Crown Sterling
I, the crown prince of Nigeria, offer you Scams 
Hook, line, and sinker 
Totally sounds legit! 
Crown Sterling is a crank company that exists at the intersection of pseudoscience (numerology, Pythagoreanism, snake oil cryptography^{}), and New Age occultism (including, but not limited to, pyramidology). It is a subsidiary of Strathspey Crown, both of which were founded by Robert Edward Grant (c. 1970–).^{[1]}
The company has presented several fraudulent claims about being able to break cryptographic algorithms, and peddled cryptographic snake oil products such as a cryptocurrency and a messaging app.
The prelude[edit]
The beginnings of Crown Sterling revolve around the 24sector dartboard of quasiprimes, that the company's CEO, Robert Edward Grant, has been rehashing ever since he uploaded his PDF "Prime Number Pattern Associated with Icositetragons"^{[2]} online on June 6, 2018.
In the PDF Grant presented dartboard illustrations that reinvented Paul Pritchard's wheel sieve^{} from 1982.^{[3]} In the dartboards on pages 4, 5, and 6, Grant claimed 1 was a prime number and that 2 and 3 are not prime numbers, most likely because reality didn't suit his grift of numerologist woo of perfect symmetry.
Also, perhaps because Grant missed e.g. the theneightyearold Stack Exchange thread on the subject,^{[4]} he deluded himself into thinking he had discovered a basic property of primes, that is, ∀p ∈ ℙ, p > 3: p²≡ 1 (mod 24), that is, every prime larger than 3 squared, minus 1 is divisible by 24. Only, Grant was 2000 years late for the party.^{[5]}
Finally, Grant redefined a subset of composite numbers as quasiprimes, pretended that it mattered, and ended with the following note:
“”Such a discovery may have farreaching implications in the fields of mathematics, physics, chemistry, and cryptography among others.

—Robert Edward Grant (CEO, Crown Sterling)^{[2]} 
The "may have" turned out to be quite shortlived, as on June 21st, 2018, just over two weeks later, Grant was already preaching the implications of the "discovery" and his plans to invent a new cipher to someone named Matthew Belair:
“”I figured out the pattern to be able to determine prime numbers^{} accurately into infinity without any factorization whatsoever. By discovering a different type of prime number[…] called quasiprime numbers. And those quasiprime numbers are [composite numbers divisible by primes larger than 5, and they all have the same remainders as primes when reduced modulo 24].
Now, what's interesting from that, is that [all numbers on that chart that aren't composites], are by definition prime.^{[note 1]} [And we've now proven this with supercomputers and "infinite equations".] And nobody believed me, even my own research team. They're like "This isn't gonna work". I said, "Just run the calculation […] up to ten thousand". And one of my colleagues here, [Talal] Ghannam, says "Aah, Okay, I'll do it. […] he sends me an email like at midnight that night saying, "Holy shit. […] we accurately predicted every single prime under the number 10 000". […] So it exactly sort of proved the theory, and we tested it further over the course of the next few days and published it the next day. And of course, we had every crypto person imaginable like call us up […] We didn't do this so that we could crack cryptocurrency even though every encryption on the planet is tied to prime number indeterminacy. Well, if it becomes determinancy, not indeterminacy, then you got a real problem with all encryption. So we are trying to figure out a way to create a new encryption now, that is fifthdimensional, and I've been working on this for the last couple of days. It's very exciting stuff, and it will be what I'm referring to now as an infinite series of oscillating cryptography. And it'll be infinite. There's not going to be any more like 256bit encryption and stuff like this. We're gonna kill all of it. And none of it is gonna be Primedetermined, either. Because we know that's inherently now weakened because you can predict primes into infinity now. 
—Robert Edward Grant (CEO, Crown Sterling)^{[6]} 
Establishing a unified narrative has been a struggle for the team from the getgo. Deciding on whether the quasiprime "discovery" was important was one thing, but the staff also has been unable to even agree on who came up with the mental dandelion it mattered for cryptography.
Crown Sterling team member Adam Apollo describes the early stages of his relationship with Grant and Crown Sterling in his project portfolio:^{[7]}According to him, he met Grant in 2017, and one year later, after seeing Grant's dartboard, he came up with the insightful idea of "Hey, the RSA cryptosystem^{} uses prime numbers. I wonder if being able to check if a number is a prime can make it trivial to break RSA encryption, you know, because.", and if Apollo is telling the truth, Grant must have jumped at Apollo's brainfart, because according to Apollo, in December of the same year, he was already working for the company, developing what was to become a replacement for modern cryptography.
The preprint peddling[edit]
From the uploading of the dartboard PDF, it took merely nine months for Grant and his coworker Talal Ghannam (a physicist gone crank) to upload the first part of their grift lore, a crank paper titled "Accurate and Infinite Prime Prediction from Novel QuasiPrime Analytical Methodology".^{[8]}
The paper was uploaded to the arXiv preprint server, leveraging the fact Ghannam had previously uploaded to arXiv and could thus vouch for Grant. The paper then somehow passed arXiv's "Is the paper full of Lorem ipsum^{}"filter.
The crank paper itself made two claims:
 The authors had devised an efficient primality test^{} algorithm (that checks if a given number is a prime number).
 The primality test could be used to solve the RSA problem,^{} i.e., factor large semiprimes (product of two large prime numbers) to break the RSA cryptosystem.
In an interview with a fellow numerologist, Grant gave the date the interview was recorded (March 19, 2019), and discussed the implications of the "discovery":
“”We're very excited that Cornell University Press published this just yesterday […] I don't think we know enough yet to know how profound the implication is […]

—Robert Edward Grant (CEO, Crown Sterling)^{[9]} 
Already, Grant couldn't help but lie about the process of academic publishing when he claimed that arXiv preprints^{} are peerreviewed publications. Grant has since made this mistake so many times^{[10]} nobody can say he doesn't know exactly what he's doing.
Grant's answer, about what he thinks the implications of his "discovery" are, had also done a complete 180, but only for a moment: Just two days after the interview, Grant was already doodling away the logo for his company's new cryptosystem in an Instagram post,^{[11]} and just seven days later the product trailer dropped.
The turd breaks the surface[edit]
On March 28, 2019, Crown Sterling pushed out its first promotional trailer to YouTube.^{[12]} TIME AI, the unholy matrimony of numerology and Retro Encabulator,^{} was produced with the ridiculously highquality CGI only VC money can buy. The trailer came bundled with the following word salad:
“”You are unlike any other. A beautifully unique human being, with integral patterns, patterns that become data, data that mirrors who you are, making its ownership and privacy essential to your individuality.
In addition to all of your transactions, messages, and financial account data, today your private inhome interactions, geolocation, and even your own DNA are protected only by a single static encryption algorithm — now recognized by the world’s experts as obsolete. The Fibonacci sequence repeats every 24 cycles when viewed using digital root analysis — a pattern that can be represented with an icositetragonal spiral. By positioning integers in 24 positions for every 360 degrees, Crown Sterling solved one of the greatest mathematical mysteries of all time: Identifying for the first time, an infinitely predictable prime number pattern. These patterns also revealed an entirely new classification of nonprime numbers called quasiprimes, as well as a new understanding of how mathematical constants interact with primes, and quasiprimes, to propagate and mirror reflect in infinite wave conjugations. Academic researchers believe this discovery may be the key to unlocking a new unified physics cosmology, a theory of everything. This new discovery enables large prime factorization using standard computers, thus rendering obsolete all static factorizing encryptions, presently used in public key cryptography. More than ever before, now is the time for a new adaptive encryption granting you security and full control of your digital individuality. A new paradigm of data sovereignty made possible only, with time. TIME AI is an entirely new classification in data privacy called quantum encryption — an impenetrable system utilizing five dimensions of encryption technology. Rather than depending on prime numbers and only a twodimensional static matrix, TIME AI introduces time and highspeed oscillations of infinite wave values of irrational numbers as its encryption modality. Using the infinite variations within music composed realtime by artificial intelligence, TIME AI generates quantum encryption keys as unique as your own iris. Each quantum public key is paired with two quantum private keys that are entangled through mirror symmetry mathematics in value, time exposure, and oscillation speed. These quantum keys change at the nanoscale of time, directed by stateoftheart AI technology harnessing time's entanglement — one key from the past, and one key from the future, changing the number series one billion times per second, with no pattern. The speed of the AI oscillations allow 31,709 years of oscillations in a single second of data authentication. To unlock TIME AI, the future, and the past must converge perfectly in a split second, unpredictable by any known intelligence in the universe. And if ever attacked, TIME AI learns, forever adapting and evolving its defenses through incalculable and infinite variations. TIME AI is a simple, elegant solution that drops easily into any computer or IoT mobile device with standard memory and storage capacities. It is so adaptive, so impenetrable, and so unique to each user, even its own architects cannot break it. This quantum leap in data privacy is the work of Crown Sterling, a team whose mission is to reshape the foundation of encryption, providing total data sovereignty for all. Information privacy is the new frontier of freedom, and Time is your shield. 
—Crown Sterling (TIME AI trailer)^{[12]} 
The emphasized parts highlight lies used as FUD tactics to attack existing established cryptographic algorithms. For context, RSA is not considered "obsolete" because it's weak. The real reason it is being phased out in cryptographic protocols^{} such as TLSv1.3^{[13]} in terms of key exchange,^{} is because using RSA omits an important property called forward secrecy,^{} that protects from situations where an attacker, who gains access to the longterm private keys (that the use of RSA requires), can decrypt massive amounts of data retrospectively.^{[14]} RSA isn't dead, however, as it is still widely used for digital signatures.^{}
The rest of the trailer sold the viewer vaporware^{} that was an anthropomorphic AI — a ridiculous^{[15]} claim in of itself — and timetraveling cryptographic keys.
The video was dissected by Ph.D. student Mark Carney on Twitter on August 9, 2019:
“”
"The world's experts think that the [singular] algorithm is obsolete" Well, no. There are two algorithms that pose a threat, and both of them only work on quantum computers. (Shor's algorithm and Grover's Algorithm) "The Fibonacci seq. repeats every 24 cycles" I don't even know what this means via 'digital root analysis' and I've actually analysed his 'digital root' function. Pass. >.< "Crown Sterling has made a breakthrough" Well, no. mod 24 isn't special, and I showed the general case for this. I haven't found anyone that actually proved the theorem I stated in my paper, but that's because it's a fairly easy application of well established theorems. "New classification of quasiprimes" Errrrrr noup... they're an established thing. See: https://encyclopediaofmath.org/wiki/Quasiprime_number "Primes...something... mirror reflect... wave conjugations..." I'm genuinely not following that. "This unlocks a new physics cosmology  a theory of everything" Well, I mean, only if it's consistent for current models in Physics. you can probably show that 'No' is the answer "Static encryption is obsolete" I mean, since Shannon we've had the idea of 'One Time Pad', so I really don't know where this is going. "Infinite wave values of irrational numbers" WTF? "Entangled in nearsymmetry mathematics" What were they smoking? "Quantum keys... one from the past... one from the future..." I genuinely have no idea what the fuck is going on now. "TimeAI learns..." DUH DUNN DUNN DUH DUNN... [Simplicity is the ultimate sophistication Leonardo da Vinci] *drinks* "TimeAI is a simple (??) elegant" (If you're high) "Even its own architects cannot break it" Well, that's true of any cryptosystem. It's called Kirckhoff's principle^{} "TimeAI fits onto any computer" So he's claiming to be able to do quantum key stuff on classical computers? Nah, sorry, that's not how that works... no qubits, no quantum computations. Likewise, for quantum cryptography, you need some way of generating a 'state' of a particle (usually polarisation of a photon/photons) and then a filter you can vary in order to get a reading. Cf: BB84^{} "Time is key to security" Ok, so, full disclosure, I *literally* helped write a book on timebased security, including a chapterload of maths, for @winnschwartau 's Analogue Network Security. I would like to think my dynamical models, ROC curves, OODA loops and such are a better approach than this... postcrackpipe rambling that I've just spent 4:30 of my life on. I'm prolly a bit biased, though xP 
—Mark Carney ^{[16]} 
Black Hat 2019[edit]
The train wreck of compounding public lies began with the CEO's presentation "The Discovery of QuasiPrime Numbers: What Does This Mean For Encryption?" at the Black Hat conference^{} on August 8, 2019.
The preparty[edit]
For Crown Sterling, the event started with TIME AI preparty^{[17]}, where Grant defined himself as a number theorist and mathematician despite only having a business degree, claimed RSA, elliptic curve cryptography, and the SHA3^{} hash function (yes, really, Keccak), are all based on the RSA problem, and claimed to have created a new cipher during the Christmas break 2018 — which contradicts with Grant's own claims from his interview with Matthew Belair,^{[6]} where he said he had been working on the cipher since midJune, 2018.
Furthermore, Grant spouted numerologist gibberish about nouns and verbs in mathematical syntax, and something about musical, circular geometry, and again claimed he was the first to have discovered that ∀p ∈ ℙ, p > 3: p²≡ 1 (mod 24). Grant also implied Numberphile did a segment on "his" discovery, ignoring the fact the segment was released back in November 2018, nobody in the academia knew who Grant was, and Matt Parker who hosted the episode didn't even mention Grant.^{[18]} Grant then claimed his system could compress an infinite amount of information into a finite memory, that the system uses AI to compose music, and that its public keys express quantum phenomena called quantum entanglement. Finally, Grant promised a consumer, an enterprise, and a government product, revealed they're completely new to the whole thing, and rolled the TIME AI trailer.
The talk[edit]
The next day, during his $115,000 paytoplay^{[19]} talk, Grant presented his dartboard and quasiprime preprint, repeated the lie that preprints on arXiv are peerreviewed, spouted a bunch of numerologist gibberish such as "What we found is that phi is where light emerges from darkness", presented the false claim that DiffieHellman^{} (another key exchange algorithm) was based on the RSA problem, and ended with the TIME AI trailer.^{[20]} The TIME AI "demonstration" that was promised in Crown Sterling's August 7 press release^{[21]} was never performed.
After the presentation, during the Q&A session, cryptographer JeanPhilippe Aumasson told Grant DiffieHellman is not based on factorization but on discrete logarithm problem, cryptographer Thomas Pornin reminded Grant of prior art that was the sieve of Eratosthenes^{} Grant was rehashing,^{[22]} and last but certainly not least, Dan Guido, the CEO of Trail of Bits, called Grant out:
“”
You uploaded that document to a website so you could get it reviewed though. You said you put it on a website that was Cornellaffiliated. And that’s arXiv. That’s like me saying I put information on Google Docs,^{} so Google reviewed it. You're lying! This is a scam! […] It’s a scam, and you’re just using marketing material from this to trick a bunch of people months later, you’ll say you’re legitimate because you spoke at Black Hat. You should be ashamed of yourself, and all of you working for him should quit your[…] 
—Dan Guido (CEO, Trail of Bits)^{[23]}^{[24]}^{[25]}

Grant had underestimated how hated snake oil cryptography^{} is among the practitioners of the field, and his attempt to exploit the prestigious conference caused an uproar.^{[26]} Black Hat organizers realized their mistake and deleted the talk.^{[27]} Shortly after, Grant showed what a good sport he was, and sued UBM LLC, the company behind the Black Hat conference, for breach of contract.^{[28]}
The aftermath[edit]
After the Black Hat 2019, Grant joined the discussion on Twitter and tried to challenge the cryptographer JeanPhilippe Aumasson — who was present in the sponsored talk — into a cracking contest.^{[29]} Cracking contests are a wellknown bullshit method to assess cipher security, and Bruce Schneier^{} has explained it in detail as early as 1998,^{[30]} hence why nobody bothered to explain what was wrong with Grant's proposal,^{[31]} to Grant.
Crown Sterling was given its James Randistyle opportunity when Jake Williams offered Crown Sterling USD25,000 to break a relevant size RSAkey in a controlled setting.^{[32]} Crown Sterling never took on the challenge.
The demands for Grant to publish their factoring methods grew on Twitter, so to avoid the pressure Talal Ghannam tweeted a lengthy (now deleted) post (see screenshot on the right), where he claimed the reason the factoring method was not disclosed, was they were concerned about public safety. Vacillating between positions of desire for full disclosure, or "we have nothing to hide", and on the other hand "responsible" behavior, suited well for the grifters trying to shake off unfavorable attention without admitting they had nothing. This is evident from never following up with promises to disclose the claimed method, and later Grant's complete 180°turn regarding public safety concerns, when he would completely reveal several methods that he claimed to be even more efficient than this one.
To further shake the negative attention, Grant attempted to appeal to people's selfinterest and laziness, by asking people why they cared so much,^{[33]} and by telling them they were wasting their time.^{[34]}
The lawsuit[edit]
Competitors
In their complaint^{[35]} Crown Sterling wept crocodile tears about how infosec experts calling them out was a "premeditated, orchestrated attack […] staged by certain industry detractors and competitors." (paragraph 9), as if discussing the upcoming snake oil presentation was some sort of coordination. The people calling Grant out were not competitors.
 JP Aumasson who at the time worked as the VP of Technology, Principal Research Engineer, and Principal Cryptographer in Kudelski Security, a company that has never competed in the fields of cryptocurrency or secure communication solutions with their own product, but that focuses on security assessment, audits, penetration tests etc. for existing ICT systems.^{[36]}
 Thomas Pornin works as the Technical Vice President of NCC Group, a consulting company that offers services, not inhouse products.^{[37]}
 Dan Guido, who at the time worked as the CEO of Trail Of Bits, only offered consulting on Binary analysis, blockhain security, osquery support, software hardening, and secure implementation of cryptography in client products.^{[38]}
The claim that pointing out glaring factual inaccuracies (such that all public key encryption is based on factorization) that arose during the talk, was detracting, was as ridiculous as the talk itself.
The gold package
In paragraph 9 the company also claimed it purchased the "highest ('gold') sponsorship package". The truth is, gold package wasn't even the highest gold package. There existed four tiers above the one Crown Sterling bought: gold plus, platinum, platinum plus, and diamond packages.^{[39]}
Nonexistent NDAs
In paragraph 11 the company claimed
“”This small group of detractors used this staged “event” to initiate a smear campaign on social media during the conference and immediately after.

—Crown Sterling^{[35]} 
as if the participants of the conference where contractually bound to not discuss, or laugh at the talk afterwards.
Vaporware
In paragraph 15 the company claimed
“”Crown Sterling, a startup company, is developing a novel, nextgeneration information security encryption solution that it believes will supplant the current industry standard RSA encryption platform and usher a new era and paradigm shift in data encryption.

—Crown Sterling^{[35]} 
Despite these claims, the company never published a public key encryption algorithm of its own design. The paradigmshift never happened. TIME AI was never demonstrated in practice, and extremely likely never even written as software. Further evidence of this is, the company only ever used bogstandard public key encryption schemes, such as NIST P521 ECDH,^{[40]}^{[41]} NTRUEncrypt,^{[42]}^{[43]} and CRYSTALSKyber,^{[44]}^{[45]} in all of their actual products.
An industry conspiracy
The company also misrepresented the relationship between industry experts and the ciphers in Paragraph 18:
“”Precisely because Crown Sterling was innovating away from the current RSA encryption standard, Crown Sterling expected some participants’ skepticism. Crown Sterling understood that many of the Black Hat participants are highly invested and entrenched in the RSA encryption model, and that Crown Sterling’s methodology will disrupt that model (which was developed in the 1970s), transforming how digital information will be encrypted and protected.

—Crown Sterling^{[35]} 
Given that the industry has been moving away^{[46]} from RSA for key exchanges since the 2010s global surveillance disclosures,^{} the claims that Aumasson, Pornin or Guido where somehow "entrenched in the RSA encryption model" is ridiculous.
E.g., on July 8, 2019, a month before Blackhat 2019, the Twitter account of Trail of Bits (the company led by Dan Guido) tweeted literally "Fuck RSA",^{[47]} while sharing a link to their blog post under the same title, "Fuck RSA".^{[48]}
The article explained how much the company loves RSA, by opening with the following statement:
“”
Let me save you a bit of time and money and just say outright — if you come to us with a codebase that uses RSA, you will be paying for the hour of time required for us to explain why you should stop using it. 
—Trail of Bits (July 18, 2019)^{[48]} 
JP Aumasson retweeted the tweet by Trail of Bits the same day, adding the following comment:
“”
Good piece about known risks with RSA, but "flat out unacceptable to use RSA in 2019" is too radical IMHO. Someone could probably list ECC failures and write a "Fuck ECC" post. The article for example omits to mention that PSS and FDH are more "misuseresistant" than ECDSA. 
—JP Aumasson^{[49]} 
The documentation for the BearSSL library, written by Thomas Pornin, states that
“”RSA, ECDH and ECDHE key exchange are supported. The ECDHE key exchange offers “Forward Secrecy”, a desirable property by which actual key exchange secrets are transient and destroyed after usage, thereby presumably immune to ulterior theft in case of full machine compromise.

—BearSSL^{[50]} 
Thus, as per Pornin, Elliptic Curve DiffieHellman (Ephemeral key exchange) should be favored over RSA, as it offers forward secrecy.
In conclusion, none of the people who criticized Grant's TIME AI where proponents of RSA.
Crown Sterling also tried to imply RSA was categorically outdated, by referring it to having been created in 1977, where as Crown Sterling would later use a much more modern technology of elliptic curve cryptography described as recently as 1985.^{[51]}
As for whose algorithms would end up being used in Crown Sterling products, fate, it seems, is not without a sense of irony. Crown Sterling later adopted the Argon2 algorithm for its Orion Messenger webapp.^{[45]} Argon2 was established as the defacto password hashing function in the 20132015 Password Hashing Competition (PHC).^{[52]} This competition was initiated by none other than JP Aumasson. Furthermore, Argon2 builds on top of the BLAKE2 hash function,^{[53]} which was designed by — you guessed it — JP Aumasson.^{[54]}
Pay to play
In paragraph 22, the company states
“”Black Hat had ample opportunity to vet the talk. No one from or associated with the Black Hat conference at any time questioned the talk’s subject matter or inquired further about it.

—Crown Sterling^{[35]} 
The truth is, Crown Sterling submitted their talk via sponsored talks, precisely because Black Hat wasn't vetting them. There is no reason to waste $115,000 on a talk, if it could get in with its own merits.
Good men, please do nothing
In paragraph 36 the company states it reached out to Black Hat USA, and
“”asked Black Hat to issue a public statement clarifying its neutral position concerning Crown Sterling’s encryption technology and denouncing the detractors’ abusive actions undertaken on its watch.

—Crown Sterling^{[35]} 
This request for Black Hat to provide higher than deserved validation for TIME AI, an obviously snake oil encryption product (that wasn't demonstrated during the event, and that was never delivered), was ridiculous.
The settlement
On April 20, 2020, BlackHat and Crown Sterling settled the lawsuit.
According to an article in CyberScoop,^{[55]} the terms of the settlement were "confidential", a claim confirmed also by Crown Sterling in their own statement:
“”As part of the confidential settlement, both parties have agreed to refrain from providing further comment on this matter.

—Crown Sterling^{[56]} 
Yet, Grant, the CEO of Crown Sterling, violated the confidentiality of the settlement on his personal Telegram channel on August 19, 2022, by revealing Black Hat had to pay them a settlement:
“”In your face Blackhat!! 🖕 🤣. Too bad you also had to pay us $$$$ in 2020 for your behavior.

—Robert Edward Grant (August 19, 2022).^{[57]} 
Desperate times[edit]
By September 2019, Grant's quasiprime crankery had been refuted, and the company stood in the middle of the PR disaster that was Black Hat.
Twothirds of the company staff had quit. At the end of July 2019, the company had 27 employees on its team roster.^{[58]} After Black Hat, at the end of the next month, only nine of the original team remained. And of those nine, Adam Apollo, Alan Green, and Talal Ghannam had apparently asked to be taken down from the company's online staff listing, as the team roster had only six original members.^{[59]} Two people appear to have joined Crown Sterling's team, but out of those two, Christine Bock doesn't have Crown Sterling listed in her LinkedIn bio, she instead appears to have been a hired consultant from CB Partners.
The Doghouse[edit]
Bruce Schneier's legendary snake oil debunking blog series The Doghouse^{[60]} had made a comeback on September 5, 2019, and the blog post^{[61]} had roasted the company and its key staff to ashes:
“”Crown Sterling is complete and utter snake oil. […][The TIME AI word salad] tick[s] three of my snakeoil warning signs—from 1999!—right there: pseudomath gobbledygook (warning sign #1), new mathematics (warning sign #2), and extreme cluelessness (warning sign #4).
Note the attempt to leverage Cornell’s reputation [in the quasiprime paper], even though the preprint server is not peerreviewed and allows anyone to upload anything. (That should be another warning sign: undeserved appeals to authority.) […] Most of [the quasiprime paper] is wrong, and what’s right isn’t new. […] None of [the people who work for Crown Sterling] have demonstrated any cryptographic credentials. No papers, no research, no nothing. (And, no, selfpublishing doesn’t count.) After the Black Hat talk, Grant — and maybe some of those others […] claimed that the patterns they found in prime numbers allowed them to break RSA. They’re not publishing their results “because Crown Sterling’s team felt it would be irresponsible to disclose discoveries that would break encryption.” (Snakeoil warning sign #7: unsubstantiated claims.) […] […] All of us can create ciphers that we cannot break ourselves, which means that amateur cryptographers regularly produce amateur cryptography. These guys are amateurs. Their math is amateurish. Their claims are nonsensical. Run away. Run, far, far, away. […] Not only is the company ridiculous, it’s litigious as well. It has sued ten unnamed “John Doe” defendants for booing the Black Hat talk. It also sued Black Hat […] 
—Bruce Schneier^{[61]} 
The second to last quote by Schneier, a legendary professional cryptographer and the author of the AES competition^{} finalist Twofish:^{}
“”All of us can create ciphers that we cannot break ourselves […]

—Bruce Schneier^{[61]} 
highlights the cluelessness of Crown Sterling nicely, as TIME AI was marketed with the following intellectual masterpiece:
“”It is so adaptive, so impenetrable, and so unique to each user, even its own architects cannot break it.

—Crown Sterling (TIME AI trailer)^{[12]} 
The RSA cracking circus[edit]
To peddle his snake oil cryptography, Grant first had to create the demand, and that required breaking existing publickey cryptography.^{} During his talk Q&A at Black Hat 2019, Grant had already fraudulently lumped DiffieHellman and its ellipticcurve variant^{} into the same boat with RSA, by claiming both were based on the RSA problem:
“”DiffieHellman exchange is  that's more of the exchange methodology  I think a lot of people refer to that  but yes, it's all based on factorization of prime numbers. Including DiffieHellman, including RSA, including elliptic curves […] AES? No, I'm talking about all asymmetric key cryptography.

—Robert Edward Grant (CEO, Crown Sterling)^{[64]} 
This was a flatout lie, as:
 RSA is based on the RSA problem:^{} Given large public key N, find factors p and q (that make up the private key) such that p⋅q = N),
 DiffieHellman is based on the discrete logarithm problem (DLP):^{} Given common values (generator g and a large prime modulus p), and public key N, find private key s, such that gˢ mod p = N), and
 Ellipticcurve DiffieHellman is based on the elliptic curve discrete logarithm problem (ECDLP):^{} Find the discrete logarithm of a random elliptic curve element with respect to a publiclyknown base point.
With the convenience of that lie, all Grant needed to do was solve the RSA problem. After all, how hard could it be to undo multiplication? What would follow, was several fraudulent claims about Grant and his company being able to factor large semiprimes to break RSA.
The quasiprime paper[edit]
As a refresher, the crank preprint^{[8]} Grant and Ghannam uploaded to arXiv made two claims:
 The authors had devised an efficient primality test^{} algorithm (that checks if a given number is a prime number).
 The primality test could be used to solve the RSA problem i.e., factor large semiprimes (product of two large prime numbers) to break the RSA cryptosystem.
Mark Carney[edit]
The quasiprime paper was originally refuted by Mark Carney in July 2019, a month before Black Hat.^{[65]}
The abstract of the paper states the following:
“”A recent publication by Grant et al. [2] has revealed some innovations with respect to the checking and generation of prime numbers with which to crack cryptographic keys. We argue that their method is minimal, and go on to prove some general cases of the mathematics they present — specifically refuting two of their claims. We also present more computationally efficient methods, and use these as a spring board to refute the existence of any practical efficiency improvements coming from this methodology.

—Mark Carney^{[65]} 
The paper's findings gives Grant's primality test the time complexity of Θ(n  (n/ln n)), where Θ denotes the exact time complexity.^{[66]}
Squeamish Ossifrage[edit]
In their Stack Exchange answer,^{[5]} Squeamish Ossifrage explains what they found in the paper:
“”
In their arXiv draft (which they proudly claim Cornell University published even though anyone can upload a draft to the arXiv with no peer review), Robert Grant and Talal Ghannam:
Earthshattering stuff, I'm sure you'll agree. 
—Squeamish Ossifrage^{[5]} 
Time and space complexity of the factoring method[edit]
On page 5 of the paper, the authors describe the algorithmic steps for "efficient primality testing":
“”
In this paper, we are proposing an exact and fast method for checking the primality of numbers. To do so, we start by checking whether a number n passes the initial primecriteria: being odd, having lastdigit of [1, 3, 7 or 9], and digital root not equal to [3, 6, 9]. Once the number passes the above criterion, n is easily tested to whether it falls along any of the prime moduli of the chosen ssides polygon or not. So, for s = 6, the prime should fall in either modulus 1 or 5. For s = 24, the primemoduli are: 1, 5, 7, 11, 13, 17, 19, and 23, etc. By passing all the above criteria, we have reduced the dimensionality^{[sic]} of the problem considerably. By requiring the selection of only 8 moduli from the total of 24, we have eliminated 2/3 of the numbers’ space that requires search activity. Searching for numbers ending with digits 1, 3, 7, and 9 along these moduli will further reduce the number of possibilities by 1/5. Therefore, the remaining percentage of the numbers’ space we need to search in is around 1/3⋅4/5 = 0.266, less than 30% of the total space. 
—Grant et al. (2019)^{[8]} 
The proposed 15/4fold speedup leads to time complexity^{} of 𝒪 ((4/15)n²), but unfortunately for Grant, in grownups' algorithm analysis, coefficients are ignored as insignificant^{[68]} when evaluating the algorithm's time complexity, and thus, the algorithm still runs in 𝒪 (n²), or quadratic time, which in the industry, is considered nothing short of "horrible".^{[69]} The reason for the quadratic time complexity comes from the algorithm's last step:
“”
Once the number passes all the above, we proceed to the final step; to check whether it belongs to the Qprime grid or not. If the original number n is found within the grid, then it is not a prime. Otherwise, it is a prime by definition. 
—Grant et al. (2019)^{[8]} 
On closer inspection, this seemingly innocuous step turns out to be quite the fine print, as Grant et al. conveniently fail to mention the work required to generate the Qprime grid, and the memory requirements to store it.
The Qgrid and Quasiprimes
In the paper, the Qprime grid is defined as a multiplication table, the horizontal and vertical headers of which contain:
 The required range of primes
 What the authors call quasiprimes, which are defined as composite numbers^{} with prime factors greater or equal to 5.
However, for semiprime factoring (which is what breaking RSA requires), on page 6 the authors explicitly want to remove the quasiprimes from the grid's headers:
“”And because when we search for the prime factors of some semiprime number we need to remove the nonprime numbers from both axes of the Qgrid, like 25, 35, 49 etc., the problem will automatically reduce to simply locating the number in the Qgrid, with its horizontal and vertical projections on both axes being its prime factors.

—Grant et al. (2019)^{[8]} 
Now, the multiplication table only has the required range of primes in its vertical and horizontal headers. The rest of the cells are semiprimes, that are the product of their matching headercells' primes.
The same quote also presents the factoring method: perform a reverse lookup in a precomputed^{} lookup table.
Determining the Qgrid size
The Qgrid's memory requirement depends on the area of the grid, which in turn depends on knowing the number of cells in the grid's headers that form the top and left sides. To know that, we need to know how many valid RSA primes are there, and to know that, we need to know the upper and lower limit for the valid primes.
The smallest and largest header value
The modern RSA key sizes^{} are 2048, 3072, and 4096 bits, and some programs like OpenSSH support even 16,384bit keys.^{[70]}
Since 3072bits is the current recommendation,^{[71]} it will be used below. A 3072bit RSA public key is created by multiplying two 1536bit primes.^{[72]}
The primes in RSA have strict upper and lower limits to their value: For N bit public key, the primes must be greater than , and lesser than .^{[73]}
The number of primes in the header
To estimate how many primes the grid's header cells would need, the prime number theorem^{} states the number of primes below n, is π(n) ≈ n / ln(n).
Calculating the number of all primes up to 3072bit ones, and subtracting from it the toosmall primes (up to 3071bit ones), results in
valid primes to choose from for each key.^{[equation 1]}
Thus, the Qgrid for RSA3072 has sides that are P = 6.6 ⋅ 10⁴⁵⁸ cells long.
Number of cells in the Qgrid
A naive Qgrid would have P² = 4.39 ⋅ 10⁹¹⁷ cells.^{[equation 2]}
Qgrid size optimization
Due to the commutativity^{} of multiplication, a little less than half of the multiplication table is duplicates. The diagonal centerline of the grid's cells has P unique values in it, thus the accurate number of duplicates is (P²P)/2.
The number of cells in the optimized Qgrid is thus A = (P²P)/2 = 2.19 ⋅ 10⁹¹⁷ cells.^{[equation 3]}
Time complexity
The algorithm requires populating the grid by performing at least P = 6.6 ⋅ 10⁴⁵⁸ primality tests to fill the headers. It also needs to perform A = 2.19 ⋅ 10⁹¹⁷ multiplications to populate the grid, and an equal number of search operations to find the factors of the semiprime. These two latter steps both take in the order of n² steps, which means the factoring algorithm time complexity is locked to 𝒪 (n²), which, again, as a classification is considered "horrible".^{[69]}
The computational workload
To put the computational requirement of 6.7 ⋅ 10⁹¹⁷ operations on the scale, Frontier, the fastest supercomputer today^{[74]} performs 1.68 ⋅ 10¹⁸ operations per second, and by the time our Sun dies in five billion years,^{[75]} that supercomputer would have performed a measly 2.65 ⋅ 10³⁵ operations.^{[equation 4]}
Space complexity
Storing (P²P)/2 cells is in the order of n². This sets the space complexity^{} of this algorithm to 𝒪 (n²), which is again, is considered "horrible".^{[69]}
The memory requirement
To keep the math simple yet fair, instead of 3072 bits per semiprime cell, and 1536 bits per header cell, we assume all cells are 1536 bits.
With 1536 bits per cell, the grid requires a meek 4.214 ⋅ 10⁹⁰¹ Exabytes of storage.^{[equation 5]}
Storing 4.214 ⋅ 10⁹⁰¹ Exabytes of data runs into a lot of problems, the most pressing of which is, that there only exists 3.28 ⋅ 10⁸⁰ subatomic particles in the entire observable universe to use as memory,^{[76]} and to put it mildly, that's not enough.
The energy consumption
The Landauer's principle^{} states that the most energyefficient computer the laws of physics theoretically allow must consume at least 2.9 ⋅ 10⁻²¹ Joules per operation. Ignoring any factoring algorithms, just incrementing a counter in a program from 0 to 6.7 ⋅ 10⁹¹⁷, would have to consume at least 5.4 ⋅ 10⁸⁹³ Watt hours of energy.^{[equation 6]}
In comparison, the Sun's total energy output to the space is only 3.86 ⋅ 10²⁶ Watts,^{[77]} which over its remaining, five billion year lifespan, yields "mere" 1.7 ⋅ 10⁴⁰ Watt hours in total.^{[equation 7]}
Wasted effort
Building a complete Qgrid is completely unnecessary in any case. Constructing the grid requires determining all valid prime candidates. During this first stage, for every prime p generated, one can simply perform a trial division on the given semiprime N, to see if N ≡ 0 (mod p), or in layman's terms, to see if the prime p divides N evenly. If it does divide evenly, p has been found, and the other factor is q = N/p. With this method, the space requirement is removed entirely, the computing time spent on computing the grid's nonheader values is eliminated, and no separate search in the grid needs to be performed. As this is essentially trial division,^{} the time complexity improves drastically from 𝒪 (n²) to 𝒪 ( √(n) ).
This, of course, doesn't mean the algorithm can be made practical. Performing P = 6.6 ⋅ 10⁴⁵⁸ primality tests alone exceeds the lifetime of our Sun and the total energy it produces before it dies. Clearly, the authors have never even considered the actual steps required to run the algorithm in full. Alternatively, they knew full well, and they intentionally neglected the Qgrid having the most significant impact on the actual time complexity and pretended that the speedup coefficient of 4/15 mattered.
Misleading prime "prediction":
Crown Sterling has implied the findings of the paper allow "predicting" primes used in RSA:
“” […] Identifying for the first time, an infinitely predictable prime number pattern […] This new discovery enables large prime factorization using standard computers, thus rendering obsolete all static factorizing encryptions, presently used in public key cryptography.

—Crown Sterling (TIME AI trailer)^{[12]} 
This is a lie. When they say "predicting", they don't mean predicting which primes were picked for the private key. They mean "predict" if some number is a prime, i.e. "primality testing". Primality tests are used in RSA key generation, where the system generates large random numbers and checks their primality.^{[78]} If an RSA key generation algorithm could break RSA, cryptographers "probably" would have noticed it. This is why Apollo's early pitch^{[7]} to Grant regarding primality tests influencing RSA security was so stupid.
As was shown above, the pool of valid RSA3072 primes has 6.6 ⋅ 10⁴⁵⁸ primes to randomly choose from.
Even with an efficient primality testing algorithm (such as the LucasLehmer primality test^{}), being able to test if some number belongs in that pool of valid primes, doesn't help in any way to guess which two primes were picked at random from the pool.
Guessing the primes is 5.73 ⋅ 10³⁸¹ times harder than guessing the AES256 key that was delivered using RSA, and that's used to protect the data in transit.^{[equation 8]}
In layman's terms, the claim of predicting primes is exactly as useful for breaking RSA, as "predicting" if 72 is a valid number for a Powerball lottery ticket, is useful in winning the lottery itself. By knowing one is only supposed to guess numbers between 1 and 69, they're no longer guaranteed to lose, but they still need to beat the odds. Only with RSA3072, the probability of guessing the primes, is comparable to winning the Powerball jackpot (1 in 292,200,000),^{[79]} 55 times in a row.^{[equation 9]}
The "results"[edit]
Page 6 of the paper discusses the socalled results:
“” The algorithm is programmed based on the search criterion we mentioned earlier along with other supporting conditional statements that exploit the properties and geometry of the Qgrid such that the search is both effective and optimized. This has already been achieved by the team at Crown Sterling located in Newport Beach, California. The results were excellent, in terms of accuracy and speed, and were achieved by deploying laptops and desktops with standard specifications and computing power.

—Grant et al. (2019)^{[8]} 
As the emphasized section shows, Grant and Ghannam have not even bothered to fabricate results for the paper. "Trust me, bro, the results were excellent" is the opposite of what an academic paper provides, and given that even kids at elementary school know answers such as "nuhuh, not telling" gets them an F from any exam, it doesn't take a rocket scientist to know whether Grant's preprint would have passed an actual academic peerreview.
The aftermath[edit]
After the Black Hat conference, Grant tweeted about claimed improvements:
“”Dan Guido and Mark Carney you may have both missed my comment yesterday that our prime factoring efforts leveraged the icositetragon geometry, however, in the process we identified algebraic/geometric equation approaches, which we have not released, none require indexing.

—Robert Edward Grant (CEO, Crown Sterling)^{[80]} 
Just under three weeks later, Grant announced on Instagram these claims were being written out by Grant and Ghannam as a paper, titled "GeometryBased Prediction Algorithm of Semi Prime Numbers". The abstract blathered something about the "Qgrid matrix method", but the paper was never completed, most likely because Grant and Ghannam knew they were full of shit.
Further proof of this is Grant and Ghannam's book Philomath^{[81]} that was released almost two years later in 2021, that after rehashing what the quasiprime paper^{[8]} said, states
“”Now, if the number n resides along or close to the reflection line of the Qgrid, then primality confirmation is simple. We only need to look for numbers at or close to
√(n) on both axes of the grid. These two numbers will define two small strips that intersect on a small area where we need to look for this number. Beyond this area, numbers either get larger or smaller than n. On the other hand, if the number n is far from the reflection line, then solving the problem requires more complex analysis. Thus, devising algorithms that can search for these numbers without the need to calculate large portions of the Qgrid is an important step in refining and optimizing primality confirmation results. Similar to the case of primality testing, performing prime factorization using the Qgrid method requires the implementation of a search algorithm that is programmed based on the search criterion we mentioned earlier, along with other supporting conditional statements that exploit the geometry of the Qgrid. The problem's geometrical aspect will be explained further in Part III, where we discuss the many interesting and novel methods we have discovered in the process, which in return, rewarded us with so much insight into not only this specific problem but into so many aspects of the physical reality as well.

—Grant et al. (Philomath, 2021)^{[81]} 
Part III discussed not the "Qgrid matrix method" but weird "Quadrant Symmetries", discussed quasiprimes that the authors had previously said have no place in the Qgrid for semiprime factoring, showed that summing numbers produce sums of said numbers, threw in the words North and South, went into a tangent about quadrants of a unit circle^{} and after hoping the reader had forgotten about what they were promised, ended with
“”
All the above hints to an evident conclusion: that numbers are geometric in nature, and their affinity to circles is most obvious. Their real powers, properties, relationships, etc., are observed and make sense only when they are distributed circularly instead of linearly. This is something we observed early on in the Dspace, as only when numbers are distributed around circles that their numeric symmetries and relationships become readily apparent and meaningful. Therefore, it makes no sense to separate numbers and geometry from each other; they should always be studied together as a coherent entity. It is only through this geonumeric domain that scientific mysteries can be discovered and solved. 
—Grant et al. (Philomath, 2021)^{[81]} 
No "Qgrid matrix method" was ever presented, the authors never presented an efficient way to factor semiprime numbers with the Qgrid, and the Qgrid of semiprimes was never mentioned again in the book (although the authors reused the term "Qgrid" later in another context).
Most of the concepts that were in the "improvements" of part III of the book, were already present in Grant's PDF "Quaternion Symmetry Inherent to the Icositetragon"^{[82]} that he had uploaded online back on July 6, 2018.^{[83]} This begs the question: If Grant already had the supposed improvements one year before Black Hat 2019, why didn't he include them in the presentation? Why did he come to the conference with a method that has quadratic (worthless) time and space complexity, and then pretend he was doing active research on the topic when he had eight months to add the supposed improvements to the crank preprint he uploaded to arXiv? Why didn't the preprint even mention a workinprogress regarding the Qgrid matrix method? The simple reason is Grant is making it up as he goes, and he knows his marks don't factcheck him, ever.
Summary[edit]
In summary, the described factoring method is a trivial reverse lookup in a massive table called the Qgrid. With relevant, average size RSAkeys (3072bits), Qgrid's
 𝒪 (n²) time complexity means the time requirement exceeds the clock counting to the death of our Sun,
 𝒪 (n²) space complexity means the observable universe doesn't have enough particles to use as the memory for the grid, and
 Table population and search both have an energy requirement that is more than a perfect Dyson sphere^{} could collect from our Sun during its remaining lifetime, to feed the most energyefficient computer the laws of physics allow.
The algorithm's claimed speedup factor of 15/4 is so small it is ignored in the bigO notation.
In layman's terms, with modern key sizes, the size of the problem is comparable to being tasked with eating an entire pizza the size of Milky Way,^{} our galaxy. Grant and Ghannam boasting that with their algorithm, one only needs to eat 4/15 of it, isn't exactly helping. Nobody has a belly big enough for the cosmic Margherita slices.
The later Qgrid matrix method that was claimed to cut the size of the original pizza was unfortunately for Grant, never backed by anything, and as Hitchens's razor states, that which can be asserted without evidence can also be dismissed without evidence.
The medicine show[edit]
After the refutal of his preprint, the Black Hat PR crisis, Schneier's searing article, and staff quitting Crown Sterling, Grant had to turn the tide. And he had a plan to crack RSA once and for all. On September 19, 2019, Grant hosted a medicine show^{}^{[84]} for the press and nontechnical men in suits. During the show, Grant and the company representatives factored a 256bit RSA key with a program the company had titled the CS BiPrime Algorithm (ver. 1.1).
Plagiarism[edit]
Unfortunately for Grant, the demonstration video^{[85]} showed how Grant's team had botched their efforts to suppress all Infomessages from the CADONFS program^{[86]} they plagiarized, as one of the messages, which is verifiable from the CADONFS August 2019 source code,^{[87]} popped onto the screen:
Info:root: Set tasks.threads=32 based on detected logical CPUs
This of course was noticed immediately the next day when the video went live.^{[88]}
Clearly, all Grant needed for success was an open source program, like CADONFS borrowed from its developers, and the idea of using someone else's technology to advance his grift, that he borrowed from Theranos.^{}
Furthermore, on the video,^{[85]} one of the team members claimed the factoring was being done on the local device, that was an Apple laptop. However, judging by CADONFS output, the laptop apparently had an impossible amount of 97GB of RAM, and the team also managed to botch hiding the fact they used SSH^{} to remotely connect to a beefier computer for the semiprime factoring.
Records from the Soviet age[edit]
During the event Grant and his team factored a minuscule 256bit RSA key, hoping the layman would not understand the difference between asymmetric and symmetric key strength, and incorrectly associate the 256bit asymmetric RSA key they broke with 256bit symmetric encryption (a key size often handwavily labeled as “militarygrade”). The industry experts immediately passed warnings to journalists about the obvious attempt to mislead.^{[90]}
In reality, to break a key with 256bit level symmetric security, Crown Sterling would have needed to factor a 15,360bit RSA key.^{[91]}^{[note 2]} Such an attempt would have been unlikely to succeed, given that based on the public RSA factoring records,^{} none of the people who are not lying, have publicly factored any RSAkey larger than 829 bits.
To put breaking a 256bit RSA key in 2019 into the right context, a much larger, 330bit key was broken by Lenstra et al. slightly earlier, April 1991 to be exact.^{[89]} Coincidentally, Lenstra happens to be part of the team that created the GNFS algorithm,^{[92]} that Grant plagiarized during the medicine show.
In fact, the key size is so weak, breaking it was used as a quick, beginner friendly, intermediatelevel assignment in the CUCTF Capture the Flag^{} event just weeks later.^{[93]}
“”I recently watched this amazing youtube video by Crown Sterling. They showed an advanced algorithm, the Crown Sterling BiPrime Algorithm (ver. 1.1), that was capable of cracking 256bit RSA keys in under a minute. Now you have to implement it if you want to have any hope of cracking my secret message in time! Don't forget to merge and remove duplications after checking your disk space!

—CTFtime team (CUCTF 2019).^{[93]} 
The assignment was so easy it was rewarded with only 150 points. The more challenging ones were awarded 600 points each.^{[94]}
On Crown Sterling's video, it takes 51.92 seconds to factor the 256bit semiprime
83473593554391843334619428139045661537976651941410655062632649869770538548577
Cursory experiments show a relatively new, midprice AMD Ryzen 7800X3D CPU factors the same semiprime with CADONFS in 44.67 seconds, even though it has half the number of threads compared to Crown Sterling's server they ran CADONFS on. Thus, the only logical reason for Crown Sterling to call the press to watch them do something anyone's workstation can do in the same time give or take a few seconds, was to mislead the audience.
These secondscale differences are as insignificant as the key sizes Crown Sterling broke, but they do show a decent desktop computer is already factoring semiprimes faster than the system in Crown Sterling's clown show did, and yet, the world keeps spinning. The secondscale differences did matter to the grifters though, who were desperately trying to get any positive press.
After Black Hat 2019, Grant had tried to challenge JeanPhilippe Aumasson not just into cracking their cipher, but also into a competition about who could break a 512bit RSA key the fastest.^{[95]} The medicine show and its plagiarism shows Grant was hoping to change the public topic on Twitter from the relevant "who has the best algorithm when its time complexity is analyzed by experts on paper", into "who can afford the most expensive AWS EC2^{} instance to run the CADONFS on". When problem sizes approach the size of modern cryptographic key spaces, even a modest time complexity change affects the algorithm runtime by astronomical units of time. Competing over seconds in results is thus pointless, often within the margin of error, and always governed by computing power. No wonder nobody wanted to entertain another of Grant's PR grifts.
The absurdity and the obscene levels of crankery in the medicine show naturally led to the infosec community roasting the fudge out of the company on Twitter.^{[96]}
Reciprocal factoring[edit]
After facing ridicule over the medicine show, Grant must have realized it was too late to convince the academia and industry, as he opted to publish his RSA factoring "algorithms" on the respected journal of Instagram wall.
On September 22, 2019, three days after the medicine show, Grant revealed on Instagram he had already put his business degree to good use and designed a replacement for the General Number Field Sieve (GNFS),^{} the world's fastest classical factoring algorithm he had just plagiarized:
His idea was to find prime factors p and q of semiprime N from the decimal expansion of the semiprime's reciprocal, 1/N.
Impossible time complexity
As the (lower) screenshot shows, Grant claimed the algorithm has an interesting property:
“”Paradoxically, the longer the BiPrime you desire to factor, the easier to locate the long consecutive prime string embedded within its 1/x reciprocal value.

—Robert Edward Grant (CEO, Crown Sterling) 
Having solution complexity be inversely proportional to the size of the problem is the kind of claim a numerologist, who believes in literal magic, would make. Grant is essentially making the claim the algorithm runs in 𝒪 (1/n), which is faster than 𝒪 (1), or constant time, which happens to be the best possible time complexity classification for any algorithm.
As any meaningful algorithm cannot get faster as the input grows,^{[97]} this claim was so stupid it broke Hitchens's razor. Yet, that did not stop Grant from applying for a patent for this crankery,^{[98]} in the hopes of drawing authority from an established institution, and attracting investors with more money than sense.
Minuscule keys
In an Instagram comment Grant claimed the method could break large RSA keys.
No exact definition for large was made, but it's definitely less than six inches, since in Grant's YouTube explainer,^{[99]} he says it works with keys that are "32bit and all the way out". In Grant and Ghannam's book Philomath (2001),^{[81]} Grant reveals they were able to find prime factors for 24bit semiprimes, and in his document on reciprocal factoring^{[100]} Grant et al. state they have limited their studies to "32bit semiprimes at maximum".
No explicit claims of finding factors of relevant size (2048bit or larger) semiprimes were presented. Grant's YouTube crankery video^{[99]} implied 2048bit keys, but with that Grant stumbled and hurt himself badly with the shards of Hitchen's razor.
This did not stop Grant (and the coauthor Ghannam) from blatantly lying about the origin of the factored semiprimes in their book Philomath, and thus from giving the semiprimes false credibility and their size ridiculously exaggerated importance:
“”After succeeding in finding the prime factors (one or both) for almost all 12bit semiprimes, we randomly tested 4,027, 24bit public keys provided by the RSA official website.

—Grant et al. (Philomath, 2021)^{[81]} 
The claim that the RSA official website had 24bit RSA keys is a complete lie: the smallest number ever hosted on the RSA Laboratories website was RSA576,^{[101]} the range of RSA factoring challenges started from 100 digits,^{[102]} and the smallest RSA challenge, the RSA100,^{} had a 330bit public key.
Lack of functional correctness
In his YouTube video,^{[99]} Grant claimed the algorithm only works with numbers whose reciprocal's decimal expansion is periodic. However, this is a lie, as e.g. 1/(11⋅13) = 0.006993… is periodic but does not contain the prime factors 11 or 13, as pointed out by the user Squeamish Ossifrage in their Stack Exchange answer.^{[5]} The algorithm therefore does not work reliably, even with small numbers.
Nonexistent efficiency
In his Instagram post, Grant implied the prime factors can be found relatively close to one another, implying the method is highly efficient in stumbling upon the prime factors. However, as explained^{[5]} by Squeamish Ossifrage:
“”The period of the decimal expansion of 1/pq for prime p and q is , which is usually not much smaller than pq. If we model the expansion as a uniform random digit string pq (not log₁₀ pq, but pq) digits long, what's the probability of finding particular a digit string, namely p, in it? The expected number of times that any particular mcharacter needle appears as a substring of a uniform random hcharacter haystack in a bsymbol alphabet is (h − m + 1) b⁻ᵐ (proof: exercise for reader). Here and h ≈ pq, so this is about Cursory random experiments suggest that this is a reasonable model for the substring search, and I know of no theory that would suggest otherwise; it is up to the fraudsters to put up or shut up if they can prove anything better than this.
In other words, in this model, there's a reasonable probability that the method works if you're willing to search through about (say) 2¹⁰²⁴ possible candidate factors of the 2048bit semiprime in question. Which, as it happens, is essentially random trial division. The fraudsters make it look easy by showing a screenshot with the answer already highlighted in a selectively cropped fragment that skipped over thousands of digits — about as many digits as the value of the numbers we're searching for. 
—Squeamish Ossifrage (2019)^{[5]} 
Thus, not only does Grant's WolframAlpha screenshot show he has no idea how to implement his algorithms as programs, but it also shows his nonexistent Photoshop skills to cover his lie.
Furthermore, by resorting to random trial division, i.e. monkeysbangtypewritersuntilHamletcomesout technology, Grant reveals he has failed to understand the purpose and time complexity of bogosort^{} (bogosort = bogus+sort). Always a strong sign of expertise when someone comes up with a proposal for an algorithm the equivalents of which are used in the basic literature of the field and Algorithms 101 college courses, as an example of the worst possible algorithm, and thus as a cautionary example of what one should definitely not do.
Summary
To summarize, after facing humiliation for factoring 256bit keys 28 years too late, Grant decided to downgrade his CADONFS supercar into a soapbox,^{} and factor 32bit semiprimes with an algorithm that doesn't always work, that runs in 𝒪 ( √(n) ) which with RSA3072 requires ridiculous 2¹⁵³⁶ operations,^{[equation 10]} and that by the definition of bogosort class of algorithms, makes exactly zero effort to intelligently solve the semiprime factoring problem.
Pythagorean factoring[edit]
On Christmas Eve, 2020, Grant uploaded his third poke at breaking RSA: the Pythagorean factorization method.^{[103]}
The claims
In his post, Grant's claims reached an entirely new level of crankery:
“”Prime FactorBased Encryptions (both RSA and ECC which are used by Bitcoin wallets […] is now rendered useless BEFORE the advent of powerful Quantum Computers due to a Right Trianglebased CONSTANT time mathematical solution. […] We were able to both immediately and successfully factor 1,000 Public Key values of various lengths/sizes.

—Robert Edward Grant (CEO, Crown Sterling)^{[103]} 
The excerpt highlights three claims:
 Grant fraudulently claimed his novel method of semiprime factorization could break not just RSA, but also ECC. However, as was shown above, elliptic curve cryptography is not based on the RSA problem. No example of breaking any size ECC key was given, most likely due to Grant having again cut himself with Hitchen's razor.
 Grant also claimed he was able to factor keys of "various lengths/sizes",^{[103]} but he was somehow unable to specify the relevant part, the size of the keys. Factoring 1000 minuscule keys is of no significance. Factoring an unfactored large key from the pool of RSA factoring challenges,^{} would be. On April 8, 2022, Grant claimed on Telegram they had been able to factor public keys with p−q>10¹³⁰⁰, which is what an 8700bit RSA key would have.^{[104]}
 Last, but certainly not least, Grant made the fraudulent claim the algorithm runs in 𝒪 (1), or constant time, which is nothing short of impressive, given that not even Shor's [quantum] algorithm,^{} the bane of RSA, runs in less than 𝒪 (72(log N)²).^{[105]} A constant time algorithm solves a problem regardless of its size, in the exact same number of steps. Thus, Grant claimed to be able to factor any size semiprime, i.e., break any size RSA key, in the same number of steps.
The implementation
In his article Grant reveals that he used what he called the "Pythagorean Calculator",^{[103]} implemented in Microsoft Excel of all things.^{[106]} Always a solid sign when someone who claims to speak eight languages,^{[107]} struggles with learning a single programming language, a core tool for anyone implementing algorithms they design.
Grant left his reader base on the sidelines by not publishing the Excel document, but he did publish a ridiculous illustration with no beginning or end, presumably drawn with Microsoft Paint.^{[108]} Even so, the image conveys enough information to fully implement Grant's trivial algorithm. Below is one implementation, written in just fourteen source lines of Python:
import math
def pythagorean_factorization(semiprime: int):
B = math.sqrt(semiprime)
r = math.ceil(B)  B
x = 0
while True:
# Solve leg A with the formula in Grant's image
A = math.sqrt((x+r) * (2*B+(x+r)))
# Note: Grant's 'readytouse' formula is
# missing the square root used above, but it
# is present in the bottom right of the image,
# where A=24 is obtained with sqrt(576).
# Solve the hypotenuse with the Pythagorean theorem
C = round(math.sqrt(A**2 + B**2))
# Prime factor candidates
p = round(C  A)
q = round(C + A)
if p * q == semiprime:
print(f"The factors of {semiprime=}" \
f" are {p=} and {q=}." \
f" Factoring required {x+1} steps.")
return
x += 1
pythagorean_factorization(12193)
The results
Running the implementation reveals that factoring 12193, the 16bit example semiprime Grant used in his weird Microsoft Paint implementation of the algorithm, requires 3 steps, that is, iterations of the whileloop. A cursory experiment of a slightly smaller semiprime 11379 shows it requires 1,792 steps.^{[program 2]} Having the factoring of a smaller semiprime take 597 times more steps, reveals Grant's algorithm runs in anything but 𝒪 (1), i.e., constant time.
Grant knows the number of steps varies, but as is typical with grifters, he has hidden this fine print in one of the images of the announcement,^{[109]} where the notation "x=1,2,3,4,5,6,..." reveals he expects x to get iterated (as it does in the implementation above), but Grant fails to acknowledge doing so completely voids the constant time claim.
More plagiarism
Closer inspection reveals Grant's algorithm runtime depends on the distance of the prime factors. Grant's algorithm thus appears to be merely a numerologist's rehashing of the 380yearold Fermat's factorization method.^{} In fact, when compared with properly generated keys, the two algorithms take identical number of steps, regardless of key size.^{[program 3]}
On September 25, 2021, nine months after the Pythagorean Factorization Algorithm was uploaded, Grant et al. uploaded an article titled "The Sum Product Conjecture"^{[110]} where they "rederive Fermat’s factorization identity^{[}sic] through a geometrical approach.", and "exploit its Pythagorean triangle configuration to investigate the relationship between the sum of two numbers and their product." Apparently taking credit for the work of one of the greatest mathematicians in human history^{[111]} was too much for even someone like Grant. This however, did not prompt Grant to issue corrections in the original upload,^{[103]} where he would give credit to Fermat, and where he would retract the absurd and obviously false claims about the time complexity.
The 𝒪 (1) lie
Fermat's factorization method time complexity is governed by the distance of the two primes, and its time complexity is .^{[112]}
With random primes, i.e. in the normal case, the method runs in 𝒪 ( √(n) ) time.^{[113]}
The 2023 paper by Shatnawi et al.^{[114]} states on page 7 that "N can be factorized in 𝒪 (1) if the [prime factor] difference is small". On page 9 the exact formula for the constant time bound is given:
"N can be factorized in 𝒪 (1) when p³ − 2p²(q+1) + p(q²+1) ≤ 2N where p>q."
Thus, Grant's claim for 𝒪 (1) time complexity is a lie. 𝒪 is used to denote the upper bound, i.e., the worstcase scenario.^{[66]} Since Fermat's factorization method Grant was rehashing runs in constant time only in the best case, i.e. when pq is within the constant time bound, the correct marking for that constant time lower bound with random keys, is Ω (1), not 𝒪 (1).^{[66]}
In layman's terms, the distinction between these two is not exactly a nuance. In the context of the Powerball lottery, the Ω (1) means in the best case, one could win the lottery, whereas 𝒪 (1) means one is going to win it every time after a small fixed number of tries, no matter what.
A rigged challenge
Because of the absurdly efficient bestcase scenario of Fermat's algorithm, Grant was able to rig his semiprime factoring demonstrations. By choosing semiprimes with the prime factors close enough to one another, any size semiprime, even ones that match the size of modern RSA key sizes, seems to factor in constant time. This rigging can not be detected just by observing the semiprime. It can only be done after the factoring has been done, by seeing if pq is within the constant time bound presented above. The illustration serves as another layer to hide this. A stepbystep analysis^{[illustration 1]} of the MS Paint implementation, shows how the work has been done beforehand, as the illustration has the value of x prebaked into the image. Similarly, Grant presented his Excel calculator (on a nowdeleted video) with small enough numbers his computer could fill the Excel document cells faster than the human eye can see, which then allowed Grant to imply all values of x are calculated at the same time, and not cellbycell.
It however turns out, that with real RSA, there are no rigged challenges, and there is no Ω (1) case.
The attack that never existed
On page 9 of the original RSA paper (1978), the authors Rivest, Shamir, and Adleman state:
“”To gain additional protection against sophisticated factoring algorithms, p and q should differ in length by a few digits[…]

—Rivest, Shamir, Adleman (1978)^{[115]}

The dangers of the primefactors p and q being close to one another was thus known by the RSA authors before RSA was published, and the attack never existed for properly implemented systems.
The required checks for prime distance are usually expressed as , and are present in both the modern implementation requirements,^{[73]} and modern cryptographic libraries.^{[116]}^{[117]}
This hasn't prevented inexperienced programmers from implementing their own naive, and thus vulnerable, RSA key generation programs. Fermat's algorithm has been used as recently as 2022, to break certificates of Canon and Fujifilm printers, as well as four random PGP keys.^{[118]}
But broken novice implementations do not mean RSA is broken. They only mean Grant either never even bothered to read the then41yearold paper, or he read it and decided to append his grift lore with another lie.
Summary
A bit over a year after constructing his soapbox to replace his CADONFS supercar, Grant spent his Christmas Eve 2020, riding a Berlin carriage^{} he stole from the Musée Fermat.
With fraudulent claims to be able to
 Break ECC, yet never back up that claim with anything,
 Factor 8700bit RSA keys, yet only factoring a 46bit RSA key, that was rigged with small prime factor distance, and
 Factor any semiprime in 𝒪 (1), or constant time, yet to have the algorithm turn out to be Fermat's factorizing algorithm with a fresh coat of paint, and that runs in useless 𝒪 ( √(n) ) time, as the Ω (1) bestcase Grant boasted about, was identified and mitigated by the authors of RSA back in 1978, before RSA was published,
Grant rode around until he noticed the license plate wasn't his, and then proceeded to tell all about it in his article "Horse Carriage Conjecture", where he investigated the relation of the cart wheel's diameter and circumference, and rederived Pi.
Geometric factoring[edit]
It's simple, we draw the primes
As his fourth RSA cracking napkin math example, Grant shared his crank geometric factorization equation on Telegram, on April 7, 2022. The crank equation wasn't even an algorithm, but a geometric equation, and Grant's proof was anything but proper algebraic geometry.^{} It was a class example of "proof"byscruffypicture. It implied any large RSA public key or semiprime could be factored simply by creating an image where the hypothenuse of a rightangle triangle would cross some points.
Scaling issues
A common theme with Grant's grifts is, that the presented methods appear to work, but only do so with tiny semiprimes. This equation is no exception.
The immediate problem with this equation is trying to draw the picture with integerlevel precision. That level of precision is the minimum requirement when trying to find a prime, as all primes are integers. With 0.0625inch technical drawing paper and one integer every 0.0625 inches, fitting a 1536bit prime of an RSA3072 key, would require a paper width of 4.3⋅10⁴⁴³ lightyears.^{} ^{[equation 11]} Unfortunately the observable universe is just 9.4⋅10¹⁰ lightyears across.^{[119]}
Computers are no different. Storing geometric surfaces with (2¹⁵³⁶)² = 10⁹²⁴ pixels, runs as with all Grant's algorithms, into the issue of the observable universe running out of subatomic particles to use as memory. There are, again, only 3.28 ⋅ 10⁸⁰ of them.^{[76]}
The inequation
The major issue with Grant's Geometric Factorization doodle is, that his claim about the intersections of the hypothenuse of the right triangle is a straightup lie, obfuscated by the lack of resolution and by the large green markings covering the area. The refutal^{[illustration 2]} of this crank equation shows this in practice, by recreating the image with exact values in GeoGebra,^{} and by showing that even with the claimed correct answers for p and q, and with zoom to mere tenths or less, there is no intersection and thus, the equation does not hold.
Conclusion[edit]
To summarize, here are the RSA factoring algorithms relevant to Crown Sterling's case, arranged by their true time complexity, from best to worst.
Crown Sterling name  Real name  Real author  Claimed time complexity (or efficiency claims)  True time complexity  Largest RSA key broken  Notes 

n/a (Listed for comparison)  Shor's algorithm (1994)  Peter Shor^{[120]}^{[121]}  n/a  𝒪 (72(log N)²r)^{[122]}  5 bits^{[123]}  Requires a sufficiently large quantum computer^{} 
CS BiPrime algorithm (2019)  General Number Field Sieve (GNFS) (1993)  Lenstra et al.^{[92]}  Implied RSA15360 (with 256bits of symmetric security) breaks in under one minute [source]  ^{[124]}  829 bits^{[125]}  Plagiarized 
Pythagorean Factorization (2020)  Fermat's factorization method (1643)  Pierre de Fermat^{[126]} 
𝒪 (1) [source]  𝒪 ( √(n) )^{[113]}  16 bits^{[note 3]}^{[106]}  Plagiarized 
Reciprocal Factorization (2019)  Random trial division  Robert E. Grant  𝒪 (1/n) [source]  𝒪 ( √(n) )^{[5]}  32 bits [source]  The factoring equivalent of "shuffle deck of cards until it's sorted" 
Infinite Prime Prediction (2019) 
Multiplicationtable reverselookup  Robert E. Grant  "Unprecedented efficiency"[source] "The results were excellent"^{[8]} 
𝒪 (n²) [source]  0 bits  𝒪 (n²) space complexity 
Geometric Factorization (2022)  n/a  Robert E. Grant  Implied 𝒪 (1): Just complete the equation [source]  ⊥ [source]  n/a  The method does not work 
 The CS BiPrime Algorithm was the best algorithm ever demonstrated by the Crown Sterling team. However, both the algorithm (GNFS) and its implementation (CADONFS) were plagiarized. GNFS is not able to factor even RSA1024, let alone modern RSA3072.
 The Pythagorean Factoring algorithm was also plagiarized and grossly misrepresented. The authors claimed it runs in 𝒪 (1), but in reality that happens only in the best case. The syntax for best case is Ω (1), not 𝒪 (1). Since the issue of small prime distance pq has been addressed in all proper RSA implementations since its conception, the average case for the algorithm is 𝒪 ( √(n) ) which makes it useless.
 The Reciprocal Factoring algorithm makes no intelligent effort to solve the problem. The reciprocal value 1/N is effectively a poor man's random number generator, and stumbling upon the prime factors takes in the order of √(n) steps which sets the time complexity at useless 𝒪 ( √(n) ).
 The Infinite Prime Prediction pattern requires performing reverse lookups from a multiplication table the size of which is in the order of n², which sets both the time and the space complexity to horrible 𝒪 (n²).
 The Geometric Factoring equation straight up doesn't work as the equation provably does not hold.
The Pythagorean and Reciprocal factoring methods presented appear to work because they were demonstrated with minuscule key sizes. Their shared time complexity of 𝒪 ( √(n) ) means the algorithms grind to a halt at 180bit RSA,^{[note 4]} long before they can factor relevant size RSA3072 keys.
The purpose of the napkinmath algorithms (Pythagorean, Reciprocal, and Geometric Factorization) is mostly to leech off admiration from Grant's numerologist fan base who unfortunately for themselves, lack the formal training in mathematics and computer science to be able to tell the napkin math is worthless.
Despite claims to crack 2048bit RSA (with Reciprocal factoring), and 8192bit RSA (with Pythagorean factorization), Grant and his team have not managed to solve even a single unsolved RSA factoring challenge.^{} These challenges exist exclusively to track the progress of attacks against RSA.
With all that being said,
 The refutals of the methods presented above,
 The endless factual errors and lies made by Grant,
 The claims of having supposedly solved the RSA problem multiple times, yet still forgetting about it a week later, instead of hosting another press conference,
 The need to plagiarize the work of others,
 The incompetence in time complexity analysis,
 The inconsistency of coming up with algorithms that have factually worse time complexity than what they have already plagiarized,
 The inconsistency of coming up with algorithms that have worse time complexity than what they claim to already have,
 Peddling a method like Geometric Factorization that straight up doesn't work, and
 Not claiming the glory and global press coverage from winning the RSA2048 factoring challenge,^{}
all say Grant and his team have absolutely nothing of substance when it comes to breaking RSA.
To give some perspective on what real cryptanalysis of RSA looks like, Claus Schnorr's 2021 (failed) attempt^{[127]} highlights the complexity of the math involved in efficient attacks.
More plagiarism[edit]
To seem more legitimate as a cybersecurity company, Crown Sterling pushed out topical articles. On March 23, 2020, Crown Sterling's newsroom published an unauthored article titled "Cybersecurity: Under Half of Organizations are Fully Prepared to deal with Cyberattacks".^{[128]} This article was plagiarized wordforword from ZDNET's article under the same title, written by Danny Palmer.^{[129]} The only changes were the Americanization of the word "organisation" to "organization", and changing the apostrophe styling. The article has since been removed by Crown Sterling.
Snake oil cryptography[edit]
After lying about all public key encryption being based on the RSA problem, and lying about RSA being weak, Crown Sterling was ready to release its own cryptography, and to the surprise of absolutely no one, it was as full of lies and deceit as their earlier claims, and as broken as one would expect from numerologists, who try to solve postdoctorallevel research problems in a sophisticated branch of applied mathematics, with middleschoollevel math.
In September 2021, Crown Sterling released its Lite Paper. ^{[130]} Later, the same year, the company released a more detailed, full White Paper titled "Crown Sterling  Cryptographic Security Protocol".^{[41]}
In these documents, the authors described a broken cryptographic protocol built from broken cryptographic primitives.
Broken RNG[edit]
As stream cipher's^{} cryptographic keys^{} and nonces^{} all depend on cryptographic randomness, it's vital for any cryptosystem to use a proper cryptographically secure pseudorandom number generator (CSPRNG).^{}
Oh, the irony
In their White Paper, the authors reveal what they decided to use as CSPRNG:
“”The RBG general design is based on the cryptographically secure BlumBlumShub (BBS) generator.

—Crown Sterling, Full White Paper (2021)^{[41]} 
Blum Blum Shub^{} is a CSPRNG from 1986. It is rarely used because it's computationally heavy and slow.^{[132]}
Its authors have proven its security reduces to factoring of large semiprimes^{[133]} which is exactly the type of cryptography Grant has been trying to get rid of since his Matthew Belair interview in summer 2018, where Grant said:
“”[…] And none of it is gonna be Primedetermined, either. Because we know that's inherently now weakened because you can predict primes into infinity now.

—Robert Edward Grant (CEO, Crown Sterling)^{[6]} 
Questionable choice
In his tweet cryptographer MarkkuJuhani O. Saarinen explains why the selection of BlumBlumShub was highly questionable:
“”However: the only reason to use publickey ("trapdoor oneway") components like Rabin's, BBS, or Dual_EC in hashing & keystream generation or entropy conditioning & DRBG is to have backdoors! AES, SHA3 modes ftw [=are the way to go] 😅

—MarkkuJuhani O. Saarinen^{[134]} 
A point that needs repeating. Professional cryptographers think the only reason to select BlumBlumShub as the DRBG, i.e. the random number generator, is to have a backdoor.
Userland seeds
On page 4 of the White Paper, the authors explain how the BBS RNG is seeded:
“”The [CrownRNG] Daemon gathers entropy from many random system processes, including the pc metrics, such as the Heap, Memory, and stack, along with mouse movements and clicks, keyboard strokes, etc.

—Crown Sterling, Full White Paper (2021)^{[41]} 
As Scott Arciszewski explained to the Monero project in October 2016, userland PRNGs are considered antipattern.^{[135]} This includes things like keystrokes that can in cases like the X window system,^{} leak^{[136]} a major part of the RNG's seeding entropy to any malicious program running on the system.
The protection ring^{} model shows Kernel is the most privileged part of the operating system and using less privileged CSPRNGs is an extremely vulnerable design; leaked internal state of an RNG breaks all cryptographic systems that rely on the RNG.
Judging by Talal Ghannam's Stack Exchange question,^{[137]} the team apparently struggled even with understanding the concept of what a seed is, when he asked if a CSPRNG (which is a {{wplDeterministic_algorithmdeterministic algorithm) could be made more secure by having it function nondeterministically (impossible) with some seed. The company was thus definitely not in a place where it should be designing its own CSPRNG.
I wonder what this knob does
Despite Grant's earlier lies, the truth is, that semiprime factoring remains a hard problem and thus, BBS remains a secure CSPRNG, if left as such. So naturally, to ensure maximum crankery, after Talal Ghannam had asked about the topic on December 12, 2019,^{[138]} and received no reply, Grant and his team, in their numerologist paranoia, just went ahead and changed stuff:
“”In the original BBS, the mod is computed from the product of two prime numbers, whereas CrownRNG uses the truncated irrational numbers coming from the Functions Table.

—Crown Sterling, Full White Paper (2021)^{[41]} 
The team replaced the semiprime factorization problem of BBS, with factoring decimal expansions from irrational numbers, which unlike the numerologists would like to believe, are not magical, but your average everyday composite numbers, and thus trivial to factor. E.g., WolframAlpha can factor the number
14159265358979323846 26433832795028841971 69399375105820974944 59230781640628620899 86280348253421170679
created from first 100 decimals of Pi in seconds.^{[139]}
Aaron Toponce, a security and system engineer, explained on Reddit exactly how this influences the RNG behavior:
“”By not using Sophie Germain safe primes, they are shortening the length of an already short cycle. The maximum cycle length of BBS, is λ(λ(pq)), where λ is the Carmichael function.^{} This is only guaranteed given the conditions in the original paper. Any other p and q, such as irrational numbers, will likely shorten the cycle length.
Exempli gratia using Wikipedia, if p = 11 and q = 23, then λ(λ(11 * 23)) = 20. But λ(λ(12 * 23)) = 10, literally half the cycle length. This shit can't just be manipulated however you see fit. Math, how does it work?

—Aaron Toponce ^{[140]} 
An RNG that has a short period starts repeating itself much sooner. This means the attacker can store its complete output, try all subsections of it, and easily break everything that relies on the RNG's output, which might include password and key generation including cryptocurrency wallet private keys, nonces, initialization vectors, etc.
Quantum encryption[edit]
Since TIME AI, the company has been advertising quantum encryption:
“”[…] Using the infinite variations within music composed realtime by artificial intelligence, TIME AI generates quantum encryption keys as unique as your own iris.
Each quantum public key is paired with two quantum private keys that are entangled through mirror symmetry mathematics in value, time exposure, and oscillation speed. These quantum keys change at the nanoscale of time, 
—Crown Sterling (TIME AI trailer)^{[12]} 
Quantum encryption isn't a thing outside quantum key distribution (QKD)^{}, and QKD isn't an app. It requires dedicated fiber optic cables as quantum channels,^{} installed in fully connected network^{} topology. Anyone who's ever had to install the last mile of fiber to connect online can probably guess how much it would cost to install an alltheway fiber between their house, and the house of every peer they have, and then throw on top of that the very, very expensive hardware^{[141]} (one for each peer) that's capable of handing an actual QKD protocol such as BB84,^{} so one can talk to them.
However, it turns out QKD is only needed to make cryptography provably unbreakable. It isn't needed to make cryptography secure against quantum computers.
Oneminute crash course
Cryptographic algorithms are built typically as hybrid cryptosystems,^{} where symmetrickey cryptography^{} is used to protect content in transfer, and publickey cryptography^{} is only used to exchange the key for the symmetric cipher. The slow advances in quantum computing have implications for these two types of cryptography.
Symmetric algorithms are affected by Grover's (quantum) algorithm^{} which has the efficiency of 𝒪 ( √(n) ). This means it cuts keystrength of symmetric ciphers in half. This means 128bit ciphers are reduced to too weak 64 bits, but 256bit symmetric ciphers remain secure as their security is only reduced to 128 bits. This algorithm runtime is however only theoretical. In practice, the circuit depth is limited to roughly 2⁴⁰ logical gates, which means breaking 128bit AES requires more than 2¹²⁸ operations.^{[142]}
Asymmetric, or, publickey cryptography is matched against Shor's (quantum) algorithm,^{} that can break RSA, DiffieHellman, and its elliptic curve variant regardless of key size, as it runs polynomial in log N time, that is, in a reasonable time. Because of this, public key cryptography is in transit towards postquantum algorithms.^{}
Grant and his team probably opened up the news and realized this at some point, as they decided to pivot from snake oil "quantum cryptography" to snake oil postquantum cryptography.
The "postquantum" key exchange[edit]
After much hype about their system being secure against quantum computers, Crown Sterling finally revealed their postquantum suite in their White Paper on page 21:
“”CrownEncrypt implements the DiffieHellman publickey exchange protocol, […] Ellipticcurve Cryptography (ECC) is more secure than RSA and requires smaller encryption keys for the same level of security.

—Crown Sterling, Full White Paper (2021)^{[41]} 
So after all that hype, their strategy to beat quantum computers was to use ellipticcurve DiffieHellman (ECDH) for key exchange. What makes this choice particularly stupid is, that not only is ECDH vulnerable to Shor's algorithm, but breaking ECDH requires a much smaller quantum computer than breaking RSA does, as the estimate table^{[143]} from Kudelski Security shows:
Symmetric security 
RSA bits 
Qubits required for Shor's alg. against RSA 
ECC bits  Qubits required for Shor's alg. against ECC 

112  2048  4098  224  2042 
128  3072  6146  256  2330 
192  8192  15362  384  3484 
And then it got even more stupid
When questioned about how ECDH could be made postquantum in Crown Sterling's Telegram channel, Naomi Mathew, a Crown Sterling research team member revealed their strategy:
“”We alter the elliptic curve encryption to eliminate the issues associated with the elliptic curve that Bitcoin uses. By using an irrational number as a private key in place of a prime number, (prime numbers are susceptible to decryption due to their patterned distribution) we are able to introduce a significant amount of entropy to the encryption.

—Naomi Mathew, Crown Sterling research team^{[144]} 
Mathew's response is phenomenal in all of its crankery.
Elliptic curve private keys are not prime numbers
As explained by Squeamish Ossifrage on Stack Overflow:
“”A NIST P256 secret key (for ECDH or ECDSA) represents any scalar modulo ℓ for ℓ = 2²⁵⁶ − 2²²⁴ + 2¹⁹² − 89188191075325690597107910205041859247

—Squeamish Ossifrage^{[145]} 
Thus, elliptic curve private keys are not limited to only prime numbers. Any scalar^{} will do. This includes any primes that happen to also be elements of the field. If there was a check that ensured the scalar was not a prime, that would only make the number of possible keys smaller, which would only aid the attacker.
46bit keys, if you're Google
As a numerologist, Grant has littered his Instagram wall with pictures of transcendental numbers such as Pi containing every possible value at some point of its decimal expansion.^{[146]} Ignoring the philosophy and woo, it's true. But that also means that Grant knows the decimal expansion of Pi contains all 521bit private keys NIST P521 ECDH would normally use, including ones that are primes, at some point. This is a contradiction to Grant's team claiming the keys generated from Pi's irrational decimal expansion are more secure than the normal keys. Thus, the logical conclusion is — any valid private key generated with cryptographic RNG is equally secure, and Grant and his team are full of shit. Furthermore, in practice, the irrational keys are much weaker, because of the massive computational overhead to generate the keyspace to pick a key randomly from.
A sequence from an irrational number such as Pi, is just a number produced with an insecure PRNG, with a known seed. The PRNG in this case is the most efficient algorithm for approximating Pi, the Chudnovsky algorithm,^{} and the seed values are the bakedin coefficients necessary to generate Pi.
The decimal expansion needs to be as secure as NISTP521 ECDH, and that requires there be at least as many keys as there would normally be. Since the key is not the value, but the random offset, this requires 2⁵²¹ offsets to choose from. (The length of the key requires additional ⌈log₁₀ 2⁵²¹⌉ = 157 digits in the offset space^{[equation 12]} but it can be ignored as insignificant.)
Unfortunately for Crown Sterling, Pi has only been calculated to a precision of 100 trillion digits. This was done by Emma Haruka Iwao, a researcher at Google in 2022.^{[147]} This caps the number of offsets and thus the number of distinct keys to only 100 trillion unique values. A cryptographic key that has 100 trillion choices, has the strength of a log₂ 100,000,000,000,000 = 46.51 bit key.^{[equation 13]}
Given that the Chudnovsky algorithm runs in 𝒪 (n (log n)³),^{[148]} generating a 521bit key requires roughly 2⁵²¹ ⋅ ln(2⁵²¹)³ = 2⁵⁴⁶ᐧ⁴⁸⁹ operations,^{[equation 14]} which is 47 million times more work than breaking the NIST P521 ECDH with brute force.^{[equation 15]}
The reason modern cryptography is so strong is because it's computationally easy to generate a large random key, and computationally hard to break that key. What Crown Sterling's scheme proposes, is that it's computationally harder to pick the 521bit private key from 2⁵²¹ possible offsets than it is to break the key exchange by trying all 521bit keys.
In practice, it means even Google's research team with Google's computing power (128 vCPUs, 864GB of RAM, 515TB of disk space, and just under 158 days of number crunching^{[147]}), struggles to generate a 46bit key. 46bit keys haven't been secure from state actors practically ever, and academics broke the 1,024 times stronger 56bit DES^{} cipher back in 1998 with the EFF's Deep Crack^{} machine. Thus, a state actor who puts in the same time to precompute the decimals as Google did, can cycle through them and try all 100 trillion offsets in a matter of hours. This is of course only the worstcase scenario, that is, if an entity such as Google would generate the key. An average enduser device couldn't generate but a fraction of the key space in a reasonable amount of time, which greatly reduces the time and space it takes for the attacker to generate the precomputed table and cycle through it.
Shor go brrr
Last but certainly not least, Shor's algorithm solves the hidden subgroup problem^{} for finite abelian groups. It will find the private key just by looking at the public key. It doesn't care how random the private key is. Many ECDH private keys are generated with hardware random number generators (HWRNGs)^{} that are the only thing that yields nonalgorithmic, truly random numbers, and nobody's thinking they're somehow able to make ECDH safe from quantum adversaries.
CrownOTP: a broken streamcipher[edit]
For symmetric encryption, Crown Sterling claimed they had picked the onetime pad (OTP).^{}
Definition of OTP
A onetime pad (OTP) is a cipher with an extremely specific definition. In computerized OTP,
 The plaintext and key are binary strings, and encryption is done by adding the two modulo 2, that is, by XORing^{} the two together.
 The key must be generated with a hardware random number generator (HWRNG).^{} Using any algorithm to expand the key by any amount, immediately changes the cipher from an OTP into a stream cipher,^{}
 The generated key must be at least as long as the message,
 The key must be used only once, as repeated use of the key completely breaks the scheme,^{} and
 The key must be destroyed immediately after use to ensure forward secrecy.
When used exactly this way, OTP is information theoretically secure,^{} that is, decrypting a ciphertext without the key in a ciphertextonly attack (COA)^{} is impossible.
Secure use of OTP
Secure usage of OTP in real life requires additional steps.
 Since OTP is an additive cipher, it's malleable:^{} any change in the ciphertext will result in a changing of the plaintext. If the attacker knows the plaintext content for any reason (perhaps the protocol adds predictable header values), they can change it to say whatever they want. To prevent this, OTP must be paired with unconditionally secure authentication, such as onetime MAC^{} or CarterWegman MAC.^{[149]}
 Since OTP is the only informationtheoretically secure algorithm, using any other algorithm to exchange the key, makes it exactly as weak as the key exchange algorithm. This is why OTP was traditionally delivered either in person or via a dead drop spike^{[150]}, or as it is sometimes today, with the ridiculously expensive quantumkeydistribution (QKD) apparatus, as was discussed above.
CrownOTP
In their White Paper, Crown Sterling reveals how their system for OTP was created.
“”The main reason why OTP cryptography is not in wide usage, even though it offers unbreakable encryption, is due to the difficulty arising from sharing the pad/key, which is as large as or larger than the message itself. Crown Sterling solved this problem by generating keys using the square root function where the problem of sharing the whole key is reduced to simply sharing the number that generates it instead, the NPSN, which is much smaller than the whole message and can be securely and easily exchanged using the usual ECCDH protocol.

—Crown Sterling, Full White Paper (2021)^{[41]} 
Crown Sterling's solution was to just ignore the exact requirement that forbids expanding the key. This automatically changed the cipher from OTP into a stream cipher.
Modern 256bit stream ciphers, such as ChaCha20^{} and AES256^{}CTR^{}, are not informationtheoretically secure, but they would have satisfied Grant's desire for postquantum security if used with preshared keys^{}. But then Grant decided to remove postquantum security by exchanging keys with DiffieHellman.
Square roots are not magic
The golden rule of cryptography is "Don't roll your own cryptography". Yet, in their numerologist hubris, Grant and his team went and did just that. As the excerpt above shows, in their CrownOTP stream cipher, they chose to expand a shared secret into a keystream with square root of all things. For context, all stream ciphers require expanding the key into the keystream with a proper, cryptographically secure pseudo random generator (CSPRG).^{[151]}
Unlike the grifters who would like their marks to believe, a square root decimal expansion isn't some magical truly random number compressed into the radicand. Square root function is just that, a mathematical function.^{} It is an entirely deterministic (and thus trivially replicable) operation that creates the decimal expansion from an input value. The square root function can be expressed e.g. with the following implementation of Newton's method, written in Python:^{[152]}^{[program 4]}
from decimal import Decimal, getcontext
def newton_sqrt(n: int, decimals: int) > float:
"""Calculate square root using Newton's method.
From https://runestone.academy/ns/books/published/thinkcspy/MoreAboutIteration/NewtonsMethod.html
Modified for arbitrary precision.
"""
getcontext().prec = decimals + 1
half = Decimal(1/2)
approx = half * n
better = half * (approx + n / approx)
while better != approx:
approx = better
better = half * (approx + n / approx)
return approx
print(newton_sqrt(16, decimals=100))
print(newton_sqrt(2, decimals=100))
The cipher was broken immediately
The reason why only experts should be designing ciphers became clear, when on December 31, 2021 — just over three months after the Lite Paper came out — Sophie Schmieg, the leader of Google's Cryptography ISE team, wrote an application that used lattice reduction^{} to recover the seed from the square root's decimal expansion, regardless of its offset,^{[153]} effectively breaking this toy cipher.
All CSPRGs must have a property called unpredictability, which means it's computationally infeasible for an adversary to determine future output from the already given output.^{[154]} Yet, by recovering the radicand, the obviously deterministic square root function could be used to generate the keystream to decrypt future ciphertexts.
Schmieg's findings about CrownOTP were confirmed the next day by the cryptographer MarkkuJuhani O. Saarinen.^{[155]}
Four months later, to avoid their followers from learning about the break, Crown Sterling created a lowprofile Twitter account, @cs_mathresearch, which they then used to inquire about the break.^{[156]} Crown Sterling never thanked Schmieg for saving their customers' ciphertext confidentiality from a complete break, nor did they report the vulnerability to the CVE program.^{}
Despite Schmieg's break, Grant still went ahead and applied for a patent for the ridiculous cipher.^{[157]}
Horrible PRG performance
On February 24, 2024, Schmieg published a blog post about the attack.^{[158]}
The post explained how the keystream generation in fact takes in the order of operations, and explains its implications:
“”This is abysmal. A DRBG should have linear time complexity and constant space complexity, i.e. the cost of producing an extra bit of randomness should not depend on how much randomness was previously created.

—Sophie Schmieg (Google LLC)^{[158]} 
In layman's terms, as the key is used, every bit that gets encrypted encrypts more slowly than the previous bit. A cursory test shows generating just a 65kB keystream (enough to encrypt a tiny image, or a short article) takes more than 30 seconds.
Ridiculously efficient attack
The lattice reduction runtime is 𝒪 (n³) which means the crankPRG is slightly faster, but the attack only requires a 256bit chunk of keystream to recover the keystream, thus extracting the key from the keystream takes in the order of milliseconds, even for very large plaintexts.
Useless offset hardening
The proposed OTP scheme uses unknown offsets that discard some of the most significant bits. However, as Schmieg explained in her blog post:
“”This of course doesn’t do anything, as the attack is fast enough, and the computation of the keystream is slow enough, that you can simply bruteforce all possible starting points, changing a [=the square root radicand, i.e., the key] by a power of 2 as necessary to account for the discarded bits.

—Sophie Schmieg (Google LLC)^{[158]} 
What authentication?[edit]
In their TIME AI trailer, Crown Sterling advertised the authentication mechanism:
“”The speed of the AI oscillations allow 31,709 years of oscillations in a single second of data authentication.

—Crown Sterling (TIME AI trailer)^{[12]} 
This word salad is about as clear as mud, but it implies some sort of authentication mechanism would be implemented for the protocol.
However, nowhere in the Lite Paper or White Paper is authentication mentioned, and in Figure 11, on page 30 of the White Paper, it is clear that the message and pad are XORed together, and the resulting ciphertext is then delivered as is, to the contact for "reverse XOR"^{[sic]}. No authentication was used at all for the system, which in the case of malleable stream ciphers such as the CrownOTP, is nothing short of a disaster. A knownplaintext attack (KPA)^{}, as demonstrated above, could allow the attacker to change the content whether it's the message, sum to transfer, or anything in between, to whatever they want.
Theon Technology[edit]
The same bastardized stream cipher^{[159]} was apparently also sold businesstobusiness, via another of Grant's companies, called Theon Technology.^{[160]}
Interestingly, Grant's face wasn't anywhere to be found on the company website. Perhaps he was unsure if Black Hat had been forgotten yet. Instead of Grant, or the CEO, the company's public face seemed to be Dr. Eric Cole,^{} a New York Institute of Technology graduate and author of some infosec books. How this man descended from Lockheed Martin and got his hands dirty consulting a snake oil cryptography peddler, remains a mystery.
The company CEO Scott Bledsoe left the company in June 2023, and in February 2024, the company's website started to redirect to Crown Sterling's company website. It would thus appear the company has pivoted from cryptography to steganography^{} by disappearing for good.
Cryptocurrency[edit]
In his search for a usecase for his broken protocol, Grant decided it was time to pivot his business model to the surprise of absolutely no one, and as predicted^{[161]} by some of the most notable experts, into cryptocurrencies.
While Crown Sterling's normal stock was offered at no less than USD 4980 a share,^{[162]} the ICO that was the CSOV token, offered an unregistered security at more reasonable prices to retail investors. Unfortunately for Grant, the ICO bubble had burst already in 2018 with the SEC going after ICOs.^{[163]} Announced two years after the bubble burst, released four years too late, the CSOV token's price crashed in just two months, and it never recovered. As a premined coin, it's effectively Monopoly money with no scarcity and thus no real value. The main purpose of the token seems to have been a) to have at least something to show the stock investors, and b) to provide some cash inflow from retail investors buying the worthless penny stock.^{}
The cryptographic protocol was never implemented as Crown Sterling's own blockchain that could make use of the claimed postquantum transactions. The CSOV token operates as a Polkadot parachain, and the WCSOV token as an Ethereum smart contract.^{[164]} The Ethereum smart contract contains absolutely nothing that would imply WCSOV uses anything described in the Lite Paper or White Paper. Polkadot's signatures use sr25519^{[165]} and Ethereum uses ECDSA, neither of those is postquantum.
The only good thing to say about the cryptocurrency grift is, that it hasn't gotten very far, as WCSOV has only 145 holders.^{[166]}
Scammy exchanges[edit]
The (W)CSOV token is offered on five exchanges that are FMFW.io, Changelly PRO, HitBTC, BitMart, and Uniswap.
FMFW.io
Originally Bitcoin.com Exchange, the exchange rebranded itself as FMFW.io in September 2021. Trustpilot shows only five reviews, all one star.^{[167]}
Global Fraud Protection found deeply concerning irregularities.
“”
By accepting their agreement, traders waive the right to sue the company in court or have a jury involved.[…] The FMFW exchange claims to be trusted by more than 1 million users all over the world. Yet, the download rate of their wallet is just above 1,000 on PlayStore. Obviously, they are pumping up numbers to appear legit.[…] Once traders join and start depositing money, they are caught by numerous traps. Primarily verification and withdrawal issues.[…] With too many irregularities about this company that is most likely offshorebased, nobody with common sense should deposit there. 
—Global Fraud Protection  FMFW review^{[168]} 
Purchasing CSOV via the FMFW.io exchange is being marketed by a company called Sarson Funds.^{[169]} Dirty Bubble Media found the Sarson Funds had "steered their investors' money into one scam after another", and they captioned an illustration of the CSOV token price crash with the the concise message: "Rug. Pulled.".^{[170]}
Changelly PRO
The subreddit /r/monero lists Changelly PRO under "Do not use the following exchange(s),^{[171]} citing three threads.^{[172]}^{[173]}^{[174]}
HitBTC
Trustpilot lists just under 900 onestar reviews for HitBTC.^{[175]}
The subreddit /r/monero lists (also) HitBTC under "Do not use the following exchange(s),^{[176]} citing two threads.^{[177]}^{[178]}
Cointelligence gave the exchange a perfect score of 0 points in every aspect, flagging it as a complete scam.^{[179]}
In his article "(s)HitBTC holds <10% solvency, and selectively scamming more users than not.",^{[180]} Richard Sanders explains the scam:
“”If they see a selectivescamming victim is in a jurisdiction where law enforcement and legal professionals aren’t as spun up on cryptocurrency, they’re more likely to never return the cryptocurrency.

—Richard Sanders^{[180]} 
Thus, even honest positive reviews only aid the scammers in exploiting those with no legal protection.
BitMart
Trustpilot shows the exchange has over 850 onestar reviews.^{[181]} Sitejabber has six reviews, all onestar, for the exchange.^{[182]}
Bitcoin Forum has a discussion about the exchange being a scam.^{[183]}
The victims of the scam are aggregated under the Twitter account @bitmartscam.
Uniswap
81% of the total 38 reviews on Trustpilot gave the exchange one star out of five.^{[184]}
Malwaretips lists the exchange as a scam website that has anonymous owners and hosting, that has blocked access to accounts after receiving payments, and that has "created deep fake videos and doctored screenshots of business leaders endorsing the project".^{[185]}
Conclusion
Every single exchange the (W)CSOV token is being offered is an outright scam, which is rather fitting for a scam token. As the vendor of the token, Crown Sterling obviously does not care if the funds can be withdrawn by the users later. As per CoinMarketCap,^{[186]} the exchanges rank, in the order of least scammy service first, as follows:
 BitMart (rank 32)
 FMFW.io (rank 70)
 HitBTC (rank 94)
 Changelly PRO (rank 146)
 Uniswap (did not even make the cut)
Orion Messenger[edit]
After realizing they had missed the ICO boom, Crown Sterling decided the best way to pump value into their token would be to offer a VPN called Orion.^{[187]} Something must have happened, however, as one year later Orion was a "quantum secure" messaging app.^{[188]} Not like the authors cared too much: the messenger's Lite Paper, released in May 2023,^{[43]} still, a year later, refers to the messenger as "Bellatrix".
The Lite Paper[edit]
Two cryptographers going by the pseudonyms RazeHer and Geyblade effectively killed the da Vinci virus by combing through the Lite Paper in their Quackers series blog post^{[189]} in detail. Additional points are made below:
The Lite Paper states Orion uses "AES256" without describing the relevant part, the mode of operation.^{} While the key size is safe, it contradicts Grant's plans he revealed to Matthew Belair in June 2018:
“”There's not going to be any more like 256bit encryption and stuff like this. We're gonna kill all of it.

—Robert Edward Grant (CEO, Crown Sterling)^{[6]} 
The Lite Paper also reveals the company was still trying to bake in the broken snake oil CrownOTP stream cipher dissected above. The internal workings of the system are not documented which gives no reason to trust it.
The messaging app runs in a browser — a horrible^{[190]} idea in of itself.
On Lite Paper's page 5, the app is advertised as "trustless", but it is still closed source, meaning no one can independently verify it uses the encryption algorithms claimed in the documentation, let alone verify whether they're safely implemented and used.
Orion Beta[edit]
If it looks like a backdoor and walks like a backdoor...
Crown Sterling took special precautions to enforce the uninspectability of their web app's source code by compiling it as WebAssembly.^{} This, however, wasn't done soon enough, and a cursory peek at the application's TypeScript^{} code they pushed to anyone who bothered to open the web app's website, shows that the client fetches — what appears to be the user's plaintext NTRU private key used for endtoend encryption of messages — from the server as the user logs in.
In cryptography, encryption is only a tool to convert a confidentiality problem into a key management problem. In messaging apps, those who control the private keys have access to message content. Thus, Orion appears to be a grifter's paradise, as it appears to give the company's staff full control over their marks' communication, from controlling the discourse regardless of promises, to possibly even eavesdropping on everything they say. This is in strict contrast with what's being promised by Crown Sterling to their customers.
Because of what the peek into the messenger's source code showed, the app should not be trusted until the company joins apps like Signal, Wire, Threema, Session, Element, and many others, which all not only endtoend encrypt everything by default, but have open source clients. Open source client ensures the vendor's claims about endtoend encryption can be verified by not just audit companies, but much more importantly, by independent security researchers. Security without transparency is called security through obscurity,^{} and it has never worked. It only opens possibilities of abuse, as was again seen here.
The White Paper[edit]
That's the fault of yesterday's me!
On Feb. 5, 2024, in a response^{[191]} to a heckler asking about this very RationalWiki article, Crown Sterling took special time and care to refute the math, findings of inconsistencies in the company's story, pictorial evidence, and all references of this article with the stepbystep methodology of telling it contains "so much falsehood". Next, in the post, the company laughed at their apparently backdoored code being too old for it to matter. They conveniently ignored they had at one point designed the application to upload the NTRU private key to their servers. The fact they ever even considered such a protocol reflects their incompetence. Furthermore, given that Orion isn't older than July 2022, it's not like their incompetence is from past times. The post ended by sharing a draft White Paper^{[45]} for the Orion Messenger on Telegram.
The heckler then proceeded to laugh at the protocol's amateur design and demanded Crown Sterling to follow up with their claims of being able to break RSA by cracking the RSA2048 challenge and to release the client's source code for the sake of transparency. These requests were followed by the expert PR take of deleting everything the heckler said, and banning them — according to their second post,^{[192]} — for violating the company's policy of "respectful dialog".
In their second post, the company also stated they are working with "university cryptographers", while conveniently failing to name a single one. They then proceeded to formally prove the security of Orion messenger's protocol with a promise to have it audited by "respected third parties", which were not specified. The promise of audit is hollow, as audit companies typically don't have permission to publish unredacted results on their own. Also, audits are expensive and thus always finite in scope, and because audits are rulebased, they are trivial to rig to ignore relevant aspects. Audits are similar to RNGs' statistical tests: they are only useful if they show issues in the evaluated system. In information security, passing an audit is not a guarantee of anything, but failing an audit is a guarantee of there still being issues to fix.
The post also stated: "we recognize the importance of open sourcing critical aspects of our protocol to allow developers to be able to build on top of our quantumsecure network", which together with the announcement to only allow selected entities to audit the full codebase threw a wet blanket to those hoping the company would publish the source code for the entire client, which is the requirement for being trustless, and for independent verifiability of the system's holistic security.
But, it would be rude not to accept Crown Sterling's courteous invitation to peek under the hood by evaluating what the Orion whitepaper states.
Pointless unmaintained cryptographic libraries
On page 6 of their White Paper, the authors state they are using CryptoJS, which is an unmaintained cryptographic library.^{[193]} Always a strong sign when a company that claims to use modern cryptography uses libraries that nobody fixes vulnerabilities for. CryptoJS has a dubious past of using noncryptographic random number generation with math.random()
. This has since been fixed, but given that the library doesn't add anything, means Crown Sterling has no idea they're just using a pointless wrapper for the browser's native Crypto API.^{[194]}
What is a KDF?
On page 4 of their White Paper, the authors reveal their failure to understand the difference between key derivation functions (KDFs)^{} and password hashing functions (PHFs)^{} that perform key stretching,^{} as the authors decided to use Argon2id to derive the remote data fetching token from the clientside data encryption key. PHFs are not used as normal KDFs because they are pointlessly slow. Passwords need to be stretched to improve their strength, but given that the first pass of Argon2id already yields the key that can decrypt all of the user's data on the server, it makes no sense to use Argon2id again to create the token for fetching the file the vendor already has access to.
While this is not a strict vulnerability, it is a much less secure design: PHFs are always timelimited by user experience, and redirecting half of the time available for key stretching to do a pointless "supersecure" KDF operation, shows major incompetence. The company's staff clearly have no idea which blocks fit which hole, and the reason this matters is, that it's such an obvious mistake, that any cryptographer would have immediately told them this, which proves they are not working with any cryptographers. As for the Argon2id itself, the relevant part, i.e. the parameters (time cost, memory cost, parallelism) were also not disclosed, which puts the algorithm's memory hardness (its key selling point) and the authors' expertise in disclosing what matters, into question.
Hard choices
On page 5 of their White Paper, the authors show their choice for AES mode of operation is AESCBC/GCM. With their lack of expertise, the company apparently struggles to choose between CBC^{} that is unauthenticated and vulnerable to padding oracle attacks,^{} and GCM^{} which as an AEAD scheme^{} is authenticated^{} by default and considered the best practice. Not knowing this trivial distinction, again shows the company staff hasn't done their homework, and they sure as hell don't employ any cryptographers.
Brainfarts
On page 7, the authors state: "Please note that the original master password cannot be stored anywhere to prevent the attacker from breaking into other users' accounts in the case the user reuses the master password somewhere else".
Having the account security of other users be dependent on storing one user's master password is so ridiculously stupid, and so absurdly dangerous and bad design, this statement should probably be dismissed as having been written after falling into daydreaming mode after a tall glass of bourbon. Then again, designing something this stupid would be more than onbrand for the company of "infinite wave conjugations".
No secrecy from the future, no secrecy from the past
On page 8, the authors state: "A novelty and differentiating feature of the ORION messenger is the capability to have large multiuser group chats that are entirely qE2EE, making ORION the first postquantum large group messenger on the market. This is guaranteed by the flow of creating chats. In our case, the user who is responsible for adding members is also responsible for generating the individual credentials for each member to grant them access to the group chat messages. The first step is to generate a chat session key. The session key is shared across all members."
So, in their desire to provide endtoend encryption for groups so large confidentiality starts to lose its meaning, Crown Sterling decided to implement a protocol without best practices such as DiffieHellman ratchet.^{} Also, judging by the fact the White Paper states on the same page "session key rotation is not part of the current implementation", not just future secrecy, but even the crucial property of Forward secrecy^{} from 1990,^{[195]} first deployed by the OTRprotocol^{} in 2004, has been left as an afterthought. What makes this particularly funny and ironic is, that the RSA algorithm that Grant hates so much, is being phased out precisely because of its lack of forward secrecy, not because it's weak like Grant has fraudulently claimed.
Acquiring the knowledge on how to deploy a group key exchange^{[196]} is clearly pointless, when the planned alternative is according to the White Paper's page 8, to force group admins to deliver a new group key for every member, every time a user joins or leaves the group, a fun way to needlessly slow down the group admin's device, consume their battery, and possibly data plan. In their defense, the authors are aware of the limitations, so they proceed to misrepresent them:
"Please note that this procedure of encrypting the Session Secret must be repeated for each member, thus adding members has linear complexity and will take considerable time for large groups. However this is not expected to be an issue as the process is performed only once for each member, and chat size is expected to grow over time (as opposed to large, fast influxes of users)."
Unfortunately for Crown Sterling, to be able to read each other's messages, all group members need to be on the same page about what the key is. While they claim key rotation is not expected to be an issue, what they fail to take into account is, as the group grows into e.g. 3,000 members, every time a member joins, all 3,000 members will need a new key, preferably right away. And precisely because the number of members varies only slightly, a group that has gotten too large is doomed to stay resourceintensive. The fact it takes time for users to populate the group has a nice property of showing the users how the group member limit is not like the authors would like their customers to think, infinite, but capped by the performance of the group owner's device. This also opens up obvious denialofservice attack vectors for very large open groups, that can be performed by simply joining and leaving the group rapidly. The fact the authors don't even consider trivial attacks like these tells us they lack the adversarial mindset it takes to design secure protocols.
Mixing up the mixnets
On page 10 of the White Paper, the authors mention plans for the future:
"Another feature for switching to a decentralized backend is the anonymization of users through a mechanism similar to onion routing"
Failure to understand that onion routing^{} (e.g. Tor^{}) is used for anonymization of traffic, not decentralized storage, which is what software such as Freenet^{} has been doing for the past 24 years, is funny and again, telling.
Who's going to be running this network of onion routing nodes is also unclear. If it's going to be Crown Sterling themselves, there is no anonymity, because control over the entry and exit node breaks anonymity with a simple endtoend correlation attack.^{[197]}
The innovation of redundancy
Page 10 also states: "Having a decentralized storage system will bring many benefits to the messenger. It will ensure redundancy as the data will be shared across multiple nodes in the network."
The company's plans to have "ensured redundancy" in the future, calls into question what serverrackinthecleaningroom technology is being used by the system currently. All datacenters use NAS^{} or SAN^{} to ensure redundancy.
No publickey fingerprints
Publickey fingerprints^{} have been used to guard against maninthemiddle (MITM) attacks^{} in the very first endtoend encrypted system, PGP,^{} at least since 1997. Although the comparison of fingerprints is an integral part of practically every modern endtoend encrypted messaging app, the White Paper doesn't even mention them. The authors are thus apparently completely unaware of basic attacks against cryptographic protocols, or they stayed quiet about the feature to maintain the possibility of eavesdropping on their users with an MITM attack, which unlucky for the users are without fingerprints, undetectable.
Furthermore, it is not only Crown Sterling that can perform MITM attacks: The X.509^{} certificate system that the TLSprotocol^{} between the user's browser and Crown Sterling's servers uses, is not considered safe from entities like nationstates who run programs such as Bullrun,^{} and are the typical adversary with access to quantum computers. The inconsistency in threat modeling where a web app of all things is supposed to offer protection against the most wellfunded adversaries, again shows the ridiculous incompetence.
Empty promises to open the source
In their second Telegram post,^{[192]} Crown Sterling stated they intended to release "critical aspects" of the source code. However, on page 3 of the White Paper, the authors state they intend to deploy their Kyberx25519 hybrid key exchange as an unauditable Rust WebAssembly binary blob.
For context, opensourcing a protocol without opensourcing the client that uses it, is worthless, as parameters delivered to and from a verified protocol's API can break the system's security completely. For example, the UI elements are responsible for showing the public key fingerprint to the user. This is a convenient place to hide a backdoor that lies about the value of the fingerprint. Crown Sterling's promise to release the source code for just the protocol, and not the entire client, is thus worthless.
Passwords over keys
On page 11, the authors state:
"From a UX perspective, we enable compatibility with legacy systems by using the embedded password manager, as this allows the user to access the data based on his master password, instead of basing the security around the private keys."
Failure to understand which is stronger, a 256bit key generated by a proper CSPRNG, or a 40.54bit password generated by an average user,^{[198]} is also more than telling about what the security of the system will ultimately be.
Oh right, the blockchain
To fill the quota on buzzwords and the relevance of their token, the team ended the White Paper with the following note:
"We are confident we will be able to merge our revolutionary quantum security with the latest highspeed blockchain solutions creating a firstofitskind secure social and community platform alongside a thriving development community."
This is the first and only time the word blockchain appeared in the paper. Hopefully, it will remain the only time it's ever associated with a secure messenger, given that the idea of storing communications ciphertexts — the keys of which depend only on knowing the password — in an appendonly distributed ledger anyone can access, invites every malicious actor in the world to a bingo of cracking passwords of nontechnical users to read their messages.
Summary
During their journey, Crown Sterling has had to learn the hard way, that they don't need to burn their reputation with false claims about breaking standard encryption, before coming up with a product that uses standard encryption. The next rock they banged their shin against, was learning selfinvented stream ciphers are trivially breakable, and right after that, that butchering relatively safe primitives like the BlumBlumShub only gets them bad press.
They have now reached the point where they use standard primitives of the industry. But they are still figuring out which brick goes through which hole in the shape sorting cube of protocol design. The protocol lacks all basic properties like forward secrecy, future secrecy, public key fingerprints, and group key exchanges. The amateur mistakes show Crown Sterling definitely isn't working with "university cryptographers". Also, advertising the continued use of WebAssembly for cryptographic primitives shows the company did not actually have plans to open the source, even for the most relevant part, the algorithm implementations, that need to be verifiable by anyone and everyone.
The staff[edit]
Here are the Crown Sterling team members who have participated in the company's "research", preprints, and selfpublished PDFs.
Robert Edward Grant[edit]
Grant, a man who unfortunately failed to meet the notability guideline of Wikipedia^{[199]} deserves an introduction.
A blog post, authored by the nickname Quasiprimes, dug up interesting things about Grant,^{[200]} which have been incorporated below.
Formal education
According to The Org,^{[201]} Grant has the following formal education:
 Bachelor of Arts (BA) in Korean and International Relations, from Brigham Young University (19881994)
 Master of Business Administration (MBA) in International Finance, from Thunderbird School of Global Management (19971998)
 YPO/OMP program in the Presidents' Program in Leadership, from Harvard Business School (20092017)
No degree in mathematics, or computer science, the prerequisites of proficiency in cryptography.
Work history
According to UCI Samueli School of Engineering,^{[202]} before 1997, Grant held several management and leadership positions, including
 General manager (Australasia)
 Director of Marketing (Asia Pacific), and
 Country manager (Japan)
for medical device manufacturers, such as
 Sulzer Medica AG (Switzerland), and
 The Nucleus Group of Pacific Dunlop Ltd (Australia).
Lumenis, Inc. (19972003)
 19971998: Director of Business Development for HGM, Inc., later acquired by Lumenis.^{[203]}
 19982001: Managing Director of European Operations for the Coherent Medical Group, (Dieburg, Germany).^{[203]}
 20002001: Vice President of Business Development of the Coherent Medical Group.^{[203]}
 2001: President of the Surgical Business of the Coherent Medical Group, a subsidiary of Coherent, Inc., later acquired by Lumenis.^{[203]}
 2002: Executive Vice President and General Manager of the Surgical and Ophthalmic Business of Lumenis.^{[203]}
 20022003: Executive Vice President and General Manager of the Medical Business of Lumenis in Santa Clara, California. ^{[203]}
BIOLASE Technology, Inc. (20032006)
Grant joined BIOLASE Technology, a publicly traded Cosmetic Dentistry company, in June 2003 as the Chief Operating Officer (COO) and as the Chief Financial Officer (CFO).^{[204]}
In October 2004, Grant was appointed as the Director and President and Chief Executive Officer,^{[203]} and in March 2006, as the acting chairman.^{[205]}
Allegedly, after nearly destroying BIOLASE, Grant was either fired, or he bolted from the company.^{[206]}
Allergan, Inc. (20062010)
In May 2006, Grant was appointed as the Chairman and President and CEO of Allergan plc.^{[202]} According to Quasiprimes,^{[200]} Grant's presence there has mixed reviews, and he has been accused of pilfering millions from physicians:
“”
BR [Bob Rhatigan] is a great guy except for the part he played in helping R[obert] Grant dup millions out of physicians. Not sure what that says about his ethics or judgement.[…] 
—Anonymous^{[207]} 
Bausch and Lomb (20102011)
Grant became the CEO and President of Global Surgical Business^{[208]} at Bausch and Lomb on August 1, 2010.^{[209]}
On December 13, 2011, Brent Saunders announced Grant leaving the company.^{[210]} Grant was allegedly fired for not getting along with Brad Paddock,^{[211]} the vice president of sales.^{[212]}
According to Quasiprimes,^{[200]}
“”
More than 5 patents,^{[213]} under his own name, were filed in September and October of 2011 that are specifically in the field that Bausch & Lomb conduct business. Given that these patents were not published until 2013, Bausch & Lomb may not have even be aware that this activity of publishing their trade secrets was happening. Having absolutely no medical degree, or background in the field, it would be highly improbable for him to have otherwise obtained this information independently. 
—Quasiprimes^{[200]} 
The alleged patent trolling might have been the last straw to the industry, as Grant never worked for another company in the industry after leaving Bausch and Lomb in December 2011. Grant went on to start Strathspey Crown, his holding company of grifts almost immediately, in January 2012.^{[201]}
Allegations of sexual harassment
Grant has been accused of sexually harassing women as early as April 2012,^{[214]} and again in February 2014.^{[215]}
Allegations of investor fraud
Strasphey Crown founded a company called Alphaeon Corporation in July 2013.^{[216]} In September 2015, Alphaeon launched a product product called ShoutMD.^{[217]}
On November 9, 2019, a group of hackers shared on Schneier's Friday Squid Blog, an offtopic thread for miscellaneous infosec topics, an oldschool — Phrack^{}style ezine^{[218]} where they revealed they had breached ShoutMD's private forums, and that it was trivial due to nonexistent security. The ezine presents some interesting claims and some serious allegations:
“”
[…] ShoutMD requires a health care provider ID to sign up and contains a rather vicious terms of service threatening any physician who discloses any of the records contained in the forum.[…] […]Since the api to search members practically drooled the permissions information for each user, he [meaning we] chose one and recovered his password[…] […]0x1  Scamming investors Multiple scams were identified in the post content. Investors ask for their actual shares (somehow he received money and didn't distribute them), complain about various doublespeak, and more. After making a serious fuckup with fiduciary responsibility and lying to investors, our Robert Grant realized he and his company could be sued for investment fraud. For this reason, he tried to get all of his investors to sign a release waiver preventing them from suing him in their next share disbursement. Lo and behold, this did not go unnoticed. Mark Pinsky notes this in post id 201446:[…] I have significant concerns about the Strathspey Crown Holdings, LLC Class X Unit Purchase Warrant: 1. It has in it a GENERAL RELEASE of any and all claims against Strathspey Crown and its managers. It also releases all actions by Strathspey's "past and present agents, employees, representatives, officers, directors, members, managers, attorneys, accountants, insurers, advisors, consultants, assigns, successors, heirs, predecessors in interest, joint ventures, affiliates, subsidiaries, parents, and commonlycontrolled entities." (This is in Section 18 of the Unit Purchase Warrant.) It appears that SCH and its managers intend that if you sign it, you give up ALL your legal rights to sue SCH or its management for any reason whatsoever, and you can never pursue or be party to any legal action. It also appears they intend for the release to include all claims, including those you know about and those you don't yet have any knowledge of. 2. As you probably know, Robert Grant has pledged 10 million of his equity to Series B investors, and it is unclear how his pledge relates to the Class X Unit purchase: Is this warrant offer in lieu of Robert Grant's $10m equity pledge? Do the warrants offered dilute all SCH investors or just the equity owned by Robert Grant? For these and other reasons, I will not be signing this agreement." […] 0x2  Tax evasion According to the SEC records for Strathspey Crown, the company took in about $50,845,002 in investment and reported it using a Form D. This may not matter much on its own, but adding all the investment amounts together from the ledger equates to $136,422,195[…] 0x3  Physician Cronies While some of these physicians are clearly victims of Robert's serial scamming, others appear to help him actively perpetuate the scam. They even offer each other tips on how to better execute pricing scams on their customers[…] Over 100 investors were found to be promoting this [Jeuveau, a Botox generic] product without disclosing their financial interests in its success on social media. This is HIGHLY ILLEGAL[…] 
—Timecop^{[218]} 
Verifying the allegations is hard, but something may have happened, as per the Wayback Machine, the website quietly disappeared during 2019.^{[219]}
Conclusion
Grant's career trajectory, marked by his terminations from several companies, as well as alleged patent trolling, investment fraud, and sexual harassment, starkly contrasts with the story dressed as humor, that he told at the TIMEAI preparty, about exiting the industry because he "couldn't be evil anymore".^{[17]}
None of Grant's education, or earlier work has any intersection with cryptography.
Talal Ghannam[edit]
Formal education
Ghannam's 2003 Master's thesis from Western Michigan University was about "Optical Solitons in a ThreeState Medium".^{[220]} Ghannam's 2007 PhD dissertation was about "Quantum Properties of Light Emitted by Dipole NanoLaser".^{[221]}
In addition to the dissertation, Ghannam has ten other publications.^{[222]} Unfortunately for Crown Sterling, it's all in the field of physics. The only use his degree would have been for the company was to teach about the process of academic publishing. Instead, his degree was abused to gain upload rights to ArXiv's preprint server.
Crank publications
Considering his reputable academic background, Ghannam has seriously sold out: In 2012 he selfpublished a crank book titled "The Mystery of Numbers: Revealed through their Digital Root",^{[223]} and later, in 2021, another of the same sort, titled "GeoNumeronomy: Unraveling the universe through numbers and forms".^{[224]} Ghannam has also coauthored with Grant the book Philomath.^{[81]}
False credentials
Despite the lack of any degree or research in mathematics, Ghannam has been claimed by Crown Sterling to be a number theorist.^{[225]}
Alan Green[edit]
On his archived website,^{[226]} Green explains his background:
“”Alan is a Britishborn, classically trained pianist, composer, author, educator, and Shakespeare Authorship scholar.
He was musical director for Davy Jones of the 60’s pop group, The Monkees, for twelve years and coauthor with Jones of two bestselling, awardwinning books, They Made A Monkee Out Of Me and Mutant Monkees.

—Alan Green, biography (2020)^{[226]} 
Grant meets crank
Following his career in the music industry, Green began in 2004 his crank work of "deciphering codes hidden within Shakespeare's works, which finally solves history's most persistent coverup."^{[227]} His YouTube videos, among other things, tie the crank decodings of Shakespeare's sonnets to the Great Pyramid of Giza:^{[228]} a novel form of pyramidology.
While Green was interviewing Grant on Dec 1, 2020,^{[229]} Grant said he had been a follower of Green's work, and that in 2017 he had stumbled on Green's 2016 CPAK^{[note 5]} presentation, where Green explained how he had through trial and error stumbled upon approximations of mathematical constants in his measurements of the Great Pyramid of Giza. Coincidentally, Grant, in his infinite wisdom, had realized that יהוה, the Tetragrammaton (Hebrew block script for Yahweh) from 840 BCE, can be interpreted as mathematical syntax: ו and י can be interpreted as 7 and ⁷ respectively, and ה as π.
All one has to do is squint their eyes enough, and ignore the entire relevant history of the Hebrew alphabet and Western Arabic numerals:
 The letter ה, or He,^{} evolved from the Egyptian hieroglyphs representing the words thread, jubilation, and court, which look nothing like the Greek letter π.
 The letter ו, or Waw,^{} evolved from the Egyptian hieroglyph representing the word mace which looks nothing like 7.
 Similarly, י, or Yodh,^{} evolved from the ProtoSinaitic script^{} for the word hand that also looks nothing like 7.
 The Western Arabic numerals^{} didn't precede AlKhwarizmi's^{} book "On the Calculation with Hindu Numerals", which wasn't written until 825CE.
 The Greek alphabet^{} that contains π didn't exist until 9th century BCE, and it wasn't used to denote the mathematical constant until the mathematician Willian Jones^{} decided to do so in 1706.
One should also completely ignore that the Hebrew language has its own ancient cultural practice of assigning numbers to words called Gematria,^{} where
 Waw (ו) is associated with the number 6 (not 7),
 Yodh (י) is associated with the number 10 (not 7), and
 He (ה) is associated with the number 5, not 3.14159265358979323846…
But Grant put his expertise on history of ancient cultures and numerology to good use, ignored all that, and decided יהוה was the equation π7π⁷. After realizing π7π⁷ = 7π⁸ ≈ 66419.717 doesn't really mean anything, he then through trial and error figured out that pi⁷ / π7 = 137.34131, which to numerologists, who love to adjust precision as needed, was exactly the same as the golden angle,^{} 180⋅(3−√(5)) ≈ 137.50776.^{[note 6]}
Grant then reached out and called Green, who pretended to be very busy, and after Grant had explained the Tetragrammaton crankery, Green said he had figured out the ratio between the volume of the King's chamber,^{} and its sarcophagus was also 137.5.
Green's discovery be easily seen from the respective dimensions of the King's chamber 10.5m ✕ 5.2m ✕ 5.8m = 316.68 m³,^{[230]} and the dimensions of the granite sarcophagus 0.987m ✕ 1.051m ✕ 2.276m = 2.361m³.^{[231]} Together these two give the ratio of 316.68m³ / 2.361m³ = 134.130 which again, to the numerologists was exactly the same as the value Grant came up with, 137.341. All you need is enough rounding. Alas, 137 rounds up to 140 and 134 down to 130, but on a positive note, both values round down to an even 100, which happens to be the number of Dalmatians lost by the Radcliffes, plus an offset factor.
Considering the shared ability to ignore mathematical precision, historical accuracy, sense of chronology, the concept of apophenia,^{} and the shared understanding there's easy money to be made from gullible pyramidologists even with trivially falsifiable claims, it is no surprise the two saw eyetoeye, and agreed they should meet.
Crank in command
Later in the video, Green brought out his expertise by explaining how the DiffieHellman key exchange works:
“”
And it reminds me of when Diffie and Hellman got together, in what was it, '67, '76, '77, and the DiffieHellman algorithm, which ultimately then became, you know, RSA, that was a breakthrough. It could easily be described, in a nutshell you know. Bob wants to talk to Alice, but Eve is always going to be listening. How do you do a public key distribution, how do you send a key across when it can be intercepted. And so, he^{[sic]} figured out, using, you know, high prime numbers, it's like mixing two cans of paint. Take a red and a yellow, mix them together. It's easy to mix them together, but it's almost impossible to separate them, right. 
—Alan Green^{[232]} 
Thinking DiffieHellman revolves around multiple large prime numbers shows Green can not tell RSA and DiffieHellman apart. So, naturally, Crown Sterling positioned Green as the "Director of Cryptography".^{[233]} Green's background was ridiculed on Twitter, the next day after BlackHat 2019.^{[234]}
Despite his position, Green never contributed to a single preprint or PDF selfpublished by the company, and he has stayed relatively far back from the public eye of the company.
Amanda Kennedy[edit]
Amanda Kennedy popped up with Crown Sterling's PR Newswire article^{[225]} that announced another crank preprint on ArXiv,^{[235]} this time about spirals, and with no mention of cryptography.
As per her LinkedIn, she joined the company as a summer intern in June 2021 and was promoted a researcher two months later. Apart from the preprint, Kennedy stayed in the background throughout her employment.
Lucky for her, she left the company in April 2023 and she has since found a job at Aerojet Rocketdyne, that matches her formal education (aerospace engineering and rocketry) from University of Central Florida (UCF).
Naomi Mathew[edit]
Naomi Mathew has, as per her LinkedIn,^{[236]} a BA in mathematics from the University of California, Riverside (UCR). Being an undergraduate is nothing to sneeze at: from the looks of it, she's apparently the only one in the company who has a formal degree in mathematics.
She joined Crown Sterling in March 2021, and according to her LinkedIn, her degree has been put to good use. She has since coauthored the crank paper sumproduct conjecture,^{[110]} and she has also
 Built a highprecision calculator^{[237]} with several features, such as graphing/geometry, right triangle calculator, and access to several math/physics constants,
 Built other applications to help support current math research on a wide variety of topics such as geometry and prime numbers, and
 Documented proprietary research to present to patent attorneys.
Conclusion[edit]
None of the people who work, or who have worked for the company have a degree that involves cryptography. Given the company's abysmal reputation, and lack of evidence that any cryptographer has ever worked for them, or with them, it's clear the company and its staff are just winging it while flying low — near the cryptocurrency industry, that has way too little oversight and way too many cranks for anyone to pay attention.
Editorial note to the scam victims[edit]
Just because you pay for the product, doesn't mean you're not the product. E.g., you pay for Spotify, yet it spies on you.^{[238]}
In contrast, the entire open source initiative^{[239]} and Free software^{} movement (free as in freedom), and their creations such as the Linux operating system,^{} or most of what's listed on e.g. privacyguides.org, is living proof that privacy respecting nonsnakeoil applications don't always cost money. The fact Grant isn't a proponent of opensource systems and transparent security is also quite telling: he doesn't want his marks to know about things that would force him to walk the talk.
In fact, the sheer number of lies told by the company and its CEO, are aching to the concept of telling a big lie:^{} It is hard to believe someone would have the impudence to distort the truth to this extent.
If you choose to stay in this roach motel because you're craving for the community and validation for your numerologist/NewAge views in the personality cult that is REG, sure, be our guest. If you're just cashing in with the linegoupdistributed Ponzi scheme that is (W)CSOV, feel free to stay and gamble. It's your money.
But if you somehow wandered into the group looking for data sovereignty, or how nongrifters call it, privacy tech, such as secure communication, run. See securemessagingapps.com for real alternatives to Orion, join Reddit's /r/privacy community or PrivacyGuides forum for proper peer support.
The movement against surveillance capitalism^{} has been actively fought by people since the cypherpunks^{} initiated it 32 years ago. The real privacy community isn't filled with people with business degrees pretending they're da Vinci, Indiana Jones, and a professional cryptographer at the same time. It has people with Ph. D.s in computer science and mathematics, with a focus on cryptography, working hard in businesses and during their free time to make the world a less dangerous place, every day.
In summary[edit]
“”Crown Sterling is complete and utter snake oil.[…]
None of [the people who work for Crown Sterling] have demonstrated any cryptographic credentials. No papers, no research, no nothing. (And, no, selfpublishing doesn’t count.)[…] Run away. Run, far, far, away. 
—Bruce Schneier^{[61]} 
External links[edit]
Notes[edit]
 ↑ And so Grant "discovered" the principle of excluded middle.^{}
 ↑ Interestingly enough, the GNFS that Crown Sterling plagiarized, is the most efficient classical factoring algorithm, and precisely because it's so efficient, RSA's key size requirements for some symmetric security level are noticeably larger when compared to those of symmetric or elliptic curve algorithms.
 ↑ Fermat's method doesn't have public records against valid RSA challenges because of their obviously too high pq. Grant's standing factoring record for Fermat's method is from a nowdeleted Instagram video (Screenshot: https://imgur.com/a/puZw8oj), where he factored 53019184700161 = 7274171 ⋅ 7288691, where pq=14520. Fermat's method solved it in four iterations. With random (i.e. nonrigged) primes, this is the equivalent of breaking a 16bit RSA key with an 𝒪 ( √(n) ) algorithm, as √(16) = 4 This evaluation method may seem strange, but it detects false claims of factoring large keys with small prime factor distance.
 ↑ √(2¹⁸⁰) =2⁹⁰ which is roughly the computational power of major nationstates. The current magical limit of what is considered within the grasp of major nationstates, is somewhere between 80 and 100 bits. For those who want to dive more into this, keylength.com is your friend.
 ↑ CPAK, or Conference on Precession and Ancient Knowledge is a conference that offers a buffet of cranks doing presentations and book signing, all for the low low price of $399.
 ↑ Unfortunately Grant missed the precise value of the golden ratio is of the form A⋅(B − √(C)), where A=180 is the highest score one can achieve with three darts, B=3 which is the number of letters in "CIA", and C=5 is the number of Twilight movies. Yes. It's all connected.
Equations[edit]
The links to equations here allow for easy verification of the results obtained via the presented formulae.
 ↑ "The prime factor space of RSA3072". Via WolframAlpha.
 ↑ "Naive number of cells in Qgrid for RSA3072". Via WolframAlpha.
 ↑ "Optimized number of cells in Qgrid for RSA3072". Via WolframAlpha.
 ↑ "Number of calculations the 'Frontier' supercomputer performs before our Sun turns into a white dwarf". Via WolframAlpha.
 ↑ "Qgrid size for RSA3072". Via WolframAlpha.
 ↑ "Minimum Watt hours to count to 6.7*10^917". Via WolframAlpha.
 ↑ "The Sun's energy output in Watt hours over its remaining five billion years". Via WolframAlpha.
 ↑ "How many times harder is guessing an RSA3072 prime, than guessing an AES256 key". Via WolframAlpha.
 ↑ "Odds of guessing a RSA3072 prime, compared to the number of times needed to win Powerball jackpot". Via WolframAlpha.
 ↑ "The number of operations required for factoring a 3072bit RSA public key with trial division". Via WolframAlpha.
 ↑ "0.0625inch technical paper's side length, in lightyears". Via WolframAlpha.
 ↑ "Length of key in decimal expansion". Via WolframAlpha.
 ↑ "Bit strength key space that matches of 100 trillion offset space". Via WolframAlpha.
 ↑ "Base2 Exponent for number of operations for Pi with 2^521 decimals.". Via WolframAlpha.
 ↑ "How many times larger is generating 2^521 offsets from Pi, than trying all 2^521 offsets". Via WolframAlpha.
Illustrations[edit]
The links to illustrations here refute the proofbypicture crank algorithms and equations presented by Grant. The use of external image hosting avoids clutter in the main article.
 ↑ "Pythagorean Factorization crank algorithm refutal". Via imgur.com.
 ↑ ^{2.0} ^{2.1} "Geometrical Factorization crank equation refutal". Via imgur.com.
Programs[edit]
The links to programs here allow for easy inspection of the algorithm implementations used to generate the results and provide a onebutton method to independently run them for verifying the presented results.
 ↑ "Pythagorean Factorization: Number of required steps, as a function of RSAkey size". Via Online Python.
 ↑ "A Python implementation of Grant's Pythagorean Factorization algorithm". Via Online Python.
 ↑ "Comparison of Fermat's factorization method and the Pythagorean Factorization Algorithm". Via Online Python.
 ↑ "Implementation of Newton's method for square roots with arbitrary precision". Via Online Python.
References[edit]
 ↑ Twin Global. (October 2021). "Robert Edward Grant". Archived from twinglobal.org on Oct. 24, 2021.
 ↑ ^{2.0} ^{2.1} Grant, Robert (June 6, 2018). "Prime Number Pattern Associated with Icositetragons". Archived from filesusr.com on July 4, 2021.
 ↑ Pritchard, Paul (October 1, 1982). "Explaining the wheel sieve". Acta Informatica 17: 477485. doi^{}:10.1007/BF00264164.
 ↑ De Tina, Ton (July 27, 2010). "For any prime p>3, why is p2−1 always divisible by 24?" Via Mathematics Stack Exchange.
 ↑ ^{5.0} ^{5.1} ^{5.2} ^{5.3} ^{5.4} ^{5.5} ^{5.6} Squeamish Ossifrage (Sept. 26, 2019). "What is the efficiency of the new Crown Sterling semiprime factoring method?". Via Cryptography Stack Exchange.
 ↑ ^{6.0} ^{6.1} ^{6.2} ^{6.3} Grant, Robert (June 21, 2018) "Robert Grant: NEW Discovery Found in Great Pyramid  Possible Mark of the Builder in King's Chamber" (Matthew Belair interview). Via YouTube.
 ↑ ^{7.0} ^{7.1} Apollo, Adam (2020). "Crown Sterling". Archived from https://adamapollo.com on January 9, 2024.
 ↑ ^{8.0} ^{8.1} ^{8.2} ^{8.3} ^{8.4} ^{8.5} ^{8.6} ^{8.7} Robert E. Grant and Talal Ghannam (March 20, 2019). "Accurate and Infinite Prime Prediction from Novel QuasiPrime Analytical Methodology". Via ArXiv.
 ↑ Grant, Robert ("Hold my ARK" interview, March 19, 2019). "A new kind of prime number called quasiprimes" via YouTube.
 ↑ "Grant thinking arXiv preprints are publications". Via imgur.com
 ↑ Grant, Robert (March 21, 2019). "Grant drawing the TIME AI logo on March 21, 2019". Via imgur.com
 ↑ ^{12.0} ^{12.1} ^{12.2} ^{12.3} ^{12.4} ^{12.5} Crown Sterling (March 28, 2019). "Crown Sterling Presents: TIME AI" via YouTube.
 ↑ Internet Engineering Task Force (IETF)  Network Working Group (Oct. 25, 2021). "The Transport Layer Security (TLS) Protocol Version 1.3". Via ietf.org
 ↑ Greenberg, Andy (Nov. 28, 2016). "Hacker Lexicon: What Is Perfect Forward Secrecy?" Archived from Wired Magazine on June 13, 2023.
 ↑ Harrison, Maggie (Sept. 8, 2022). "Analysis: No, AI Isn't Sentient, You Absolute Morons" Archived from futurism.com on Sept. 29, 2023.
 ↑ Carney, Mark (Aug. 9, 2019). "Dissection of the TIME AI video". Via Twitter.
 ↑ ^{17.0} ^{17.1} Grant, Robert (August 3, 2019). "Introduction to TIME AI party, Blackhat 2019G". Uploaded by Alex Gaynor on YouTube on Aug. 24, 2019.
 ↑ Parker, Matt (Nov. 20, 2018). "Squaring Primes  Numberphile". Via YouTube.
 ↑ Bernoff, Josh (Aug. 27, 2019). "Crown Sterling asserts its legal right to be an idiot". Archived from https://bernoff.com/ on Jan. 16, 2024.
 ↑ Aumasson, JeanPhilippe (Aug. 8, 2019). Live tweets from "Robert Grant's "The Discovery of QuasiPrime Numbers: What Does This Mean For Encryption?" presentation, Black Hat 2019. Archived from Twitter on May 23, 2020.
 ↑ Bernoff, Josh (Aug. 13, 2019). "Is this Crown Sterling press release from another planet?". Archived from https://bernoff.com/ on Jan. 21, 2024.
 ↑ Aumasson, JeanPhilippe (Aug. 8, 2019). "I started by telling the guy that DH and AES aren't based on factorization, then Thomas Pornin reminded him of the prior art (Eratosthene sieve), then Dan brilliantly finished him" Archived from Twitter on Jan. 28, 2024.
 ↑ Grant, Robert (Aug. 8, 2019). "QuasiPrime Numbers: What Does This Mean For Encryption?" (Video recording, part 1). Uploaded by Alex Gaynor on YouTube on Aug. 24, 2019.
 ↑ Eargle, Dave (Sept. 30, 2020). "Transcription of Crown Sterling TIME AI Blackhat 2019 Q&A Session". Archived from https://daveeargle.com on Jan. 16, 2024.
 ↑ Guido, Dan (Aug. 8, 2019). "I yelled at the Time AI guy. It’s ok to get angry at someone trying to harm people. I was shocked that more people haven’t done the same." Archived from Twitter on Feb. 11, 2021.
 ↑ Eddy, Max (Aug. 10, 2019). "Black Hat Attendees: Sponsored Session Was 'Snake Oil Crypto'". Archived from PCMag on Jan. 21, 2024.
 ↑ FranceschiBicchierai, Lorenzo; Cox, Joseph (Aug. 10, 2019). "Black Hat Talk About ‘Time AI’ Causes Uproar, Is Deleted By Conference". Archived from Vice on Jan. 21, 2024.
 ↑ Gallager, Sean (Aug. 24, 2019). "Alleged 'Snake Oil' Crypto Firm Sues Over Boos At Black Hat". Archived from Wired Magazine on Aug. 25, 2019.
 ↑ Grant, Robert (Aug. 10, 2019). "I tell you what, you seem like a pretty smart fellow. I will make the new encryption available for you to test. I will even pay you significantly if you can crack it. Why not?". Archived from Twitter on Jan. 28, 2024.
 ↑ Schneier, Bruce (Dec. 15, 1998). "Cryptogram: The Fallacy of Cracking Contests". Via schneier.com
 ↑ Grant, Robert (Aug. 9, 2019). "I’m actually being quite serious. What’s wrong with this? I’ll pay you $100K if you can crack it just one time." Archived from Twitter on Aug. 12, 2019.
 ↑ Williams, Jake (Aug. 29, 2019). "I'm throwing down the gauntlet. I'll publicly shave my head, glue pubes to my bald scalp, and give a recorded talk apologizing and publicly endorsing Crown Sterling's TimeAI if they demonstrate decrypting RSA encryption in the next 14 days.". Archived from Twitter on Aug. 30, 2019.
 ↑ Grant, Robert (Aug. 10, 2019). "Why do you care so much?". Archived from Twitter on Jan. 25, 2024.
 ↑ Grant, Robert (Aug. 10, 2019). "Maybe, maybe not. That’s the nature of risk. You are entitled to your views and opinion, I respect that. If you are correct then you are clearly wasting your time in this string.". Archived from Twitter on Jan. 25, 2024.
 ↑ ^{35.0} ^{35.1} ^{35.2} ^{35.3} ^{35.4} ^{35.5} Katz, Michael I.; Bressler, Joshua R. (Aug. 22, 2019). "ECF Case No. 19, CV7900  CROWN STERLING LIMITED LLC vs UBM LLC aka BLACK HAT USA and DOES 110". Via cdn.arstechnica.com
 ↑ Kudelski Security (Aug. 1, 2019). "Kudelski Security website". Archived from kudelskisecurity.com on Aug. 1, 2019.
 ↑ NCC Group (Accessed March 20, 2024). "NCC Group website". Via nccgroup.com
 ↑ Trail of Bits (Aug. 9, 2019). Trail of Bits. Archived from trailofbits.com on Aug. 9, 2019.
 ↑ UBM LLC, (2019). "Black Hat 2019 Sponsors". Archived from blackhat.com on July 28, 2019.
 ↑ National Institute of Standards and Technology (NIST) (Feb. 2023). "Recommendations for Discrete Logarithmbased Cryptography". Via nvlpubs.nist.gov.
 ↑ ^{41.0} ^{41.1} ^{41.2} ^{41.3} ^{41.4} ^{41.5} ^{41.6} Crown Sterling (2021). "CROWN STERLING  CRYPTOGRAPHIC SECURITY PROTOCOL" Archived from hubspotusercontent10.net CDN on Dec. 19, 2021.
 ↑ Hoffstein, Jeffrey; Pipher, Jill; Silverman, Joseph H. (1998) "NTRU: A RingBased Public Key Cryptosystem". Via ntru.org.
 ↑ ^{43.0} ^{43.1} Crown Sterling (May 10, 2023). "Orion Lite Paper" Archived from crownsterling.io on June 6, 2023.
 ↑ Bos et al. (April 2018). "CRYSTALS – Kyber: a CCAsecure modulelatticebased KEM" via iacr.org.
 ↑ ^{45.0} ^{45.1} ^{45.2} Crown Sterling (Jan. 2024). "Crown Sterling Orion Messenger qE2EE Whitepaper". Via imgur.com.
 ↑ Horowitz, Michael (Jun 21, 2013). "Perfect Forward Secrecy can block the NSA from secure web pages, but no one uses it". Via computerworld.com.
 ↑ Trail of Bits (July 8, 2019). "Fuck RSA https://blog.trailofbits.com/2019/07/08/fuckrsa/" Via Twitter
 ↑ ^{48.0} ^{48.1} Trail of Bits (July 8, 2019). "Fuck RSA". Archived from trailofbits.com on July 8, 2019.
 ↑ Aumasson, JeanPhilippe (July 18, 2019). "Good piece about known risks with RSA, but "flat out unacceptable to use RSA in 2019" is too radical IMHO. Someone could probably list ECC failures and write a "Fuck ECC" post. The article for example omits to mention that PSS and FDH are more "misuseresistant" than ECDSA." Via Twitter.
 ↑ "BearSSL Features"
 ↑ Miller, Victor S. (1985). "Use of Elliptic Curves in Cryptography". Advances in Cryptology — CRYPTO ’85 Proceedings 218: 417426. doi^{}:10.1007/354039799X_31. Retrieved March 20, 2024.
 ↑ Password Hashing Competition (Accessed March 20, 2024). "Password Hashing Competition" Via passwordhashing.net.
 ↑ Biryukov, Alex; Dinu, Daniel; Khovratovich, Dmitry (Dec 26. 2015). "Argon2: the memoryhard function for password hashing and other applications". Via passwordhashing.net.
 ↑ Aumasson, JeanPhilippe (2012—). "BLAKE2 — fast secure hashing". Via blake2.net.
 ↑ Stone, Jeff (April 22, 2020). "Crown Sterling and Black Hat settle lawsuit, promise to never speak of it again" Via cyberscoop.com
 ↑ "Crown Sterling and Informa Tech Holdings, Owner of Black Hat USA, Reach Settlement Agreement". Archived from crownsterling.io on Aug. 13, 2020.
 ↑ "Grant's comment to BlackHat on August 19, 2022". Via rationalwiki.org
 ↑ Crown Sterling team roster (July 31, 2019). Archived from crownsterling.io on July 31, 2019.
 ↑ Crown Sterling team roster (Aug. 31, 2019). Archived from crownsterling.io on Aug. 31, 2019.
 ↑ Schneier, Bruce (2004—). "The Doghouse", a series of refutal articles on cryptographic snake oil. Via schneier.com.
 ↑ ^{61.0} ^{61.1} ^{61.2} ^{61.3} Schneier, Bruce (Sept. 5, 2019). "The Doghouse: Crown Sterling". Archived from Schneier on Security on Jan. 22, 2024.
 ↑ Treadwell Stanton DuPont (Sept. 3, 2019). "Treadwell Stanton DuPont today announced its researchers quietly broke the SHA256 hashing algorithm over a year ago". Archived from treadwellstanton.com on Sept. 10, 2019.
 ↑ Squeamish Ossifrage (Sept. 11, 2019). "Has SHA256 been broken by Treadwell Stanton DuPont?" Via Cryptography Stack Exchange.
 ↑ Grant, Robert (Aug. 8, 2019). "Grant's lie about DiffieHellman being based on the RSA problem." (Grant's Black Hat 2019 presentation video recording, part 1). Uploaded by Alex Gaynor on YouTube on Aug. 24, 2019.
 ↑ ^{65.0} ^{65.1} Carney, Mark (July 2019). "Reviewing Recent Prime Generation Methods for Breaking Cryptographic Keys". University of Leeds.
 ↑ ^{66.0} ^{66.1} ^{66.2} von Brand, Horst H. (Aug. 27, 2020). "What is the difference between Big O, Omega, and Theta?" Via Computer Science Stack Exchange.
 ↑ Hippolytus of Rome (c.230 AD). "The Refutation of all Heresies". Translated by MacMahon, Rev. J.H., In Roberts & Donaldson  The AnteNicene Fathers (1919, pp. 9–153).
 ↑ Noble Mushtak (Dec. 27, 2016). "Why are we allowed to ignore coefficients in BigO notation?". Via Via Math Stack Exchange.
 ↑ ^{69.0} ^{69.1} ^{69.2} Rowell et al. (2012—). BigO Cheat Sheet.
 ↑ The OpenSSH Project. "OpenSSH RSA maximum limit for public key modulus size (16,384 bits)". Via github.com.
 ↑ National Security Agency (NSA) (2016). "NSA CNSA Suite key size recommendations". Via keylength.com.
 ↑ Pornin, Thomas (June 24, 2015). "What prime lengths are used for RSA?". Via Cryptography Stack Exchange.
 ↑ ^{73.0} ^{73.1} National Institute of Standards and Technology (NIST) (March 2019). "Recommendation for PairWise KeyEstablishment Using Integer Factorization Cryptography". NIST Special Publication 80056B rev 2, Subsection 6.2.1.3.
 ↑ TOP500.org (c) (November 2023). Frontier supercomputer Via top500.org
 ↑ National Aeronautics and Space Administration (NASA) (October 25, 2023)."Our Sun: Facts" via nasa.gov
 ↑ ^{76.0} ^{76.1} Padilla, Tony (July 10, 2017). "How many particles in the Universe?". The University of Nottingham. Via Numberphile.
 ↑ Kennewell, John; McDonald, Andrew (March 25, 2016). "The Solar Constant". The Bureau of Meteorology, Australia
 ↑ National Institute of Standards and Technology (NIST) (Feb. 3, 2023). "Construct a Provable Prime (Possibly with Conditions) Based on Contemporaneously Constructed Auxiliary Provable Primes" Digital Signature Standard (DSS). Via nist.gov
 ↑ The Associated Press (July 19, 2023). "How hard is it to win the lottery? Odds to keep in mind as Powerball and Mega Millions jackpots soar". Archived from AP News on Jan. 22, 2024.
 ↑ Grant, Robert (Aug. 10, 2019). "Dan Guido and Mark Carney you may have both missed my comment yesterday that our prime factoring efforts leveraged the icositetragon geometry, however, in the process we identified algebraic/geometric equation approaches, which we have not released, none require indexing.". Archived from Twitter on Jan. 28, 2024.
 ↑ ^{81.0} ^{81.1} ^{81.2} ^{81.3} ^{81.4} ^{81.5} Grant, Robert (April 2021). Philomath  The Geometric Unification of Science & Art through Number. Independently published. p. 127. ISBN 9798736939466.
 ↑ Grant, Robert (July 6, 2018). "Quaternion Symmetry Inherent to the Icositetragon". Archived from filesusr.com on July 4, 2024.
 ↑ Grant, Robert (July 5, 2018). "Quaternion Symmetry Inherent to the Icositetragon – Publication" Archived from https://robertedwardgrant.com on Feb. 2, 2024.
 ↑ Gallagher, Sean (Sept. 20, 2019). "Medicine show: Crown Sterling demos 256bit RSA keycracking at private event". Archived from Ars Technica on Sept. 21, 2019.
 ↑ ^{85.0} ^{85.1} ^{85.2} Crown Sterling (Sept. 21, 2019). "Crown Sterling Decrypts RSA Asymmetric Public Keys in Live Demonstration". Via YouTube.
 ↑ CADONFS Development Team (2006–). CADONFS, a software implementation of the Number Field Sieve (NFS) algorithm. gitlabpages.inria.fr.
 ↑ CADONFS Development Team (August 22, 2019). CADONFS source line for the popped Infomessage from August 22, 2019.
 ↑ @vytvso (Sept. 20, 2019). "If they are *so* unique why they should use the same output like CADONFS? Or their code is based on it ...". Archived from Twitter on Jan. 5, 2024.
 ↑ ^{89.0} ^{89.1} RSA Factoring Challenge Administrator (Jan. 30, 2002). "RSA Honor Roll  As of March 5, 1999" via ontko.com.
 ↑ @SwiftOnSecurity (Sept. 20, 2019). "JOURNALISTS: You may be seeing claims about cracking “256bit encryption” today. DO NOT REPRINT THAT, IT IS MISLEADING CLAIM ON PURPOSE. They selected that bitlength as a part of their misinformation campaign to confuse you and the public. I asked @ParagonIE to tweet about why.". Archived from Twitter on Sept. 20, 2019.
 ↑ ECRYPTCSA (2018). "ECRYPTCSA Recommendations". Via keylength.com.
 ↑ ^{92.0} ^{92.1} A. K. Lenstra, H. W. Lenstra, Jr., M. S. Manasse, and J. M. Pollard, “[The Number Field Sieve https://link.springer.com/chapter/10.1007/BFb0091537],” in A. K. Lenstra and H. W. Lenstra, Jr. (eds.) The Development of the Number Field Sieve, Lecture Notes in Mathematics 1554, SpringerVerlag, New York, pp. 11–42, 1993.
 ↑ ^{93.0} ^{93.1} CTFtime team (Sept. 28, 2019). Crown Sterling. Via ctftime.org.
 ↑ CTFtime team (Sept. 28, 2019). "CUCTF 2019 Tasks". Via ctftime.org.
 ↑ Grant, Robert (Aug. 10, 2019). "Of course I meant factoring a biPrime into its primes factors. Rules: We will do the test on 512Bit (155 decimal digits). I will send you a number and you will send me a number. We will do it simultaneously at a predetermined time.". Archived from Twitter on Jan. 31, 2024.
 ↑ Postmedicine show roastingthread (Twitter). Archived from Twitter on Sept. 25, 2019.
 ↑ Stack Overflow Community (Jan. 24, 2021). "Are there any O(1/n) algorithms?". Via Stack Overflow.
 ↑ USPTO.report (May 26, 2022). "Decryption of Encrypted Data Missing a Private Key". Via uspto.report.
 ↑ ^{99.0} ^{99.1} ^{99.2} Grant, Robert (July 20, 2020). "Novel Reciprocal Wave Factorization Explained: A x B = C". Via YouTube.
 ↑ Grant, Robert (June 2020). Reciprocal Wave Factorization. p. 18.
 ↑ "The RSA Challenge Numbers". Archived from rsasecurity.com on May 23, 2004.
 ↑ van Tilborg, Henk C.A. (2005). "Encyclopedia of Cryptography and Security" p. 435 (448)
 ↑ ^{103.0} ^{103.1} ^{103.2} ^{103.3} ^{103.4} Grant, Robert (Dec. 24, 2020). "Prime FactorBased Encryptions Rendered Useless by Right TriangleBased Constant Time Solution". Archived from robertedwardgrant.com on Jan. 11, 2024.
 ↑ ^{104.0} ^{104.1} "RSA modulus size with pq distance > 10^1300". Via imgur.com
 ↑ Shor, Peter (Nov. 4, 2013). "Shor's Algorithm speed". Via Computer Science Stack Exchange.
 ↑ ^{106.0} ^{106.1} Grant, Robert (December 2020). "Pythagorean Factorization  Largest semiprime factored to record" (screenshot). Via imgur.com
 ↑ Grant, Robert (July 22, 2019). "It's Time to Fight Back for Data Sovereignty with TIME AI". Archived from robertedwardgrant.com on Jan. 22, 2024.
 ↑ ^{108.0} ^{108.1} Grant, Robert (Dec. 24, 2020). "Pythagorean Factorization" (illustration). Archived from robertedwardgrant.com on Jan. 11, 2024.
 ↑ Grant, Robert (Dec. 24, 2020). "Pythagorean Factorization" (fine print hidden in notes: "Note: if not a perfect square, then proceed (to iterate) x=1,2,3,4,5,6... "). Archived from robertedwardgrant.com on Jan. 11, 2024.
 ↑ ^{110.0} ^{110.1} Grant et al. (Oct. 9, 2021). "The Sum Product Conjecture". Archived from https://robertedwardgrant.com on Jan. 16, 2024.
 ↑ Oduenyi, Valentine (2017). "The 50 Greatest Mathematicians" Via sapaviva.com.
 ↑ Erra, Robert; Grenier, Christopher (June 30, 2009). "The Fermat factorization method revisited". IACR Cryptol. ePrint Arch. 2009: 318.
 ↑ ^{113.0} ^{113.1} Zaki, Alaa M.; Bakr, M.E.; Alsahangiti, Arwa M.; Khosa, Saima Khan; Fathy, Khaled A. (March 1, 2023). "Acceleration of Wheel Factoring Techniques". Mathematics 11 (5). doi^{}:10.3390/math11051203. Retrieved Jan. 22, 2024.
 ↑ Shatnawi, Ahmed; Almazari, Mahmoud (2023). "RSA cryptanalysis — Fermat factorization exact bound and the role of integer sequences in factorization problem". Journal of Information Security and Applications 78 (22142126): 103614. doi^{}:10.1016/j.jisa.2023.103614. Retrieved 20240113.
 ↑ Rivest, R.; Shamir, A.; Adleman, L. (February 1978). "A Method for Obtaining Digital Signatures and PublicKey Cryptosystems". Communications of the ACM 21 (2): 120–126. doi^{}:10.1145/359340.359342.
 ↑ OpenSSL Project Authors (1999—). "OpenSSL implementation of NIST SP80056Br1 6.4.1.2.1 requirement for checking the safe distance of prime factors.
 ↑ Legion of the Bouncy Castle Inc (2000—). BouncyCastle implementation of NIST SP80056Br1 6.4.1.2.1 requirement for checking the safe distance of prime factors.
 ↑ Goodin, Dan (March 14, 2022). "Researcher uses 379yearold algorithm to crack crypto keys found in the wild". Archived from Ars Technica on March 22, 2022.
 ↑ National Aeronautics and Space Administration (NASA) (March 2018). "Age & Size of the Universe Through the Years". Via nasa.gov.
 ↑ Shor, Peter W. (1994). "Algorithms for quantum computation: Discrete logarithms and factoring". Proceedings 35th Annual Symposium on Foundations of Computer Science. IEEE Comput. Soc. Press. pp. 124–134. doi^{}:10.1109/sfcs.1994.365700. ISBN 0818665807.
 ↑ Shor, Peter W. (October 1997). "PolynomialTime Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer". SIAM Journal on Computing 26 (5): 1484–1509. arXiv:quantph/9508027. doi^{}:10.1137/S0097539795293172. ISSN 00975397.
 ↑ Shor, Peter (Nov. 4, 2013). "Shor's Algorithm speed". Via Computer Science Stack Exchange.
 ↑ MartínLópez, Enrique; Enrique MartínLópez; Anthony Laing; Thomas Lawson; Roberto Alvarez; XiaoQi Zhou; Jeremy L. O'Brien (12 October 2012). "Experimental realization of Shor's quantum factoring algorithm using qubit recycling". Nature Photonics 6 (11): 773–776. arXiv:1111.4147. Bibcode 2012NaPho...6..773M. doi^{}:10.1038/nphoton.2012.259.
 ↑ Pomerance, Carl (December 1996). "A Tale of Two Sieves". Notices of the AMS 43 (12): pp. 1473–1485.
 ↑ Zimmermann, Paul (Feb. 28, 2020). "Factorization of RSA250" Via Cadonfsdiscuss Mailing List.
 ↑ Pierre de Fermat (1643). Oeuvres de Fermat, vol. 2, p. 256.
 ↑ Schnorr, Claus Peter (June 16, 2021). "Fast Factoring Integers by SVP Algorithms, corrected (work in progress)". Via iacr.org.
 ↑ Crown Sterling (March 23, 2020). "Cybersecurity: Under Half of Organizations are Fully Prepared to deal with Cyberattacks". Archived from crownsterling.io on Nov. 25, 2021.
 ↑ Palmer, Danny (Nov. 4, 2019). "Cybersecurity: Under half of organisations are fully prepared to deal with cyberattacks". Archived from zdnet.com on Jan. 27, 2024.
 ↑ "THE CROWN SOVEREIGN  Lite Paper (2021)". Archived from crownsterling.io on Sept. 26, 2021.
 ↑ National Institute of Standards and Technology (NIST) (March 23, 2020). "Crown Sterling Cryptographic Module" via nist.gov
 ↑ Omorog, Challiz D. and Gerardo, Bobby D. and Medina, Ruji P. (2018). "Enhanced pseudorandom number generator based on BlumBlumShub and elliptic curves". 2018 IEEE Symposium on Computer Applications & Industrial Electronics (ISCAIE). Via ieee.org.
 ↑ Blum, L.; Blum, M.; Shub, M. (1986). "A Simple Unpredictable PseudoRandom Number Generator". SIAM Journal on Computing (Society for Industrial & Applied Mathematics (SIAM)) 15 (2): 364–383. doi^{}:10.1137/0215025. ISSN 00975397.
 ↑ Saarinen, MarkkuJuhani O. (Jan. 1, 2022). ["However: the only reason to use publickey ("trapdoor oneway") components like Rabin's, BBS, or Dual_EC in hashing & keystream generation or entropy conditioning & DRBG is to have backdoors! AES, SHA3 modes ftw [=are the way to go]" https://archive.is/Et3z4]. Archived from Twitter on Feb. 5, 2024.
 ↑ Arciszewski, Scott (Oct. 29, 2016). "Don't use Insecure Userland PRNG for random_scalar()". Via github.com
 ↑ Rutkowska, Joanna (Apr. 23, 2011). "The Linux Security Circus: On GUI isolation". Via blog.invisiblethings.org
 ↑ Ghannam, Talal (Dec 18, 2019). "Should the seed of CSPRNG produce the same random number?". Archived from crypto.stachexchange.com on March 7, 2024.
 ↑ Ghannam, Talal (Dec. 12, 2019). "using non prime numbers in Blum Blum Shub or Blum Micali". Archived from crypto.stachexchange.com on Dec. 8, 2023.
 ↑ "Factor integer formed from first 100 decimals of Pi". Via WolframAlpha
 ↑ Toponce, Aaron (Oct. 19, 2024). "Remember Crown Sterling with their "TIME AI' cryptography nonsense at Blackhat? They now have a white paper (PDF)". Archived from reddit.com on Jan. 29, 2024.
 ↑ QuantumCTek (2024). "QKDPOL1250  Highspeed Quantum Key Distribution Terminal". Via quantumcomm.com.
 ↑ Valsorda, Filippo (July 6, 2022). "This MAXDEPTH is realistically around 2⁴⁰, which makes a quantum attack against a 128bit cipher take more than 2¹²⁸ anyway. This is because ideal Grover requires an unrealistically longrunning serial computation, and can't be parallelized well per https://arxiv.org/pdf/quantph/9711070.pdf". Via Twitter.
 ↑ Gagliardoni, Tommaso (Aug. 24, 2021). "Quantum Attack Resource Estimate: Using Shor’s Algorithm to Break RSA vs DH/DSA VS ECC" Via kudelskisecurity.com.
 ↑ Ottela, Markus (Oct. 30, 2021). "As per their "researcher", apparently there's a simple trick to generate postquantum secure ECDHE private values: Just don't use prime numbers, and the entropy will take care of the rest. :)". Archived from Twitter on Jan. 29, 2024.
 ↑ Squeamish Ossifrage (March 16, 2018). "Generating a NIST P256 private key". Via Cryptography Stack Exchange.
 ↑ Grant, Robert (April 7, 2019). "Grant sharing numerologist Pi woo". Via imgur.com.
 ↑ ^{147.0} ^{147.1} Emma Haruka Iwao (June 9, 2022). "Even more pi in the sky: Calculating 100 trillion digits of pi on Google Cloud". via Google Cloud Blog.
 ↑ Yee, Alexander (Oct. 25, 2023). "Formulas and Algorithms" Via numberworld.org
 ↑ Cederlöf, Jörgen (June 2005). "Authentication in quantum key growing" Linköping University. Via liu.se
 ↑ Crypto Museum (Aug. 4, 2015). "Dead drop spike". Via cryptomuseum.com
 ↑ Khurana, Dakshita (Aug. 27, 2020). "Pseudorandom Generators (PRGs), Stream Ciphers". Via courses.grainger.illinois.edu
 ↑ Runestone Academy (Jan. 20, 2022). "Newton’s Method". Via runestone.academy.
 ↑ Schmieg, Sophie (Dec. 31, 2021). "I was a bit bored, so I decided to reconstruct an integer from the fractional part of its square root. You never know when you might need such an algorithm, after all.". Archived from Twitter on Feb. 11, 2024.
 ↑ Boneh, Dan (Sept. 27, 2013). "Cryptography I  Stream ciphers and pseudo random generators" Via VideosCoursera
 ↑ Saarinen, MarkkuJuhani O. (Jan. 1, 2022). "...yes frac(sqrt(x)) is most definitely a bad oneway function if someone proposed it as such, and a slow one too." Archived from Twitter on Feb 5. 2024.
 ↑ Crown Sterling Research Team (May 22, 2022). "Let's say you want to reconstruct an integer using only a segment of its square root mantissa, starting at an arbitrary index. How would this method be applied to do that?". Archived from Twitter on Jan. 29, 2024.
 ↑ Grant, Robert (May 16, 2023). " Use of irrational number sequences to secure state transition function in blockchain transactions". Via patents.google.com
 ↑ ^{158.0} ^{158.1} ^{158.2} Schmieg, Sophie (Feb. 24, 2024). "Lattices vs Cranks". Via keymaterial.net
 ↑ Theon Technology (Nov. 15, 2022). "How to Reduce OTP Key Storage and Transmission Overhead". Archived from theontechnology.com on Nov. 28, 2022.
 ↑ Theon Technology Theon Technology website Archived from theontechnology.com (now defunct) on Nov. 29, 2023.
 ↑ Matthew Green (Sept. 20, 2019). "These Crown Sterling people are going to launch a cryptocurrency, mark my words.". Archived from Twitter on Jan. 5, 2024.
 ↑ U.S. Securities and Exchange Commission (SEC) Info (Dec. 22, 2020). Crown Sterling Ltd. LLC  Notice of an Exempt Offering of Securities. Archived from secinfo.com on Jan. 22, 2024.
 ↑ Popper, Nathaniel (Feb. 28, 2018). "Subpoenas Signal S.E.C. Crackdown on Initial Coin Offerings". Archived from The New York Times on March 1, 2018.
 ↑ Etherscan. "Create: WrappedCSOV". Via etherscan.io
 ↑ Polkadot. "Keypairs and Signing". Via wiki.polkadot.network.
 ↑ Ethplorer. "Token WrappedCSOV Holders". Via https://ethplorer.io
 ↑ Fmfw reviews Via trustpilot.com
 ↑ Global Fraud Protection (Dec. 22, 2023). "FMFW Review – Pumped Up Numbers, Offshore Laws, and More Revealed". via https://globalfraudprotection.com.
 ↑ Sarson Funds (Sept. 28, 2021). "A New Paradigm of Personal Data Sovereignty.". Archived from sarsonfunds.com on Dec. 8, 2023.
 ↑ Dirty Bubble Media (Feb. 24, 2023). "Don't Forget to Feed the Ponzi". Archived from dirtybubblemedia.com on March 1, 2024.
 ↑ /r/monero (Accessed March 1, 2024). "Distrusted by the Community". Archived from reddit.com on June 11, 2023.
 ↑ moneroexchange13 (April 11, 2018). "Major issues with changelly. Support does NOTHING. Changelly still trying to attract more customers.". Archived from reddit.com on June 10, 2023.
 ↑ Nttwo (Aug. 17, 2017). "Changelly scam... I think so.". Archived from reddit.com on June 7, 2023.
 ↑ [Deleted user] (Aug. 8, 2017). "Major issues with changelly. Support does NOTHING. Changelly still trying to attract more customers." Archived from reddit.com on June 10, 2023.
 ↑ TrustPilot (Accessed March 1, 2024). "HitBTC reviews". Via trustpilot.com
 ↑ [1]. Archived from reddit.com on June 11, 2023.
 ↑ shadomoon (Aug. 25, 2017). "HitBTC.com Scam  Stolen Tokens worth 150 ETH ($50,000 USD)". Archived from reddit.com on June 10, 2023.
 ↑ sQtWLgK (March 27, 2017). "HitBTC exchange suspends withdrawals "until the hard fork" ". Archived from reddit.com on June 6, 2023.
 ↑ Cointelligence (Jan 28, 2022). "(SCAM ALERT) HitBTC ". Archived from cointelligene.com on Jan. 28, 2022.
 ↑ ^{180.0} ^{180.1} Sanders, Richard (Dec 25, 2019). "(s)HitBTC holds <10% solvency, and selectively scamming more users than not". Archived from medium.com on Dec 27, 2022.
 ↑ Trustpilot (Accessed March 1, 2024). "BitMart reviews". Via trustpilot.com
 ↑ sitejabber (Accessed March 1, 2024). "BitMart reviews". Via sitejabber.com
 ↑ timz (Aug. 7, 2023). "(SCAM REPORT) Bitmart.com SCAM, stolen over $100k" via bitcointalk.org
 ↑ Trustpilot (Accessed March 1, 2024). "uniswap.org reviews". Via trustpilot.com
 ↑ Orsolya, Thomas (Nov. 19, 2023). "Don’t Fall For the Walletsuniswap.org Crypto Scam". Via malwaretips.com
 ↑ CoinMarketCap (Accessed March 1), 2023. "Top Cryptocurrency Spot Exchanges" Via coinmarketcap.com
 ↑ Grant, Robert (July 21, 2022). "DEFI Summit Conference  Day 2". Dcentral Con. Via YouTube.
 ↑ Grant, Robert (Nov. 17, 2023). "Introducing ORION Messenger". Archived from robertedwardgrant.com on Jan. 11, 2024.
 ↑ RazeHer, Geyblade (Jan. 29, 2024). "Is “Orion” by Crown Sterling Legit? Nope!". Via quackers.blog.
 ↑ Arcieri, Tony (Dec. 30, 2013). "What’s wrong with inbrowser cryptography?". Archived from tonyarcieri.com on April 27, 2022.
 ↑ Crown Sterling (Feb. 5, 2024). "In all seriousness, we've got a new whitepaper which will be published soon and will explain even more about ORION's cryptographic protocol. Here is the first look at the draft for anyone who wishes to take a peek". Archived from Telegram on Feb. 7, 2024.
 ↑ ^{192.0} ^{192.1} Crown Sterling (Feb. 7, 2024). "Crown Sterling's response to the heckler". Archived from Telegram on Feb. 7, 2024.
 ↑ cryptojs. Via https://www.npmjs.com.
 ↑ mdn web docs_ (April 7, 2023). "Crypto: getRandomValues() method" Via https://developer.mozilla.org.
 ↑ Günther C. G. (1990). "An identitybased keyexchange protocol". Advances in Cryptology EUROCRYPT '89 (LNCS 434). Pages 2937.
 ↑ Xixiang, Lv; Li, Hui; Wang, Baocang (Oct. 2012). "Group key agreement for secure group communication in dynamic peer systems". Journal of Parallel and Distributed Computing 72 (10): 11951200. doi^{}:10.1016/j.jpdc.2012.06.004. Retrieved Feb. 7, 2024.
 ↑ Arminius (Jan. 5, 2017). "How do traffic correlation attacks against Tor users work?". Via Information Security Stackexchange.
 ↑ Florêncio, Dinei; Herley, Cormac (May 12, 2007). "A LargeScale Study of Web Password Habits". Archived from research.microsoft.com on March 27, 2015.
 ↑ User:Premeditated Chaos (Nov. 4, 2021). "Wikipedia:Articles for deletion/Robert Edward Grant". Via wikipedia.org
 ↑ ^{200.0} ^{200.1} ^{200.2} ^{200.3} quasiprimes (Sept. 20, 2019). "Robert Grant of Crown Sterling". Archived from wordpress.com on Sept. 26, 2019.
 ↑ ^{201.0} ^{201.1} The Org (~2021). "Robert Edward Grant" Via theorg.com.
 ↑ ^{202.0} ^{202.1} UCI Samueli School of Engineering (Jan. 2010). "Robert E. Grant, Allergan Medical on Entrepreneurship". Via engineering.uci.edu.
 ↑ ^{203.0} ^{203.1} ^{203.2} ^{203.3} ^{203.4} ^{203.5} ^{203.6} Securities and Exchange Commission (~2005). "FORM 10K, BIOLASE TECHNOLOGY, INC." Via sec.gov.
 ↑ BioSpace (June 16, 2010). "Bausch & Lomb Names Robert E. Grant as CEO and President of Its Surgical Business". Via biospace.com
 ↑ BioSpace (March 29, 2006). "BioLase Technology, Inc. Expands Board Of Directors And Appoints Robert E. Grant As Acting Chairman". Archived from biospace.com on March 2, 2024.
 ↑ Ron Z (Dec. 14, 2011). "Organizational Announcement  Robert Grant" Archived from cafepharma.com on March 2, 2024.
 ↑ Anonymous (March 28, 2017). "BR is a great guy except for the part he played in helping R Grant dup millions out of physicians. Not sure what that says about his ethics or judgement. Maybe it was just a revenge play against AGN." Archived from cafepharma.com on March 2, 2024.
 ↑ Bausch + Lomb (May 2011). "Executive Leadership Team" Archived from [2] on May 6. 2011.
 ↑ Ophthalmology Times (July 1, 2010). "Bausch and Lomb appoints Grant for surgical business" Archived from ophthalmologytimes.com on March 2, 2024.
 ↑ Saunders, Brent L (Dec. 13, 2011). "Surgical Organization Update" Via cafepharma.com.
 ↑ Anonymous (Dec. 16, 2011). "Organizational Announcement  Robert Grant" Archived from cafepharma.com on March 2, 2024.
 ↑ BioSpace (Nov. 05, 2010). "Bausch & Lomb Makes Three Management Appointments To Surgical Business". Archived from biospace.com on March 2, 2024.
 ↑ Google Patents (Accessed 2019). "Google Patents  Inventor: "robert edward grant"; After: priority 20110901; Before: priority 20111031;". Via patents.google.com
 ↑ Anonymous (April 8, 2012). "Organizational Announcement  Robert Grant" archived from cafepharma.com
 ↑ Anonymous (Feb. 19, 2014). "Aesthetic Expansion" Archived from cafepharma.com on March 2, 2024.
 ↑ PR Newswire (July 22, 2013). "Strathspey Crown Establishes Alphaeon Corporation, The First SelfPay Lifestyle Healthcare Company". Via prnewswire.com.
 ↑ PR Newswire (Sept. 15, 2015). "ALPHAEON Launches ShoutMD 3.0, The First Social Commerce Store For Lifestyle Healthcare Products". Via prnewswire.com.
 ↑ ^{218.0} ^{218.1} Timecop (Nov 5, 2019). "TIMECOP  TIME AI". Via pastebin.com
 ↑ Internet Archive (Accessed March 15, 2024). "Wayback Machine: shoutmd.com". Via archive.org.
 ↑ Ghannam, Talal (June 2003). "Optical Solitons in a ThreeState Medium". Archived from scholarworks.wmich.edu on May 18, 2021.
 ↑ Ghannam, Talal (December 2007). "Quantum Properties of Light Emitted by Dipole NanoLaser". Archived from scholarworks.wmich.edu on March 22, 2020.
 ↑ ResearchGate (Accessed March 7, 2024). "Talal Ghannam". Via researchgate.com.
 ↑ Ghannam, Talal (2012). The Mystery of Numbers: Revealed through their Digital Root. CreateSpace Independent Publishing Platform. p. 476. ISBN 9781477678411.
 ↑ Ghannam, Talal (June 29, 2021). GeoNumeronomy: Unraveling the universe through numbers and forms. Independently published. p. 374. ISBN 9798527330397.
 ↑ ^{225.0} ^{225.1} Crown Sterling (Nov. 9, 2023). "Crown Sterling Limited LLC Founder Publishes Novel Geometric Model of Natural Spirals". Archived from prnewswire.com on Nov. 9, 2021.
 ↑ ^{226.0} ^{226.1} "Alan Green, Biography". Archived from tobeornottobe.org on Nov. 11, 2020.
 ↑ "Alan Green, Biography". Archived from tobeornottobe.org on Dec. 5, 2023.
 ↑ Green, Alan (Bard Code) (July 20, 2020). "Pyramid Structure of the Sonnets" Via YouTube.
 ↑ Green, Alan (Bard Code) (Dec. 1, 2020). "Bardcast™ 8  special guest Robert Edward Grant". Via YouTube
 ↑ Lehner, Mark (1997). The Complete Pyramids. London: Thames & Hudson. p. 112. ISBN 0500050848.
 ↑ Löhner, Franz; Zuberbühler, Teresa (2006). "The Great Pyramid of Khufu (Cheops)". Via cheopspyramide.ch
 ↑ Green, Alan (Bard Code) (Dec. 1, 2020). "Bardcast™ 8  special guest Robert Edward Grant". Via YouTube
 ↑ Gallagher, Sean (Aug. 29, 2019). "Snake oil or genius? Crown Sterling tells its side of Black Hat controversy". Via arstechnica.com.
 ↑ Margaritelli, Simone (Aug. 9, 2019). "HOW DARE YOU MAKE FUN OF THEM!! Don't you know that their Director of Cryptography "dedicated the last fifteen years to decrypting mathematical codes in Shakespeare’s writings that have revealed unknown sacred geometry hidden in the pyramids of Giza" FOR F SAKE?! BOW, NOW.". Archived from twitter.com on March 7, 2024.
 ↑ Grant, Robert E.; Ghannam, Talal; Kennedy, Amanda (March 20, 2019). "A Novel Geometric Model of Natural Spirals Based on Right Triangle Polygonal Modular Formations". Via ArXiv.
 ↑ Linkedin (Accessed March 7, 2024). "Linkedin, Naomi Mathew". Via linkedin.com
 ↑ Mathew, Naomi (March 2024). "POLYMATH Calculator Integrates Arithmetic, Geometry, Music & Cosmology: The Quadrivium". Via Youtube.
 ↑ Beres, Derek (Feb. 20, 2019). "How Spotify manipulates your emotions and sells your data". Archived from bigthink.com on Feb 2. 2024.
 ↑ Open source initiative. "Open source initiative". Via opensource.org