the second column of the triangle. Taking differences again gives the third column, and so forth. Column c of the triangle consists of the cth differences of the harmonic series.
1
1/2 1/2
1/3 1/6 1/3
1/4 1/12 1/12 1/4
1/5 1/20 1/30 1/20 1/5
…
Each entry is the difference of the entries to its west and northwest. If we let L(r, c) be the element in the rth row and cth column, then
Every numerator is 1, though it’s not immediately obvious why this should be the case. And every number is a value of the beta function, the function that gives the normalizing constant for the beta distribution [1].
[1] Ayoub B. Ayoub. The Harmonic Triangle and the Beta Function. Mathematics Magazine, Vol. 60, No. 4 (Oct., 1987), pp. 223-225
The post Harmonic triangle first appeared on John D. Cook.
