Crown Sterling

The Crown Sterling logo

I, the crown prince of Nigeria, offer you Scams

Hook, line, and sinker

Kevin Trudeau Pious fraud Pick-up artist Gold Homeophone Pseudolaw

Totally sounds legit!

Vulture fund Bernie Madoff Matthew Lesko Fiscal cliff Dinar revaluation Zion Oil and Gas v - t - e

Crown Sterling is a crank company that exists at the intersection of pseudoscience (numerology, Pythagoreanism, snake oil cryptography), and New Age occultism (including, but not limited to, pyramidology). It is a subsidiary of Strathspey Crown, both of which were founded by Robert Edward Grant (c. 1970–).

The company has presented several fraudulent claims about being able to break cryptographic algorithms, and peddled cryptographic snake oil products such as a cryptocurrency and a messaging app.

The prelude

The beginnings of Crown Sterling revolve around the 24-sector dartboard of quasi-primes, that the company's CEO, Robert Edward Grant, has been rehashing ever since he uploaded his PDF "Prime Number Pattern Associated with Icositetragons" online on June 6, 2018.

In the PDF Grant presented dart-board illustrations that re-invented Paul Pritchard's wheel sieve from 1982. In the dartboards on pages 4, 5, and 6, Grant claimed 1 was a prime number and that 2 and 3 are not prime numbers, most likely because reality didn't suit his grift of numerologist woo of perfect symmetry.

Also, perhaps because Grant missed e.g. the then-eight-year-old Stack Exchange thread on the subject, he deluded himself into thinking he had discovered a basic property of primes, that is, ∀p ∈ ℙ, p > 3: p²≡ 1 (mod 24), that is, every prime larger than 3 squared, minus 1 is divisible by 24. Only, Grant was 2000 years late for the party.

Finally, Grant redefined a subset of composite numbers as quasi-primes, pretended that it mattered, and ended with the following note:

“”Such a discovery may have far-reaching implications in the fields of mathematics, physics, chemistry, and cryptography among others.

—Robert Edward Grant (CEO, Crown Sterling)

The "may have" turned out to be quite short-lived, as on June 21st, 2018, just over two weeks later, Grant was already preaching the implications of the "discovery" and his plans to invent a new cipher to someone named Matthew Belair:

“”I figured out the pattern to be able to determine prime numbers accurately into infinity without any factorization whatsoever. By discovering a different type of prime number[…] called quasi-prime numbers. And those quasi-prime numbers are [composite numbers divisible by primes larger than 5, and they all have the same remainders as primes when reduced modulo 24]. Now, what's interesting from that, is that [all numbers on that chart that aren't composites], are by definition prime. [And we've now proven this with supercomputers and "infinite equations".] And nobody believed me, even my own research team. They're like "This isn't gonna work". I said, "Just run the calculation […] up to ten thousand". And one of my colleagues here, [Talal] Ghannam, says "Aah, Okay, I'll do it. […] he sends me an e-mail like at midnight that night saying, "Holy shit. […] we accurately predicted every single prime under the number 10 000". […] So it exactly sort of proved the theory, and we tested it further over the course of the next few days and published it the next day. And of course, we had every crypto person imaginable like call us up […] We didn't do this so that we could crack cryptocurrency even though every encryption on the planet is tied to prime number indeterminacy. Well, if it becomes determinancy, not indeterminacy, then you got a real problem with all encryption. So we are trying to figure out a way to create a new encryption now, that is fifth-dimensional, and I've been working on this for the last couple of days. It's very exciting stuff, and it will be what I'm referring to now as an infinite series of oscillating cryptography. And it'll be infinite. There's not going to be any more like 256-bit encryption and stuff like this. We're gonna kill all of it. And none of it is gonna be Prime-determined, either. Because we know that's inherently now weakened because you can predict primes into infinity now.

—Robert Edward Grant (CEO, Crown Sterling)

Establishing a unified narrative has been a struggle for the team from the get-go. Deciding on whether the quasi-prime "discovery" was important was one thing, but the staff also has been unable to even agree on who came up with the mental dandelion it mattered for cryptography.

Crown Sterling team member Adam Apollo describes the early stages of his relationship with Grant and Crown Sterling in his project portfolio:According to him, he met Grant in 2017, and one year later, after seeing Grant's dartboard, he came up with the insightful idea of "Hey, the RSA cryptosystem uses prime numbers. I wonder if being able to check if a number is a prime can make it trivial to break RSA encryption, you know, because.", and if Apollo is telling the truth, Grant must have jumped at Apollo's brain-fart, because according to Apollo, in December of the same year, he was already working for the company, developing what was to become a replacement for modern cryptography.

The preprint peddling

From the uploading of the dartboard PDF, it took merely nine months for Grant and his co-worker Talal Ghannam (a physicist gone crank) to upload the first part of their grift lore, a crank paper titled "Accurate and Infinite Prime Prediction from Novel Quasi-Prime Analytical Methodology".

The paper was uploaded to the arXiv preprint server, leveraging the fact Ghannam had previously uploaded to arXiv and could thus vouch for Grant. The paper then somehow passed arXiv's "Is the paper full of Lorem ipsum"-filter.

The crank paper itself made two claims:

1. The authors had devised an efficient primality test algorithm (that checks if a given number is a prime number).
2. The primality test could be used to solve the RSA problem, i.e., factor large semiprimes (product of two large prime numbers) to break the RSA cryptosystem.

In an interview with a fellow numerologist, Grant gave the date the interview was recorded (March 19, 2019), and discussed the implications of the "discovery":

“”We're very excited that Cornell University Press published this just yesterday […] I don't think we know enough yet to know how profound the implication is […]

—Robert Edward Grant (CEO, Crown Sterling)

Already, Grant couldn't help but lie about the process of academic publishing when he claimed that arXiv preprints are peer-reviewed publications. Grant has since made this mistake so many times nobody can say he doesn't know exactly what he's doing.

Grant's answer, about what he thinks the implications of his "discovery" are, had also done a complete 180, but only for a moment: Just two days after the interview, Grant was already doodling away the logo for his company's new cryptosystem in an Instagram post, and just seven days later the product trailer dropped.

The turd breaks the surface

On March 28, 2019, Crown Sterling pushed out its first promotional trailer to YouTube. TIME AI, the unholy matrimony of numerology and Retro Encabulator, was produced with the ridiculously high-quality CGI only VC money can buy. The trailer came bundled with the following word salad:

“”You are unlike any other. A beautifully unique human being, with integral patterns, patterns that become data, data that mirrors who you are, making its ownership and privacy essential to your individuality. In addition to all of your transactions, messages, and financial account data, today your private in-home interactions, geo-location, and even your own DNA are protected only by a single static encryption algorithm — now recognized by the world’s experts as obsolete. The Fibonacci sequence repeats every 24 cycles when viewed using digital root analysis — a pattern that can be represented with an icositetragonal spiral. By positioning integers in 24 positions for every 360 degrees, Crown Sterling solved one of the greatest mathematical mysteries of all time: Identifying for the first time, an infinitely predictable prime number pattern. These patterns also revealed an entirely new classification of non-prime numbers called quasi-primes, as well as a new understanding of how mathematical constants interact with primes, and quasi-primes, to propagate and mirror reflect in infinite wave conjugations. Academic researchers believe this discovery may be the key to unlocking a new unified physics cosmology, a theory of everything. This new discovery enables large prime factorization using standard computers, thus rendering obsolete all static factorizing encryptions, presently used in public key cryptography. More than ever before, now is the time for a new adaptive encryption granting you security and full control of your digital individuality. A new paradigm of data sovereignty made possible only, with time. TIME AI is an entirely new classification in data privacy called quantum encryption — an impenetrable system utilizing five dimensions of encryption technology. Rather than depending on prime numbers and only a two-dimensional static matrix, TIME AI introduces time and high-speed oscillations of infinite wave values of irrational numbers as its encryption modality. Using the infinite variations within music composed real-time by artificial intelligence, TIME AI generates quantum encryption keys as unique as your own iris. Each quantum public key is paired with two quantum private keys that are entangled through mirror symmetry mathematics in value, time exposure, and oscillation speed. These quantum keys change at the nano-scale of time, directed by state-of-the-art AI technology harnessing time's entanglement — one key from the past, and one key from the future, changing the number series one billion times per second, with no pattern. The speed of the AI oscillations allow 31,709 years of oscillations in a single second of data authentication. To unlock TIME AI, the future, and the past must converge perfectly in a split second, unpredictable by any known intelligence in the universe. And if ever attacked, TIME AI learns, forever adapting and evolving its defenses through incalculable and infinite variations. TIME AI is a simple, elegant solution that drops easily into any computer or IoT mobile device with standard memory and storage capacities. It is so adaptive, so impenetrable, and so unique to each user, even its own architects cannot break it. This quantum leap in data privacy is the work of Crown Sterling, a team whose mission is to reshape the foundation of encryption, providing total data sovereignty for all. Information privacy is the new frontier of freedom, and Time is your shield.

—Crown Sterling (TIME AI trailer)

The emphasized parts highlight lies used as FUD tactics to attack existing established cryptographic algorithms. For context, RSA is not considered "obsolete" because it's weak. The real reason it is being phased out in cryptographic protocols such as TLSv1.3 in terms of key exchange, is because using RSA omits an important property called forward secrecy, that protects from situations where an attacker, who gains access to the long-term private keys (that the use of RSA requires), can decrypt massive amounts of data retrospectively. RSA isn't dead, however, as it is still widely used for digital signatures.

The rest of the trailer sold the viewer vaporware that was an anthropomorphic AI — a ridiculous claim in of itself — and time-traveling cryptographic keys.

The video was dissected by Ph.D. student Mark Carney on Twitter on August 9, 2019:

“” "The world's experts think that the [singular] algorithm is obsolete" Well, no. There are two algorithms that pose a threat, and both of them only work on quantum computers. (Shor's algorithm and Grover's Algorithm) "The Fibonacci seq. repeats every 24 cycles" I don't even know what this means via 'digital root analysis' and I've actually analysed his 'digital root' function. Pass. >.< "Crown Sterling has made a breakthrough" Well, no. mod 24 isn't special, and I showed the general case for this. I haven't found anyone that actually proved the theorem I stated in my paper, but that's because it's a fairly easy application of well established theorems. "New classification of quasi-primes" Errrrrr noup... they're an established thing. See: https://encyclopediaofmath.org/wiki/Quasi-prime_number "Primes...something... mirror reflect... wave conjugations..." I'm genuinely not following that. "This unlocks a new physics cosmology - a theory of everything" Well, I mean, only if it's consistent for current models in Physics. you can probably show that 'No' is the answer "Static encryption is obsolete" I mean, since Shannon we've had the idea of 'One Time Pad', so I really don't know where this is going. "Infinite wave values of irrational numbers" WTF? "Entangled in near-symmetry mathematics" What were they smoking? "Quantum keys... one from the past... one from the future..." I genuinely have no idea what the fuck is going on now. "TimeAI learns..." DUH DUNN DUNN DUH DUNN... [Simplicity is the ultimate sophistication -Leonardo da Vinci] *drinks* "TimeAI is a simple (??) elegant" (If you're high) "Even its own architects cannot break it" Well, that's true of any cryptosystem. It's called Kirckhoff's principle "TimeAI fits onto any computer" So he's claiming to be able to do quantum key stuff on classical computers? Nah, sorry, that's not how that works... no qubits, no quantum computations. Likewise, for quantum cryptography, you need some way of generating a 'state' of a particle (usually polarisation of a photon/photons) and then a filter you can vary in order to get a reading. Cf: BB84 "Time is key to security" Ok, so, full disclosure, I *literally* helped write a book on time-based security, including a chapterload of maths, for @winnschwartau 's Analogue Network Security. I would like to think my dynamical models, ROC curves, OODA loops and such are a better approach than this... post-crackpipe rambling that I've just spent 4:30 of my life on. I'm prolly a bit biased, though x-P

—Mark Carney

Black Hat 2019

The train wreck of compounding public lies began with the CEO's presentation "The Discovery of Quasi-Prime Numbers: What Does This Mean For Encryption?" at the Black Hat conference on August 8, 2019.

The pre-party

For Crown Sterling, the event started with TIME AI pre-party, where Grant defined himself as a number theorist and mathematician despite only having a business degree, claimed RSA, elliptic curve cryptography, and the SHA-3 hash function (yes, really, Keccak), are all based on the RSA problem, and claimed to have created a new cipher during the Christmas break 2018 — which contradicts with Grant's own claims from his interview with Matthew Belair, where he said he had been working on the cipher since mid-June, 2018.

Furthermore, Grant spouted numerologist gibberish about nouns and verbs in mathematical syntax, and something about musical, circular geometry, and again claimed he was the first to have discovered that ∀p ∈ ℙ, p > 3: p²≡ 1 (mod 24). Grant also implied Numberphile did a segment on "his" discovery, ignoring the fact the segment was released back in November 2018, nobody in the academia knew who Grant was, and Matt Parker who hosted the episode didn't even mention Grant. Grant then claimed his system could compress an infinite amount of information into a finite memory, that the system uses AI to compose music, and that its public keys express quantum phenomena called quantum entanglement. Finally, Grant promised a consumer, an enterprise, and a government product, revealed they're completely new to the whole thing, and rolled the TIME AI trailer.

The talk

The next day, during his $115,000 pay-to-play talk, Grant presented his dartboard and quasi-prime preprint, repeated the lie that preprints on arXiv are peer-reviewed, spouted a bunch of numerologist gibberish such as "What we found is that phi is where light emerges from darkness", presented the false claim that Diffie-Hellman (another key exchange algorithm) was based on the RSA problem, and ended with the TIME AI trailer. The TIME AI "demonstration" that was promised in Crown Sterling's August 7 press release was never performed.

After the presentation, during the Q&A session, cryptographer Jean-Philippe Aumasson told Grant Diffie-Hellman is not based on factorization but on discrete logarithm problem, cryptographer Thomas Pornin reminded Grant of prior art that was the sieve of Eratosthenes Grant was rehashing, and last but certainly not least, Dan Guido, the CEO of Trail of Bits, called Grant out:

“” You uploaded that document to a website so you could get it reviewed though. You said you put it on a website that was Cornell-affiliated. And that’s arXiv. That’s like me saying I put information on Google Docs, so Google reviewed it. You're lying! This is a scam! […] It’s a scam, and you’re just using marketing material from this to trick a bunch of people months later, you’ll say you’re legitimate because you spoke at Black Hat. You should be ashamed of yourself, and all of you working for him should quit your[…]

—Dan Guido (CEO, Trail of Bits)

Talal Ghannam's deleted tweet that claims the reason the factorization method was not disclosed was security concerns.

Grant had underestimated how hated snake oil cryptography is among the practitioners of the field, and his attempt to exploit the prestigious conference caused an uproar. Black Hat organizers realized their mistake and deleted the talk. Shortly after, Grant showed what a good sport he was, and sued UBM LLC, the company behind the Black Hat conference, for breach of contract.

The aftermath

After the Black Hat 2019, Grant joined the discussion on Twitter and tried to challenge the cryptographer Jean-Philippe Aumasson — who was present in the sponsored talk — into a cracking contest. Cracking contests are a well-known bullshit method to assess cipher security, and Bruce Schneier has explained it in detail as early as 1998, hence why nobody bothered to explain what was wrong with Grant's proposal, to Grant.

Crown Sterling was given its James Randi-style opportunity when Jake Williams offered Crown Sterling USD25,000 to break a relevant size RSA-key in a controlled setting. Crown Sterling never took on the challenge.

The demands for Grant to publish their factoring methods grew on Twitter, so to avoid the pressure Talal Ghannam tweeted a lengthy (now deleted) post (see screenshot on the right), where he claimed the reason the factoring method was not disclosed, was they were concerned about public safety. Vacillating between positions of desire for full disclosure, or "we have nothing to hide", and on the other hand "responsible" behavior, suited well for the grifters trying to shake off unfavorable attention without admitting they had nothing. This is evident from never following up with promises to disclose the claimed method, and later Grant's complete 180°-turn regarding public safety concerns, when he would completely reveal several methods that he claimed to be even more efficient than this one.

To further shake the negative attention, Grant attempted to appeal to people's self-interest and laziness, by asking people why they cared so much, and by telling them they were wasting their time.

The lawsuit

Competitors

In their complaint Crown Sterling wept crocodile tears about how infosec experts calling them out was a "premeditated, orchestrated attack […] staged by certain industry detractors and competitors." (paragraph 9), as if discussing the upcoming snake oil presentation was some sort of coordination. The people calling Grant out were not competitors.

• JP Aumasson who at the time worked as the VP of Technology, Principal Research Engineer, and Principal Cryptographer in Kudelski Security, a company that has never competed in the fields of cryptocurrency or secure communication solutions with their own product, but that focuses on security assessment, audits, penetration tests etc. for existing ICT systems.

• Thomas Pornin works as the Technical Vice President of NCC Group, a consulting company that offers services, not in-house products.

• Dan Guido, who at the time worked as the CEO of Trail Of Bits, only offered consulting on Binary analysis, blockhain security, osquery support, software hardening, and secure implementation of cryptography in client products.

The claim that pointing out glaring factual inaccuracies (such that all public key encryption is based on factorization) that arose during the talk, was detracting, was as ridiculous as the talk itself.

The gold package

In paragraph 9 the company also claimed it purchased the "highest ('gold') sponsorship package". The truth is, gold package wasn't even the highest gold package. There existed four tiers above the one Crown Sterling bought: gold plus, platinum, platinum plus, and diamond packages.

Non-existent NDAs

In paragraph 11 the company claimed

“”This small group of detractors used this staged “event” to initiate a smear campaign on social media during the conference and immediately after.

—Crown Sterling

as if the participants of the conference where contractually bound to not discuss, or laugh at the talk afterwards.

Vaporware

In paragraph 15 the company claimed

“”Crown Sterling, a start-up company, is developing a novel, next-generation information security encryption solution that it believes will supplant the current industry standard RSA encryption platform and usher a new era and paradigm shift in data encryption.

—Crown Sterling

Despite these claims, the company never published a public key encryption algorithm of its own design. The paradigm-shift never happened. TIME AI was never demonstrated in practice, and extremely likely never even written as software. Further evidence of this is, the company only ever used bog-standard public key encryption schemes, such as NIST P-521 EC-DH, NTRUEncrypt, and CRYSTALS-Kyber, in all of their actual products.

An industry conspiracy

The company also misrepresented the relationship between industry experts and the ciphers in Paragraph 18:

“”Precisely because Crown Sterling was innovating away from the current RSA encryption standard, Crown Sterling expected some participants’ skepticism. Crown Sterling understood that many of the Black Hat participants are highly invested and entrenched in the RSA encryption model, and that Crown Sterling’s methodology will disrupt that model (which was developed in the 1970s), transforming how digital information will be encrypted and protected.

—Crown Sterling

Given that the industry has been moving away from RSA for key exchanges since the 2010s global surveillance disclosures, the claims that Aumasson, Pornin or Guido were somehow "entrenched in the RSA encryption model" is ridiculous.

E.g., on July 8, 2019, a month before Blackhat 2019, the Twitter account of Trail of Bits (the company led by Dan Guido) tweeted literally "Fuck RSA", while sharing a link to their blog post under the same title, "Fuck RSA".

The article explained how much the company loves RSA, by opening with the following statement:

“” Let me save you a bit of time and money and just say outright — if you come to us with a codebase that uses RSA, you will be paying for the hour of time required for us to explain why you should stop using it.

—Trail of Bits (July 18, 2019)

JP Aumasson retweeted the tweet by Trail of Bits the same day, adding the following comment:

“” Good piece about known risks with RSA, but "flat out unacceptable to use RSA in 2019" is too radical IMHO. Someone could probably list ECC failures and write a "Fuck ECC" post. The article for example omits to mention that PSS and FDH are more "misuse-resistant" than ECDSA.

—JP Aumasson

The documentation for the BearSSL library, written by Thomas Pornin, states that

“”RSA, ECDH and ECDHE key exchange are supported. The ECDHE key exchange offers “Forward Secrecy”, a desirable property by which actual key exchange secrets are transient and destroyed after usage, thereby presumably immune to ulterior theft in case of full machine compromise.

—BearSSL

Thus, as per Pornin, Elliptic Curve Diffie-Hellman (Ephemeral key exchange) should be favored over RSA, as it offers forward secrecy.

In conclusion, none of the people who criticized Grant's TIME AI were proponents of RSA.

Crown Sterling also tried to imply RSA was categorically outdated, by referring it to having been created in 1977, where as Crown Sterling would later use a much more modern technology of elliptic curve cryptography described as recently as 1985.

As for whose algorithms would end up being used in Crown Sterling products, fate, it seems, is not without a sense of irony. Crown Sterling later adopted the Argon2 algorithm for its Orion Messenger web-app. Argon2 was established as the de-facto password hashing function in the 2013-2015 Password Hashing Competition (PHC). This competition was initiated by none other than JP Aumasson. Furthermore, Argon2 builds on top of the BLAKE2 hash function, which was designed by — you guessed it — JP Aumasson.

Pay to play

In paragraph 22, the company states

“”Black Hat had ample opportunity to vet the talk. No one from or associated with the Black Hat conference at any time questioned the talk’s subject matter or inquired further about it.

—Crown Sterling

The truth is, Crown Sterling submitted their talk via sponsored talks, precisely because Black Hat wasn't vetting them. There is no reason to waste $115,000 on a talk, if it could get in with its own merits.

Good men, please do nothing

In paragraph 36 the company states it reached out to Black Hat USA, and

“”asked Black Hat to issue a public statement clarifying its neutral position concerning Crown Sterling’s encryption technology and denouncing the detractors’ abusive actions undertaken on its watch.

—Crown Sterling

This request for Black Hat to provide higher than deserved validation for TIME AI, an obviously snake oil encryption product (that wasn't demonstrated during the event, and that was never delivered), was ridiculous.

The settlement

On April 20, 2020, BlackHat and Crown Sterling settled the lawsuit.

According to an article in CyberScoop, the terms of the settlement were "confidential", a claim confirmed also by Crown Sterling in their own statement:

“”As part of the confidential settlement, both parties have agreed to refrain from providing further comment on this matter.

—Crown Sterling

Yet, Grant, the CEO of Crown Sterling, violated the confidentiality of the settlement on his personal Telegram channel on August 19, 2022, by revealing Black Hat had to pay them a settlement:

“”In your face Blackhat!! 🖕 🤣. Too bad you also had to pay us $$$$ in 2020 for your behavior.

—Robert Edward Grant (August 19, 2022).

Desperate times

The Glassdoor reviews of Crown Sterling reveal what the people inside Crown Sterling really think about the company and its management.

By September 2019, Grant's quasi-prime crankery had been refuted, and the company stood in the middle of the PR disaster that was Black Hat.

Two-thirds of the company staff had quit. At the end of July 2019, the company had 27 employees on its team roster. After Black Hat, at the end of the next month, only nine of the original team remained. And of those nine, Adam Apollo, Alan Green, and Talal Ghannam had apparently asked to be taken down from the company's online staff listing, as the team roster had only six original members. Two people appear to have joined Crown Sterling's team, but out of those two, Christine Bock doesn't have Crown Sterling listed in her LinkedIn bio, she instead appears to have been a hired consultant from CB Partners.

The Doghouse

Bruce Schneier's legendary snake oil debunking blog series The Doghouse had made a comeback on September 5, 2019, and the blog post had roasted the company and its key staff to ashes:

“”Crown Sterling is complete and utter snake oil. […][The TIME AI word salad] tick[s] three of my snake-oil warning signs—from 1999!—right there: pseudo-math gobbledygook (warning sign #1), new mathematics (warning sign #2), and extreme cluelessness (warning sign #4). Note the attempt to leverage Cornell’s reputation [in the quasiprime paper], even though the preprint server is not peer-reviewed and allows anyone to upload anything. (That should be another warning sign: undeserved appeals to authority.) […] Most of [the quasiprime paper] is wrong, and what’s right isn’t new. […] None of [the people who work for Crown Sterling] have demonstrated any cryptographic credentials. No papers, no research, no nothing. (And, no, self-publishing doesn’t count.) After the Black Hat talk, Grant — and maybe some of those others […] claimed that the patterns they found in prime numbers allowed them to break RSA. They’re not publishing their results “because Crown Sterling’s team felt it would be irresponsible to disclose discoveries that would break encryption.” (Snake-oil warning sign #7: unsubstantiated claims.) […] […] All of us can create ciphers that we cannot break ourselves, which means that amateur cryptographers regularly produce amateur cryptography. These guys are amateurs. Their math is amateurish. Their claims are nonsensical. Run away. Run, far, far, away. […] Not only is the company ridiculous, it’s litigious as well. It has sued ten unnamed “John Doe” defendants for booing the Black Hat talk. It also sued Black Hat […]

—Bruce Schneier

The second to last quote by Schneier, a legendary professional cryptographer and the author of the AES competition finalist Twofish:

“”All of us can create ciphers that we cannot break ourselves […]

—Bruce Schneier

highlights the cluelessness of Crown Sterling nicely, as TIME AI was marketed with the following intellectual masterpiece:

“”It is so adaptive, so impenetrable, and so unique to each user, even its own architects cannot break it.

—Crown Sterling (TIME AI trailer)

The RSA cracking circus

Grant has been very keen to believe any claim that existing cryptography is weak. On week 37, September 2019, Grant carelessly repeated the outlandish claim made by Treadwell Stanton DuPont, that they had broken the SHA256 hash function. To the surprise of no one, this claim turned out to be a lie.

To peddle his snake oil cryptography, Grant first had to create the demand, and that required breaking existing public-key cryptography. During his talk Q&A at Black Hat 2019, Grant had already fraudulently lumped Diffie-Hellman and its elliptic-curve variant into the same boat with RSA, by claiming both were based on the RSA problem:

“”Diffie-Hellman exchange is - that's more of the exchange methodology - I think a lot of people refer to that - but yes, it's all based on factorization of prime numbers. Including Diffie-Hellman, including RSA, including elliptic curves […] AES? No, I'm talking about all asymmetric key cryptography.

—Robert Edward Grant (CEO, Crown Sterling)

This was a flat-out lie, as:

• RSA is based on the RSA problem: Given large public key N, find factors p and q (that make up the private key) such that p⋅q = N),
• Diffie-Hellman is based on the discrete logarithm problem (DLP): Given common values (generator g and a large prime modulus p), and public key N, find private key s, such that gˢ mod p = N), and
• Elliptic-curve Diffie-Hellman is based on the elliptic curve discrete logarithm problem (ECDLP): Find the discrete logarithm of a random elliptic curve element with respect to a publicly-known base point.

With the convenience of that lie, all Grant needed to do was solve the RSA problem. After all, how hard could it be to undo multiplication? What would follow, was several fraudulent claims about Grant and his company being able to factor large semiprimes to break RSA.

The quasi-prime paper

A screenshot from Grant's Instagram shows Grant described the "Infinite Prime Prediction Method" to provide "unprecedented efficiency".

As a refresher, the crank preprint Grant and Ghannam uploaded to arXiv made two claims:

1. The authors had devised an efficient primality test algorithm (that checks if a given number is a prime number).
2. The primality test could be used to solve the RSA problem i.e., factor large semiprimes (product of two large prime numbers) to break the RSA cryptosystem.

Mark Carney

The quasi-prime paper was originally refuted by Mark Carney in July 2019, a month before Black Hat.

The abstract of the paper states the following:

“”A recent publication by Grant et al. [2] has revealed some innovations with respect to the checking and generation of prime numbers with which to crack cryptographic keys. We argue that their method is minimal, and go on to prove some general cases of the mathematics they present — specifically refuting two of their claims. We also present more computationally efficient methods, and use these as a spring board to refute the existence of any practical efficiency improvements coming from this methodology.

—Mark Carney

The paper's findings gives Grant's primality test the time complexity of Θ(n - (n/ln n)), where Θ denotes the exact time complexity.

Squeamish Ossifrage

In their Stack Exchange answer, Squeamish Ossifrage explains what they found in the paper:

“” In their arXiv draft (which they proudly claim Cornell University published even though anyone can upload a draft to the arXiv with no peer review), Robert Grant and Talal Ghannam: (§II) made the remarkable observation that every prime above 3 is congruent to ±1 modulo 6 (proof: 2 ∣ 6k ± 2 and 3 ∣ 6k ± 3; this is the newest result they recycled, several centuries old — first published no later than 1509 and first proven no later than 1603, according to Dickson pp. 7–9, but quite possibly known earlier because it's so obvious); (§III) reinvented the sieve of Eratosthenes several thousand years late; (§IV) discovered that x ↦ x mod 9 is a ring homomorphism (a technique known since antiquity and more commonly called ‘casting out nines’), and figured out that if x ≡ 3 (mod 9), x ≡ 6 (mod 9), or x ≡ 9 (mod 9), then x can't be prime (proof: duh); (§VI) deluded themselves into thinking if pq ≡ 1 (mod 10) then either {p mod 10, q mod 10} = {3,7} or p ≡ q ≡ 1 (mod 10) (counterexample: 19 ⋅ 29 = 551; perhaps they used ‘proof by trying numbers until I got bored’); and (Appendix) proved that p ≡ ± 1 (mod 6) implies p² ≡ 1 mod (24), a trivial consequence of the Chinese remainder theorem (CRT) first stated no later than nearly two millennia ago (proof: p ≡ ±1 (mod 2) so p mod 8 ∈ {1,3,5,7} so p² ≡ 1 (mod 8), and p ≡ ±1 (mod 3) so p² ≡ 1 (mod 3); hence by CRT, p² ≡ 1 (mod 3⋅8)). Earthshattering stuff, I'm sure you'll agree.

—Squeamish Ossifrage

Time and space complexity of the factoring method

On page 5 of the paper, the authors describe the algorithmic steps for "efficient primality testing":

“” In this paper, we are proposing an exact and fast method for checking the primality of numbers. To do so, we start by checking whether a number n passes the initial prime-criteria: being odd, having last-digit of [1, 3, 7 or 9], and digital root not equal to [3, 6, 9]. Once the number passes the above criterion, n is easily tested to whether it falls along any of the prime moduli of the chosen s-sides polygon or not. So, for s = 6, the prime should fall in either modulus 1 or 5. For s = 24, the prime-moduli are: 1, 5, 7, 11, 13, 17, 19, and 23, etc. By passing all the above criteria, we have reduced the dimensionality[sic] of the problem considerably. By requiring the selection of only 8 moduli from the total of 24, we have eliminated 2/3 of the numbers’ space that requires search activity. Searching for numbers ending with digits 1, 3, 7, and 9 along these moduli will further reduce the number of possibilities by 1/5. Therefore, the remaining percentage of the numbers’ space we need to search in is around 1/3⋅4/5 = 0.266, less than 30% of the total space.

—Grant et al. (2019)

The proposed 15/4-fold speedup leads to time complexity of 𝒪 ((4/15)n²), but unfortunately for Grant, in grown-ups' algorithm analysis, coefficients are ignored as insignificant when evaluating the algorithm's time complexity, and thus, the algorithm still runs in 𝒪 (n²), or quadratic time, which in the industry, is considered nothing short of "horrible". The reason for the quadratic time complexity comes from the algorithm's last step:

“” Once the number passes all the above, we proceed to the final step; to check whether it belongs to the Q-prime grid or not. If the original number n is found within the grid, then it is not a prime. Otherwise, it is a prime by definition.

—Grant et al. (2019)

On closer inspection, this seemingly innocuous step turns out to be quite the fine print, as Grant et al. conveniently fail to mention the work required to generate the Q-prime grid, and the memory requirements to store it.

The Q-grid and Quasi-primes

In the paper, the Q-prime grid is defined as a multiplication table, the horizontal and vertical headers of which contain:

1. The required range of primes
2. What the authors call quasi-primes, which are defined as composite numbers with prime factors greater or equal to 5.

However, for semiprime factoring (which is what breaking RSA requires), on page 6 the authors explicitly want to remove the quasi-primes from the grid's headers:

“”And because when we search for the prime factors of some semiprime number we need to remove the non-prime numbers from both axes of the Q-grid, like 25, 35, 49 etc., the problem will automatically reduce to simply locating the number in the Q-grid, with its horizontal and vertical projections on both axes being its prime factors.

—Grant et al. (2019)

Now, the multiplication table only has the required range of primes in its vertical and horizontal headers. The rest of the cells are semiprimes, that are the product of their matching header-cells' primes.

The same quote also presents the factoring method: perform a reverse lookup in a precomputed lookup table.

Determining the Q-grid size

The Q-grid's memory requirement depends on the area of the grid, which in turn depends on knowing the number of cells in the grid's headers that form the top and left sides. To know that, we need to know how many valid RSA primes are there, and to know that, we need to know the upper and lower limit for the valid primes.

The smallest and largest header value

The modern RSA key sizes are 2048, 3072, and 4096 bits, and some programs like OpenSSH support even 16,384-bit keys.

Since 3072-bits is the current recommendation, it will be used below. A 3072-bit RSA public key is created by multiplying two 1536-bit primes.

The primes in RSA have strict upper and lower limits to their value: For N bit public key, the primes must be greater than $2^{(N-1)/2}$, and lesser than $2^{N/2}$.

The number of primes in the header

To estimate how many primes the grid's header cells would need, the prime number theorem states the number of primes below n, is π(n) ≈ n / ln(n).

Calculating the number of all primes up to 3072-bit ones, and subtracting from it the too-small primes (up to 3071-bit ones), results in

$P={\frac {2^{3072/2}}{\ln(2^{3072/2})}}-{\frac {2^{3071/2}}{\ln(2^{3071/2})}}=6.6\cdot 10^{458}$ valid primes to choose from for each key.

Thus, the Q-grid for RSA-3072 has sides that are P = 6.6 ⋅ 10⁴⁵⁸ cells long.

Number of cells in the Q-grid

A naive Q-grid would have P² = 4.39 ⋅ 10⁹¹⁷ cells.

Q-grid size optimization

Due to the commutativity of multiplication, a little less than half of the multiplication table is duplicates. The diagonal center-line of the grid's cells has P unique values in it, thus the accurate number of duplicates is (P²-P)/2.

The number of cells in the optimized Q-grid is thus A = (P²-P)/2 = 2.19 ⋅ 10⁹¹⁷ cells.

Time complexity

The algorithm requires populating the grid by performing at least P = 6.6 ⋅ 10⁴⁵⁸ primality tests to fill the headers. It also needs to perform A = 2.19 ⋅ 10⁹¹⁷ multiplications to populate the grid, and an equal number of search operations to find the factors of the semiprime. These two latter steps both take in the order of n² steps, which means the factoring algorithm time complexity is locked to 𝒪 (n²), which, again, as a classification is considered "horrible".

The computational workload

To put the computational requirement of 6.7 ⋅ 10⁹¹⁷ operations on the scale, Frontier, the fastest supercomputer today performs 1.68 ⋅ 10¹⁸ operations per second, and by the time our Sun dies in five billion years, that supercomputer would have performed a measly 2.65 ⋅ 10³⁵ operations.

Space complexity

Storing (P²-P)/2 cells is in the order of n². This sets the space complexity of this algorithm to 𝒪 (n²), which is again, is considered "horrible".

The memory requirement

To keep the math simple yet fair, instead of 3072 bits per semiprime cell, and 1536 bits per header cell, we assume all cells are 1536 bits.

With 1536 bits per cell, the grid requires a meek 4.214 ⋅ 10⁹⁰¹ Exabytes of storage.

Storing 4.214 ⋅ 10⁹⁰¹ Exabytes of data runs into a lot of problems, the most pressing of which is, that there only exists 3.28 ⋅ 10⁸⁰ subatomic particles in the entire observable universe to use as memory, and to put it mildly, that's not enough.

The energy consumption

The Landauer's principle states that the most energy-efficient computer the laws of physics theoretically allow must consume at least 2.9 ⋅ 10⁻²¹ Joules per operation. Ignoring any factoring algorithms, just incrementing a counter in a program from 0 to 6.7 ⋅ 10⁹¹⁷, would have to consume at least 5.4 ⋅ 10⁸⁹³ Watt hours of energy.

In comparison, the Sun's total energy output to the space is only 3.86 ⋅ 10²⁶ Watts, which over its remaining, five billion year lifespan, yields "mere" 1.7 ⋅ 10⁴⁰ Watt hours in total.

Wasted effort

Building a complete Q-grid is completely unnecessary in any case. Constructing the grid requires determining all valid prime candidates. During this first stage, for every prime p generated, one can simply perform a trial division on the given semiprime N, to see if N ≡ 0 (mod p), or in layman's terms, to see if the prime p divides N evenly. If it does divide evenly, p has been found, and the other factor is q = N/p. With this method, the space requirement is removed entirely, the computing time spent on computing the grid's non-header values is eliminated, and no separate search in the grid needs to be performed. As this is essentially trial division, the time complexity improves drastically from 𝒪 (n²) to 𝒪 ( √(n) ).

This, of course, doesn't mean the algorithm can be made practical. Performing P = 6.6 ⋅ 10⁴⁵⁸ primality tests alone exceeds the lifetime of our Sun and the total energy it produces before it dies. Clearly, the authors have never even considered the actual steps required to run the algorithm in full. Alternatively, they knew full well, and they intentionally neglected the Q-grid having the most significant impact on the actual time complexity and pretended that the speedup coefficient of 4/15 mattered.

Misleading prime "prediction":

Crown Sterling has implied the findings of the paper allow "predicting" primes used in RSA:

“” […] Identifying for the first time, an infinitely predictable prime number pattern […] This new discovery enables large prime factorization using standard computers, thus rendering obsolete all static factorizing encryptions, presently used in public key cryptography.

—Crown Sterling (TIME AI trailer)

This is a lie. When they say "predicting", they don't mean predicting which primes were picked for the private key. They mean "predict" if some number is a prime, i.e. "primality testing". Primality tests are used in RSA key generation, where the system generates large random numbers and checks their primality. If an RSA key generation algorithm could break RSA, cryptographers "probably" would have noticed it. This is why Apollo's early pitch to Grant regarding primality tests influencing RSA security was so stupid.

As was shown above, the pool of valid RSA-3072 primes has 6.6 ⋅ 10⁴⁵⁸ primes to randomly choose from.

Even with an efficient primality testing algorithm (such as the Lucas-Lehmer primality test), being able to test if some number belongs in that pool of valid primes, doesn't help in any way to guess which two primes were picked at random from the pool.

Guessing the primes is 5.73 ⋅ 10³⁸¹ times harder than guessing the AES-256 key that was delivered using RSA, and that's used to protect the data in transit.

In layman's terms, the claim of predicting primes is exactly as useful for breaking RSA, as "predicting" if 72 is a valid number for a Powerball lottery ticket, is useful in winning the lottery itself. By knowing one is only supposed to guess numbers between 1 and 69, they're no longer guaranteed to lose, but they still need to beat the odds. Only with RSA-3072, the probability of guessing the primes, is comparable to winning the Powerball jackpot (1 in 292,200,000), 55 times in a row.

The "results"

Page 6 of the paper discusses the so-called results:

“” The algorithm is programmed based on the search criterion we mentioned earlier along with other supporting conditional statements that exploit the properties and geometry of the Q-grid such that the search is both effective and optimized. This has already been achieved by the team at Crown Sterling located in Newport Beach, California. The results were excellent, in terms of accuracy and speed, and were achieved by deploying laptops and desktops with standard specifications and computing power.

—Grant et al. (2019)

As the emphasized section shows, Grant and Ghannam have not even bothered to fabricate results for the paper. "Trust me, bro, the results were excellent" is the opposite of what an academic paper provides, and given that even kids at elementary school know answers such as "nuh-uh, not telling" gets them an F from any exam, it doesn't take a rocket scientist to know whether Grant's preprint would have passed an actual academic peer-review.

The aftermath

Grant's announcement about efficient semi-prime factoring with "Q-grid matrix method".

After the Black Hat conference, Grant tweeted about claimed improvements:

“”Dan Guido and Mark Carney you may have both missed my comment yesterday that our prime factoring efforts leveraged the icositetragon geometry, however, in the process we identified algebraic/geometric equation approaches, which we have not released, none require indexing.

—Robert Edward Grant (CEO, Crown Sterling)

Just under three weeks later, Grant announced on Instagram these claims were being written out by Grant and Ghannam as a paper, titled "Geometry-Based Prediction Algorithm of Semi Prime Numbers". The abstract blathered something about the "Q-grid matrix method", but the paper was never completed, most likely because Grant and Ghannam knew they were full of shit.

Further proof of this is Grant and Ghannam's book Philomath that was released almost two years later in 2021, that after rehashing what the quasi-prime paper said, states

“”Now, if the number n resides along or close to the reflection line of the Q-grid, then primality confirmation is simple. We only need to look for numbers at or close to √(n) on both axes of the grid. These two numbers will define two small strips that intersect on a small area where we need to look for this number. Beyond this area, numbers either get larger or smaller than n. On the other hand, if the number n is far from the reflection line, then solving the problem requires more complex analysis. Thus, devising algorithms that can search for these numbers without the need to calculate large portions of the Q-grid is an important step in refining and optimizing primality confirmation results. Similar to the case of primality testing, performing prime factorization using the Q-grid method requires the implementation of a search algorithm that is programmed based on the search criterion we mentioned earlier, along with other supporting conditional statements that exploit the geometry of the Q-grid. The problem's geometrical aspect will be explained further in Part III, where we discuss the many interesting and novel methods we have discovered in the process, which in return, rewarded us with so much insight into not only this specific problem but into so many aspects of the physical reality as well.

—Grant et al. (Philomath, 2021)

Part III discussed not the "Q-grid matrix method" but weird "Quadrant Symmetries", discussed quasi-primes that the authors had previously said have no place in the Q-grid for semi-prime factoring, showed that summing numbers produce sums of said numbers, threw in the words North and South, went into a tangent about quadrants of a unit circle and after hoping the reader had forgotten about what they were promised, ended with

“” All the above hints to an evident conclusion: that numbers are geometric in nature, and their affinity to circles is most obvious. Their real powers, properties, relationships, etc., are observed and make sense only when they are distributed circularly instead of linearly. This is something we observed early on in the D-space, as only when numbers are distributed around circles that their numeric symmetries and relationships become readily apparent and meaningful. Therefore, it makes no sense to separate numbers and geometry from each other; they should always be studied together as a coherent entity. It is only through this geo-numeric domain that scientific mysteries can be discovered and solved.

—Grant et al. (Philomath, 2021)

No "Q-grid matrix method" was ever presented, the authors never presented an efficient way to factor semi-prime numbers with the Q-grid, and the Q-grid of semi-primes was never mentioned again in the book (although the authors re-used the term "Q-grid" later in another context).

Most of the concepts that were in the "improvements" of part III of the book, were already present in Grant's PDF "Quaternion Symmetry Inherent to the Icositetragon" that he had uploaded online back on July 6, 2018. This begs the question: If Grant already had the supposed improvements one year before Black Hat 2019, why didn't he include them in the presentation? Why did he come to the conference with a method that has quadratic (worthless) time and space complexity, and then pretend he was doing active research on the topic when he had eight months to add the supposed improvements to the crank preprint he uploaded to arXiv? Why didn't the preprint even mention a work-in-progress regarding the Q-grid matrix method? The simple reason is Grant is making it up as he goes, and he knows his marks don't fact-check him, ever.

Summary

In summary, the described factoring method is a trivial reverse lookup in a massive table called the Q-grid. With relevant, average size RSA-keys (3072-bits), Q-grid's

• 𝒪 (n²) time complexity means the time requirement exceeds the clock counting to the death of our Sun,
• 𝒪 (n²) space complexity means the observable universe doesn't have enough particles to use as the memory for the grid, and
• Table population and search both have an energy requirement that is more than a perfect Dyson sphere could collect from our Sun during its remaining lifetime, to feed the most energy-efficient computer the laws of physics allow.

The algorithm's claimed speedup factor of 15/4 is so small it is ignored in the big-O notation.

In layman's terms, with modern key sizes, the size of the problem is comparable to being tasked with eating an entire pizza the size of Milky Way, our galaxy. Grant and Ghannam boasting that with their algorithm, one only needs to eat 4/15 of it, isn't exactly helping. Nobody has a belly big enough for the cosmic Margherita slices.

The later Q-grid matrix method that was claimed to cut the size of the original pizza was unfortunately for Grant, never backed by anything, and as Hitchens's razor states, that which can be asserted without evidence can also be dismissed without evidence.

The medicine show

After the refutal of his preprint, the Black Hat PR crisis, Schneier's searing article, and staff quitting Crown Sterling, Grant had to turn the tide. And he had a plan to crack RSA once and for all. On September 19, 2019, Grant hosted a medicine show for the press and non-technical men in suits. During the show, Grant and the company representatives factored a 256-bit RSA key with a program the company had titled the CS BiPrime Algorithm (ver. 1.1).

Plagiarism

See the main article on this topic: Plagiarism

Screenshot from the event video shows using SSH to connect to another computer in the local network, an impossible amount of RAM for a laptop, and the leaked CADO-NFS Info-message.

Unfortunately for Grant, the demonstration video showed how Grant's team had botched their efforts to suppress all Info-messages from the CADO-NFS program they plagiarized, as one of the messages, which is verifiable from the CADO-NFS August 2019 source code, popped onto the screen:

Info:root: Set tasks.threads=32 based on detected logical CPUs

This of course was noticed immediately the next day when the video went live.

Clearly, all Grant needed for success was an open source program, like CADO-NFS borrowed from its developers, and the idea of using someone else's technology to advance his grift, that he borrowed from Theranos.

Furthermore, on the video, one of the team members claimed the factoring was being done on the local device, that was an Apple laptop. However, judging by CADO-NFS output, the laptop apparently had an impossible amount of 97GB of RAM, and the team also managed to botch hiding the fact they used SSH to remotely connect to a beefier computer for the semiprime factoring.

Records from the Soviet age

Screenshot from Grant's Instagram on July 2, 2019, shows him spending the summer preceding Black Hat, fighting windmills that turn out to be random YouTubers' softball challenges. Grant's mischaracterization that 512-bit RSA takes over millennia to crack, is nothing sort of idiotic, given that 512-bit RSA was broken by Riele et al. on August 22, 1999, using the exact same algorithm Grant plagiarized, in just 5.2 months.

During the event Grant and his team factored a minuscule 256-bit RSA key, hoping the layman would not understand the difference between asymmetric and symmetric key strength, and incorrectly associate the 256-bit asymmetric RSA key they broke with 256-bit symmetric encryption (a key size often hand-wavily labeled as “military-grade”). The industry experts immediately passed warnings to journalists about the obvious attempt to mislead.

In reality, to break a key with 256-bit level symmetric security, Crown Sterling would have needed to factor a 15,360-bit RSA key. Such an attempt would have been unlikely to succeed, given that based on the public RSA factoring records, none of the people who are not lying, have publicly factored any RSA-key larger than 829 bits.

To put breaking a 256-bit RSA key in 2019 into the right context, a much larger, 330-bit key was broken by Lenstra et al. slightly earlier, April 1991 to be exact. Coincidentally, Lenstra happens to be part of the team that created the GNFS algorithm, that Grant plagiarized during the medicine show.

In fact, the key size is so weak, breaking it was used as a quick, beginner friendly, intermediate-level assignment in the CUCTF Capture the Flag event just weeks later.

“”I recently watched this amazing youtube video by Crown Sterling. They showed an advanced algorithm, the Crown Sterling BiPrime Algorithm (ver. 1.1), that was capable of cracking 256-bit RSA keys in under a minute. Now you have to implement it if you want to have any hope of cracking my secret message in time! Don't forget to merge and remove duplications after checking your disk space!

—CTFtime team (CUCTF 2019).

The assignment was so easy it was rewarded with only 150 points. The more challenging ones were awarded 600 points each.

On Crown Sterling's video, it takes 51.92 seconds to factor the 256-bit semiprime

83473593554391843334619428139045661537976651941410655062632649869770538548577

Cursory experiments show a relatively new, mid-price AMD Ryzen 7800X3D CPU factors the same semiprime with CADO-NFS in 44.67 seconds, even though it has half the number of threads compared to Crown Sterling's server they ran CADO-NFS on. Thus, the only logical reason for Crown Sterling to call the press to watch them do something anyone's workstation can do in the same time give or take a few seconds, was to mislead the audience.

These second-scale differences are as insignificant as the key sizes Crown Sterling broke, but they do show a decent desktop computer is already factoring semiprimes faster than the system in Crown Sterling's clown show did, and yet, the world keeps spinning. The second-scale differences did matter to the grifters though, who were desperately trying to get any positive press.

After Black Hat 2019, Grant had tried to challenge Jean-Philippe Aumasson not just into cracking their cipher, but also into a competition about who could break a 512-bit RSA key the fastest. The medicine show and its plagiarism shows Grant was hoping to change the public topic on Twitter from the relevant "who has the best algorithm when its time complexity is analyzed by experts on paper", into "who can afford the most expensive AWS EC2 instance to run the CADO-NFS on". When problem sizes approach the size of modern cryptographic key spaces, even a modest time complexity change affects the algorithm runtime by astronomical units of time. Competing over seconds in results is thus pointless, often within the margin of error, and always governed by computing power. No wonder nobody wanted to entertain another of Grant's PR grifts.

The absurdity and the obscene levels of crankery in the medicine show naturally led to the infosec community roasting the fudge out of the company on Twitter.

Reciprocal factoring

Screenshot of Grant's Instagram comment from Sept. 22, 2019, where he claimed reciprocal factoring will break large RSA keys.

After facing ridicule over the medicine show, Grant must have realized it was too late to convince the academia and industry, as he opted to publish his RSA factoring "algorithms" on the respected journal of Instagram wall.

On September 22, 2019, three days after the medicine show, Grant revealed on Instagram he had already put his business degree to good use and designed a replacement for the General Number Field Sieve (GNFS), the world's fastest classical factoring algorithm he had just plagiarized:

His idea was to find prime factors p and q of semiprime N from the decimal expansion of the semiprime's reciprocal, 1/N.

Impossible time complexity

Grant's Instagram post of reciprocal factoring. The red arrow points to the imperfect cropping edge that attempts to deceive the reader into thinking the primes exist trivially close to one another.

As the (lower) screenshot shows, Grant claimed the algorithm has an interesting property:

“”Paradoxically, the longer the BiPrime you desire to factor, the easier to locate the long consecutive prime string embedded within its 1/x reciprocal value.

—Robert Edward Grant (CEO, Crown Sterling)

Having solution complexity be inversely proportional to the size of the problem is the kind of claim a numerologist, who believes in literal magic, would make. Grant is essentially making the claim the algorithm runs in 𝒪 (1/n), which is faster than 𝒪 (1), or constant time, which happens to be the best possible time complexity classification for any algorithm.

As any meaningful algorithm cannot get faster as the input grows, this claim was so stupid it broke Hitchens's razor. Yet, that did not stop Grant from applying for a patent for this crankery, in the hopes of drawing authority from an established institution, and attracting investors with more money than sense.

Minuscule keys

On August 19, 2022, Grant announced his worthless patent, while his middle fingers did most of the talking about who he really is inside.

In an Instagram comment Grant claimed the method could break large RSA keys.

No exact definition for large was made, but it's definitely less than six inches, since in Grant's YouTube explainer, he says it works with keys that are "32-bit and all the way out". In Grant and Ghannam's book Philomath (2001), Grant reveals they were able to find prime factors for 24-bit semiprimes, and in his document on reciprocal factoring Grant et al. state they have limited their studies to "32-bit semiprimes at maximum".

No explicit claims of finding factors of relevant size (2048-bit or larger) semiprimes were presented. Grant's YouTube crankery video implied 2048-bit keys, but with that Grant stumbled and hurt himself badly with the shards of Hitchen's razor.

This did not stop Grant (and the co-author Ghannam) from blatantly lying about the origin of the factored semi-primes in their book Philomath, and thus from giving the semi-primes false credibility and their size ridiculously exaggerated importance:

“”After succeeding in finding the prime factors (one or both) for almost all 12-bit semiprimes, we randomly tested 4,027, 24-bit public keys provided by the RSA official website.

—Grant et al. (Philomath, 2021)

The claim that the RSA official website had 24-bit RSA keys is a complete lie: the smallest number ever hosted on the RSA Laboratories website was RSA-576, the range of RSA factoring challenges started from 100 digits, and the smallest RSA challenge, the RSA-100, had a 330-bit public key.

Lack of functional correctness

In his YouTube video, Grant claimed the algorithm only works with numbers whose reciprocal's decimal expansion is periodic. However, this is a lie, as e.g. 1/(11⋅13) = 0.006993… is periodic but does not contain the prime factors 11 or 13, as pointed out by the user Squeamish Ossifrage in their Stack Exchange answer. The algorithm therefore does not work reliably, even with small numbers.

Nonexistent efficiency

In his Instagram post, Grant implied the prime factors can be found relatively close to one another, implying the method is highly efficient in stumbling upon the prime factors. However, as explained by Squeamish Ossifrage:

“”The period of the decimal expansion of 1/pq for prime p and q is $\operatorname {lcm} (\operatorname {ord} _{p}10,\operatorname {ord} _{q}10)$, which is usually not much smaller than pq. If we model the expansion as a uniform random digit string pq (not log₁₀ pq, but pq) digits long, what's the probability of finding particular a $\log _{b}p$-digit string, namely p, in it? The expected number of times that any particular m-character needle appears as a substring of a uniform random h-character haystack in a b-symbol alphabet is (h − m + 1) b⁻ᵐ (proof: exercise for reader). Here $m\approx \log _{b}p$ and h ≈ pq, so this is about $(pq-\log _{b}p+1)b^{-\log _{b}p}\approx q.$ Cursory random experiments suggest that this is a reasonable model for the substring search, and I know of no theory that would suggest otherwise; it is up to the fraudsters to put up or shut up if they can prove anything better than this. In other words, in this model, there's a reasonable probability that the method works if you're willing to search through about (say) 2¹⁰²⁴ possible candidate factors of the 2048-bit semiprime in question. Which, as it happens, is essentially random trial division. The fraudsters make it look easy by showing a screenshot with the answer already highlighted in a selectively cropped fragment that skipped over thousands of digits — about as many digits as the value of the numbers we're searching for.

—Squeamish Ossifrage (2019)

Thus, not only does Grant's WolframAlpha screenshot show he has no idea how to implement his algorithms as programs, but it also shows his nonexistent Photoshop skills to cover his lie.

Furthermore, by resorting to random trial division, i.e. monkeys-bang-typewriters-until-Hamlet-comes-out technology, Grant reveals he has failed to understand the purpose and time complexity of bogosort (bogosort = bogus+sort). Always a strong sign of expertise when someone comes up with a proposal for an algorithm the equivalents of which are used in the basic literature of the field and Algorithms 101 college courses, as an example of the worst possible algorithm, and thus as a cautionary example of what one should definitely not do.

Summary

To summarize, after facing humiliation for factoring 256-bit keys 28 years too late, Grant decided to downgrade his CADO-NFS supercar into a soapbox, and factor 32-bit semiprimes with an algorithm that doesn't always work, that runs in 𝒪 ( √(n) ) which with RSA-3072 requires ridiculous 2¹⁵³⁶ operations, and that by the definition of bogosort class of algorithms, makes exactly zero effort to intelligently solve the semiprime factoring problem.

Pythagorean factoring

On Christmas Eve, 2020, Grant uploaded his third poke at breaking RSA: the Pythagorean factorization method.

The claims

Unsubstantiated claims by Grant, made on Telegram on April 8, 2022. RSA-keys with |p−q|10¹³⁰⁰, would have at least 8700-bit public keys. Asserted without evidence, dismissed without evidence.

In his post, Grant's claims reached an entirely new level of crankery:

“”Prime Factor-Based Encryptions (both RSA and ECC which are used by Bitcoin wallets […] is now rendered useless BEFORE the advent of powerful Quantum Computers due to a Right Triangle-based CONSTANT time mathematical solution. […] We were able to both immediately and successfully factor 1,000 Public Key values of various lengths/sizes.

—Robert Edward Grant (CEO, Crown Sterling)

The excerpt highlights three claims:

1. Grant fraudulently claimed his novel method of semiprime factorization could break not just RSA, but also ECC. However, as was shown above, elliptic curve cryptography is not based on the RSA problem. No example of breaking any size ECC key was given, most likely due to Grant having again cut himself with Hitchen's razor.
2. Grant also claimed he was able to factor keys of "various lengths/sizes", but he was somehow unable to specify the relevant part, the size of the keys. Factoring 1000 minuscule keys is of no significance. Factoring an unfactored large key from the pool of RSA factoring challenges, would be. On April 8, 2022, Grant claimed on Telegram they had been able to factor public keys with |p−q|>10¹³⁰⁰, which is what an 8700-bit RSA key would have.
3. Last, but certainly not least, Grant made the fraudulent claim the algorithm runs in 𝒪 (1), or constant time, which is nothing short of impressive, given that not even Shor's [quantum] algorithm, the bane of RSA, runs in less than 𝒪 (72(log N)²). A constant time algorithm solves a problem regardless of its size, in the exact same number of steps. Thus, Grant claimed to be able to factor any size semiprime, i.e., break any size RSA key, in the same number of steps.

The implementation

In his article Grant reveals that he used what he called the "Pythagorean Calculator", implemented in Microsoft Excel of all things. Always a solid sign when someone who claims to speak eight languages, struggles with learning a single programming language, a core tool for anyone implementing algorithms they design.

Grant left his reader base on the sidelines by not publishing the Excel document, but he did publish a ridiculous illustration with no beginning or end, presumably drawn with Microsoft Paint. Even so, the image conveys enough information to fully implement Grant's trivial algorithm. Below is one implementation, written in just fourteen source lines of Python:

import math

def pythagorean_factorization(semiprime: int):
    B = math.sqrt(semiprime)
    r = math.ceil(B) - B

    x = 0
    while True:

        # Solve leg A with the formula in Grant's image
        A = math.sqrt((x+r) * (2*B+(x+r)))

        # Note: Grant's 'ready-to-use' formula is
        # missing the square root used above, but it
        # is present in the bottom right of the image, 
        # where A=24 is obtained with sqrt(576).

        # Solve the hypotenuse with the Pythagorean theorem
        C = round(math.sqrt(A**2 + B**2))

        # Prime factor candidates
        p = round(C - A)
        q = round(C + A)

        if p * q == semiprime:
            print(f"The factors of {semiprime=}" \
                  f" are {p=} and {q=}." \
                  f" Factoring required {x+1} steps.")
            return

        x += 1

pythagorean_factorization(12193)

The results

Pythagorean Factorization steps as the function of key size. The graph shows how the number of steps needed to factor a key explodes at around the 50-bit key mark. The data point that is the 16-bit key in Grant's MS Paint implementation has been added on the graph (in red), to show just how deceivingly small and meaningless numbers his crank algorithms are demonstrated with. The values can be verified from the implementation.

Running the implementation reveals that factoring 12193, the 16-bit example semiprime Grant used in his weird Microsoft Paint implementation of the algorithm, requires 3 steps, that is, iterations of the while-loop. A cursory experiment of a slightly smaller semiprime 11379 shows it requires 1,792 steps. Having the factoring of a smaller semiprime take 597 times more steps, reveals Grant's algorithm runs in anything but 𝒪 (1), i.e., constant time.

Grant knows the number of steps varies, but as is typical with grifters, he has hidden this fine print in one of the images of the announcement, where the notation "x=1,2,3,4,5,6,..." reveals he expects x to get iterated (as it does in the implementation above), but Grant fails to acknowledge doing so completely voids the constant time claim.

More plagiarism

Closer inspection reveals Grant's algorithm is just a slightly obfuscated version of the 380-year-old Fermat's factorization method. This is also confirmed by the number of steps the algorithm takes. When compared with properly generated keys, the two algorithms take identical number of steps, regardless of key size. The only difference was, instead of brute-forcing the hypotenuse of the right triangle, Grant decided to move things around, and brute force the leg A instead.

On September 25, 2021, nine months after the Pythagorean Factorization Algorithm was uploaded, Grant et al. uploaded an article titled "The Sum Product Conjecture" where they "re-derive Fermat’s factorization identity^[sic] through a geometrical approach.", and "exploit its Pythagorean triangle configuration to investigate the relationship between the sum of two numbers and their product." Apparently taking credit for the work of one of the greatest mathematicians in human history was too much for even someone like Grant. This however, did not prompt Grant to issue corrections in the original upload, where he would give credit to Fermat, and where he would retract the absurd and obviously false claims about the time complexity.

The 𝒪 (1) lie

Fermat's factorization method time complexity is governed by the distance of the two primes, and its time complexity is ${\mathcal {O}}{\bigl (}{\frac {|p-q|^{2}}{4{\sqrt {n}}}}{\bigr )}$.

With random primes, i.e. in the normal case, the method runs in 𝒪 ( √(n) ) time.

The 2023 paper by Shatnawi et al. states on page 7 that "N can be factorized in 𝒪 (1) if the [prime factor] difference is small". On page 9 the exact formula for the constant time bound is given:

"N can be factorized in 𝒪 (1) when p³ − 2p²(q+1) + p(q²+1) ≤ 2N where p>q."

Thus, Grant's claim for 𝒪 (1) time complexity without constraints, is a lie. 𝒪 is used to denote the upper bound, i.e., the worst-case scenario. Since Fermat's factorization method Grant was rehashing runs in constant time only in the best case, i.e. when |p-q| is within the constant time bound, the correct marking for that constant time lower bound with random keys, is Ω (1), not 𝒪 (1).

In layman's terms, the distinction between these two is not exactly a nuance. In the context of the Powerball lottery, the Ω (1) means in the best case, one could win the lottery, whereas 𝒪 (1) means one is going to win it every time after a small fixed number of tries, no matter what.

A rigged challenge

Because of the absurdly efficient best-case scenario of Fermat's algorithm, Grant was able to rig his semiprime factoring demonstrations. By choosing semiprimes with the prime factors close enough to one another, any size semiprime, even ones that match the size of modern RSA key sizes, seems to factor in constant time. This rigging can not be detected just by observing the semiprime. It can only be done after the factoring has been done, by seeing if |p-q| is within the constant time bound presented above. The illustration serves as another layer to hide this. A step-by-step analysis of the MS Paint implementation, shows how the work has been done beforehand, as the illustration has the value of x pre-baked into the image. Similarly, Grant presented his Excel calculator (on a now-deleted video) with small enough numbers his computer could fill the Excel document cells faster than the human eye can see, which then allowed Grant to imply all values of x are calculated at the same time, and not cell-by-cell.

It however turns out, that with real RSA, there are no rigged challenges, and there is no Ω (1) case.

The attack that never existed

On page 9 of the original RSA paper (1978), the authors Rivest, Shamir, and Adleman state:

“”To gain additional protection against sophisticated factoring algorithms, p and q should differ in length by a few digits[…]

—Rivest, Shamir, Adleman (1978)

The dangers of the prime-factors p and q being close to one another was thus known by the RSA authors before RSA was published, and the attack never existed for properly implemented systems.

The required checks for prime distance are usually expressed as $|p-q|>2^{nBits/2-100}$, and are present in both the modern implementation requirements, and modern cryptographic libraries.

This hasn't prevented inexperienced programmers from implementing their own naive, and thus vulnerable, RSA key generation programs. Fermat's algorithm has been used as recently as 2022, to break certificates of Canon and Fujifilm printers, as well as four random PGP keys.

But broken novice implementations do not mean RSA is broken. They only mean Grant either never even bothered to read the then-41-year-old paper, or he read it and decided to append his grift lore with another lie.

Summary

A bit over a year after constructing his soapbox to replace his CADO-NFS supercar, Grant spent his Christmas Eve 2020, riding a Berlin carriage he stole from the Musée Fermat.

With fraudulent claims to be able to

• Break ECC, yet never back up that claim with anything,
• Factor 8700-bit RSA keys, yet only factoring a 46-bit RSA key, that was rigged with small prime factor distance, and
• Factor any semiprime in 𝒪 (1), or constant time, yet to have the algorithm turn out to be Fermat's factorizing algorithm with a fresh coat of paint, and that runs in useless 𝒪 ( √(n) ) time, as the Ω (1) best-case Grant boasted about, was identified and mitigated by the authors of RSA back in 1978, before RSA was published,

Grant rode around until he noticed the license plate wasn't his, and then proceeded to tell all about it in his article "Horse Carriage Conjecture", where he investigated the relation of the cart wheel's diameter and circumference, and re-derived Pi.

Geometric factoring

It's simple, we draw the primes

Grant's original "publication" of geometric factorization on Telegram on April 7, 2022

As his fourth RSA cracking napkin math example, Grant shared his crank geometric factorization equation on Telegram, on April 7, 2022. The crank equation wasn't even an algorithm, but a geometric equation, and Grant's proof was anything but proper algebraic geometry. It was a class example of "proof"-by-scruffy-picture. It implied any large RSA public key or semiprime could be factored simply by creating an image where the hypothenuse of a right-angle triangle would cross some points.

Scaling issues

A common theme with Grant's grifts is, that the presented methods appear to work, but only do so with tiny semiprimes. This equation is no exception.

The immediate problem with this equation is trying to draw the picture with integer-level precision. That level of precision is the minimum requirement when trying to find a prime, as all primes are integers. With 0.0625-inch technical drawing paper and one integer every 0.0625 inches, fitting a 1536-bit prime of an RSA-3072 key, would require a paper width of 4.3⋅10⁴⁴³ light-years. Unfortunately the observable universe is just 9.4⋅10¹⁰ light-years across.

Computers are no different. Storing geometric surfaces with (2¹⁵³⁶)² = 10⁹²⁴ pixels, runs as with all Grant's algorithms, into the issue of the observable universe running out of subatomic particles to use as memory. There are, again, only 3.28 ⋅ 10⁸⁰ of them.

The inequation

The major issue with Grant's Geometric Factorization doodle is, that his claim about the intersections of the hypothenuse of the right triangle is a straight-up lie, obfuscated by the lack of resolution and by the large green markings covering the area. The refutal of this crank equation shows this in practice, by re-creating the image with exact values in GeoGebra, and by showing that even with the claimed correct answers for p and q, and with zoom to mere tenths or less, there is no intersection and thus, the equation does not hold.

The step-by-step refutal of the Geometrical Factorization crank equation shows, that simple zooming reveals there are no intersections between the hypothenuse (blue line) and relevant intersections A, B, and C (in pink).

Conclusion

To summarize, here are the RSA factoring algorithms relevant to Crown Sterling's case, arranged by their true time complexity, from best to worst.

Crown Sterling name	Real name	Real author	Claimed time complexity (or efficiency claims)	True time complexity	Largest RSA key broken	Notes
n/a (Listed for comparison)	Shor's algorithm (1994)	Peter Shor	n/a	𝒪 (72(log N)²r)	5 bits	Requires a sufficiently large quantum computer
CS BiPrime algorithm (2019)	General Number Field Sieve (GNFS) (1993)	Lenstra et al.	Implied RSA-15360 (with 256-bits of symmetric security) breaks in under one minute [source]	${\mathcal {O}}{\biggl (}\exp \left(\left((64/9)^{1/3}+o(1)\right)\left(\log n\right)^{1/3}\left(\log \log n\right)^{2/3}\right){\biggr )}$	829 bits	Plagiarized
Pythagorean Factorization (2020)	Fermat's factorization method (1643)	Pierre de Fermat	𝒪 (1) [source]	𝒪 ( √(n) )	16 bits	Plagiarized
Reciprocal Factorization (2019)	Random trial division	Robert E. Grant	𝒪 (1/n) [source]	𝒪 ( √(n) )	32 bits [source]	The factoring equivalent of "shuffle deck of cards until it's sorted"
Infinite Prime Prediction (2019)	Multiplication-table reverse-lookup	Robert E. Grant	"Unprecedented efficiency"[source] "The results were excellent"	𝒪 (n²) [source]	0 bits	𝒪 (n²) space complexity
Geometric Factorization (2022)	n/a	Robert E. Grant	Implied 𝒪 (1): Just complete the equation [source]	⊥ [source]	n/a	The method does not work

• The CS BiPrime Algorithm was the best algorithm ever demonstrated by the Crown Sterling team. However, both the algorithm (GNFS) and its implementation (CADO-NFS) were plagiarized. GNFS is not able to factor even RSA-1024, let alone modern RSA-3072.
• The Pythagorean Factoring algorithm was also plagiarized and grossly misrepresented. The authors claimed it runs in 𝒪 (1), but in reality that happens only in the best case. The syntax for best case is Ω (1), not 𝒪 (1). Since the issue of small prime distance |p-q| has been addressed in all proper RSA implementations since its conception, the average case for the algorithm is 𝒪 ( √(n) ) which makes it useless.
• The Reciprocal Factoring algorithm makes no intelligent effort to solve the problem. The reciprocal value 1/N is effectively a poor man's random number generator, and stumbling upon the prime factors takes in the order of √(n) steps which sets the time complexity at useless 𝒪 ( √(n) ).
• The Infinite Prime Prediction pattern requires performing reverse lookups from a multiplication table the size of which is in the order of n², which sets both the time and the space complexity to horrible 𝒪 (n²).
• The Geometric Factoring equation straight up doesn't work as the equation provably does not hold.

The Pythagorean and Reciprocal factoring methods presented appear to work because they were demonstrated with minuscule key sizes. Their shared time complexity of 𝒪 ( √(n) ) means the algorithms grind to a halt at 180-bit RSA, long before they can factor relevant size RSA-3072 keys.

The purpose of the napkin-math algorithms (Pythagorean, Reciprocal, and Geometric Factorization) is mostly to leech off admiration from Grant's numerologist fan base who unfortunately for themselves, lack the formal training in mathematics and computer science to be able to tell the napkin math is worthless.

Despite claims to crack 2048-bit RSA (with Reciprocal factoring), and 8192-bit RSA (with Pythagorean factorization), Grant and his team have not managed to solve even a single unsolved RSA factoring challenge. These challenges exist exclusively to track the progress of attacks against RSA.

With all that being said,

• The refutals of the methods presented above,
• The endless factual errors and lies made by Grant,
• The claims of having supposedly solved the RSA problem multiple times, yet still forgetting about it a week later, instead of hosting another press conference,
• The need to plagiarize the work of others,
• The incompetence in time complexity analysis,
• The inconsistency of coming up with algorithms that have factually worse time complexity than what they have already plagiarized,
• The inconsistency of coming up with algorithms that have worse time complexity than what they claim to already have,
• Peddling a method like Geometric Factorization that straight up doesn't work, and
• Not claiming the glory and global press coverage from winning the RSA-2048 factoring challenge,

all say Grant and his team have absolutely nothing of substance when it comes to breaking RSA.

To give some perspective on what real cryptanalysis of RSA looks like, Claus Schnorr's 2021 (failed) attempt highlights the complexity of the math involved in efficient attacks.

More plagiarism

Textual comparison between Crown Sterling's article and ZDNET's original article shows the article was plagiarized word-for-word.

To seem more legitimate as a cybersecurity company, Crown Sterling pushed out topical articles. On March 23, 2020, Crown Sterling's newsroom published an unauthored article titled "Cybersecurity: Under Half of Organizations are Fully Prepared to deal with Cyberattacks". This article was plagiarized word-for-word from ZDNET's article under the same title, written by Danny Palmer. The only changes were the Americanization of the word "organisation" to "organization", and changing the apostrophe styling. The article has since been removed by Crown Sterling.

Snake oil cryptography

After lying about all public key encryption being based on the RSA problem, and lying about RSA being weak, Crown Sterling was ready to release its own cryptography, and to the surprise of absolutely no one, it was as full of lies and deceit as their earlier claims, and as broken as one would expect from numerologists, who try to solve post-doctoral-level research problems in a sophisticated branch of applied mathematics, with middle-school-level math.

In September 2021, Crown Sterling released its Lite Paper. Later, the same year, the company released a more detailed, full White Paper titled "Crown Sterling - Cryptographic Security Protocol".

In these documents, the authors described a broken cryptographic protocol built from broken cryptographic primitives.

Broken RNG

As stream cipher's cryptographic keys and nonces all depend on cryptographic randomness, it's vital for any cryptosystem to use a proper cryptographically secure pseudorandom number generator (CSPRNG).

Oh, the irony

Using non-standard RNG shows up nicely in Crown Sterling's FIPS certificate. "No assurance of the minimum strength of generated keys" is quite telling.

In their White Paper, the authors reveal what they decided to use as CSPRNG:

“”The RBG general design is based on the cryptographically secure Blum-Blum-Shub (BBS) generator.

—Crown Sterling, Full White Paper (2021)

Blum Blum Shub is a CSPRNG from 1986. It is rarely used because it's computationally heavy and slow.

Its authors have proven its security reduces to factoring of large semiprimes which is exactly the type of cryptography Grant has been trying to get rid of since his Matthew Belair interview in summer 2018, where Grant said:

“”[…] And none of it is gonna be Prime-determined, either. Because we know that's inherently now weakened because you can predict primes into infinity now.

—Robert Edward Grant (CEO, Crown Sterling)

Questionable choice

In his tweet cryptographer Markku-Juhani O. Saarinen explains why the selection of Blum-Blum-Shub was highly questionable:

“”However: the only reason to use public-key ("trapdoor one-way") components like Rabin's, BBS, or Dual_EC in hashing & keystream generation or entropy conditioning & DRBG is to have backdoors! AES, SHA3 modes ftw [=are the way to go] 😅

—Markku-Juhani O. Saarinen

A point that needs repeating. Professional cryptographers think the only reason to select Blum-Blum-Shub as the DRBG, i.e. the random number generator, is to have a backdoor.

Userland seeds

On page 4 of the White Paper, the authors explain how the BBS RNG is seeded:

“”The [CrownRNG] Daemon gathers entropy from many random system processes, including the pc metrics, such as the Heap, Memory, and stack, along with mouse movements and clicks, keyboard strokes, etc.

—Crown Sterling, Full White Paper (2021)

As Scott Arciszewski explained to the Monero project in October 2016, userland PRNGs are considered antipattern. This includes things like keystrokes that can in cases like the X window system, leak a major part of the RNG's seeding entropy to any malicious program running on the system.

The protection ring model shows Kernel is the most privileged part of the operating system and using less privileged CSPRNGs is an extremely vulnerable design; leaked internal state of an RNG breaks all cryptographic systems that rely on the RNG.

Judging by Talal Ghannam's Stack Exchange question, the team apparently struggled even with understanding the concept of what a seed is, when he asked if a CSPRNG (which is a deterministic algorithm) could be made more secure by having it function non-deterministically (impossible) with some seed. The company was thus definitely not in a place where it should be designing its own CSPRNG.

I wonder what this knob does

Despite Grant's earlier lies, the truth is, that semi-prime factoring remains a hard problem and thus, BBS remains a secure CSPRNG, if left as such. So naturally, to ensure maximum crankery, after Talal Ghannam had asked about the topic on December 12, 2019, and received no reply, Grant and his team, in their numerologist paranoia, just went ahead and changed stuff:

“”In the original BBS, the mod is computed from the product of two prime numbers, whereas CrownRNG uses the truncated irrational numbers coming from the Functions Table.

—Crown Sterling, Full White Paper (2021)

The team replaced the semi-prime factorization problem of BBS, with factoring decimal expansions from irrational numbers, which unlike the numerologists would like to believe, are not magical, but your average everyday composite numbers, and thus trivial to factor. E.g., WolframAlpha can factor the number

14159265358979323846
26433832795028841971
69399375105820974944
59230781640628620899
86280348253421170679

created from first 100 decimals of Pi in seconds.

Aaron Toponce, a security and system engineer, explained on Reddit exactly how this influences the RNG behavior:

“”By not using Sophie Germain safe primes, they are shortening the length of an already short cycle. The maximum cycle length of BBS, is λ(λ(pq)), where λ is the Carmichael function. This is only guaranteed given the conditions in the original paper. Any other p and q, such as irrational numbers, will likely shorten the cycle length. Exempli gratia using Wikipedia, if p = 11 and q = 23, then λ(λ(11 * 23)) = 20. But λ(λ(12 * 23)) = 10, literally half the cycle length. This shit can't just be manipulated however you see fit. Math, how does it work?

—Aaron Toponce

An RNG that has a short period starts repeating itself much sooner. This means the attacker can store its complete output, try all subsections of it, and easily break everything that relies on the RNG's output, which might include password and key generation including cryptocurrency wallet private keys, nonces, initialization vectors, etc.

Quantum encryption

Since TIME AI, the company has been advertising quantum encryption:

“”[…] Using the infinite variations within music composed real-time by artificial intelligence, TIME AI generates quantum encryption keys as unique as your own iris. Each quantum public key is paired with two quantum private keys that are entangled through mirror symmetry mathematics in value, time exposure, and oscillation speed. These quantum keys change at the nano-scale of time,

—Crown Sterling (TIME AI trailer)

Quantum encryption isn't a thing outside quantum key distribution (QKD), and QKD isn't an app. It requires dedicated fiber optic cables as quantum channels, installed in fully connected network topology. Anyone who's ever had to install the last mile of fiber to connect online can probably guess how much it would cost to install an all-the-way fiber between their house, and the house of every peer they have, and then throw on top of that the very, very expensive hardware (one for each peer) that's capable of handing an actual QKD protocol such as BB84, so one can talk to them.

However, it turns out QKD is only needed to make cryptography provably unbreakable. It isn't needed to make cryptography secure against quantum computers.

One-minute crash course

Cryptographic algorithms are built typically as hybrid cryptosystems, where symmetric-key cryptography is used to protect content in transfer, and public-key cryptography is only used to exchange the key for the symmetric cipher. The slow advances in quantum computing have implications for these two types of cryptography.

Symmetric algorithms are affected by Grover's (quantum) algorithm which has the efficiency of 𝒪 ( √(n) ). This means it cuts key-strength of symmetric ciphers in half. This means 128-bit ciphers are reduced to too weak 64 bits, but 256-bit symmetric ciphers remain secure as their security is only reduced to 128 bits. This algorithm runtime is however only theoretical. In practice, the circuit depth is limited to roughly 2⁴⁰ logical gates, which means breaking 128-bit AES requires more than 2¹²⁸ operations.

Asymmetric, or, public-key cryptography is matched against Shor's (quantum) algorithm, that can break RSA, Diffie-Hellman, and its elliptic curve variant regardless of key size, as it runs polynomial in log N time, that is, in a reasonable time. Because of this, public key cryptography is in transit towards post-quantum algorithms.

Grant and his team probably opened up the news and realized this at some point, as they decided to pivot from snake oil "quantum cryptography" to snake oil post-quantum cryptography.

The "post-quantum" key exchange

After much hype about their system being secure against quantum computers, Crown Sterling finally revealed their post-quantum suite in their White Paper on page 21:

“”CrownEncrypt implements the Diffie-Hellman public-key exchange protocol, […] Elliptic-curve Cryptography (ECC) is more secure than RSA and requires smaller encryption keys for the same level of security.

—Crown Sterling, Full White Paper (2021)

So after all that hype, their strategy to beat quantum computers was to use elliptic-curve Diffie-Hellman (EC-DH) for key exchange. What makes this choice particularly stupid is, that not only is EC-DH vulnerable to Shor's algorithm, but breaking EC-DH requires a much smaller quantum computer than breaking RSA does, as the estimate table from Kudelski Security shows:

Symmetric security	RSA bits	Qubits required for Shor's alg. against RSA	ECC bits	Qubits required for Shor's alg. against ECC
112	2048	4098	224	2042
128	3072	6146	256	2330
192	8192	15362	384	3484

And then it got even more stupid

When questioned about how EC-DH could be made post-quantum in Crown Sterling's Telegram channel, Naomi Mathew, a Crown Sterling research team member revealed their strategy:

“”We alter the elliptic curve encryption to eliminate the issues associated with the elliptic curve that Bitcoin uses. By using an irrational number as a private key in place of a prime number, (prime numbers are susceptible to decryption due to their patterned distribution) we are able to introduce a significant amount of entropy to the encryption.

—Naomi Mathew, Crown Sterling research team

Mathew's response is phenomenal in all of its crankery.

Elliptic curve private keys are not prime numbers

As explained by Squeamish Ossifrage on Stack Overflow:

“”A NIST P-256 secret key (for ECDH or ECDSA) represents any scalar modulo ℓ for ℓ = 2²⁵⁶ − 2²²⁴ + 2¹⁹² − 89188191075325690597107910205041859247

—Squeamish Ossifrage

Thus, elliptic curve private keys are not limited to only prime numbers. Any scalar will do. This includes any primes that happen to also be elements of the field. If there was a check that ensured the scalar was not a prime, that would only make the number of possible keys smaller, which would only aid the attacker.

46-bit keys, if you're Google

As a numerologist, Grant has littered his Instagram wall with pictures of transcendental numbers such as Pi containing every possible value at some point of its decimal expansion. Ignoring the philosophy and woo, it's true. But that also means that Grant knows the decimal expansion of Pi contains all 521-bit private keys NIST P-521 EC-DH would normally use, including ones that are primes, at some point. This is a contradiction to Grant's team claiming the keys generated from Pi's irrational decimal expansion are more secure than the normal keys. Thus, the logical conclusion is — any valid private key generated with cryptographic RNG is equally secure, and Grant and his team are full of shit. Furthermore, in practice, the irrational keys are much weaker, because of the massive computational overhead to generate the keyspace to pick a key randomly from.

A sequence from an irrational number such as Pi, is just a number produced with an insecure PRNG, with a known seed. The PRNG in this case is the most efficient algorithm for approximating Pi, the Chudnovsky algorithm, and the seed values are the baked-in coefficients necessary to generate Pi.

The decimal expansion needs to be as secure as NIST-P521 EC-DH, and that requires there be at least as many keys as there would normally be. Since the key is not the value, but the random offset, this requires 2⁵²¹ offsets to choose from. (The length of the key requires additional ⌈log₁₀ 2⁵²¹⌉ = 157 digits in the offset space but it can be ignored as insignificant.)

Unfortunately for Crown Sterling, Pi has only been calculated to a precision of 100 trillion digits. This was done by Emma Haruka Iwao, a researcher at Google in 2022. This caps the number of offsets and thus the number of distinct keys to only 100 trillion unique values. A cryptographic key that has 100 trillion choices, has the strength of a log₂ 100,000,000,000,000 = 46.51 bit key.

Given that the Chudnovsky algorithm runs in 𝒪 (n (log n)³), generating a 521-bit key requires roughly 2⁵²¹ ⋅ ln(2⁵²¹)³ = 2⁵⁴⁶ᐧ⁴⁸⁹ operations, which is 47 million times more work than breaking the NIST P-521 EC-DH with brute force.

The reason modern cryptography is so strong is because it's computationally easy to generate a large random key, and computationally hard to break that key. What Crown Sterling's scheme proposes, is that it's computationally harder to pick the 521-bit private key from 2⁵²¹ possible offsets than it is to break the key exchange by trying all 521-bit keys.

In practice, it means even Google's research team with Google's computing power (128 vCPUs, 864GB of RAM, 515TB of disk space, and just under 158 days of number crunching), struggles to generate a 46-bit key. 46-bit keys haven't been secure from state actors practically ever, and academics broke the 1,024 times stronger 56-bit DES cipher back in 1998 with the EFF's Deep Crack machine. Thus, a state actor who puts in the same time to pre-compute the decimals as Google did, can cycle through them and try all 100 trillion offsets in a matter of hours. This is of course only the worst-case scenario, that is, if an entity such as Google would generate the key. An average end-user device couldn't generate but a fraction of the key space in a reasonable amount of time, which greatly reduces the time and space it takes for the attacker to generate the pre-computed table and cycle through it.

Shor go brrr

Last but certainly not least, Shor's algorithm solves the hidden subgroup problem for finite abelian groups. It will find the private key just by looking at the public key. It doesn't care how random the private key is. Many EC-DH private keys are generated with hardware random number generators (HWRNGs) that are the only thing that yields non-algorithmic, truly random numbers, and nobody's thinking they're somehow able to make EC-DH safe from quantum adversaries.

Crown-OTP: a broken stream-cipher

For symmetric encryption, Crown Sterling claimed they had picked the one-time pad (OTP).

Definition of OTP

A one-time pad (OTP) is a cipher with an extremely specific definition. In computerized OTP,

1. The plaintext and key are binary strings, and encryption is done by adding the two modulo 2, that is, by XORing the two together.
2. The key must be generated with a hardware random number generator (HWRNG). Using any algorithm to expand the key by any amount, immediately changes the cipher from an OTP into a stream cipher,
3. The generated key must be at least as long as the message,
4. The key must be used only once, as repeated use of the key completely breaks the scheme, and
5. The key must be destroyed immediately after use to ensure forward secrecy.

When used exactly this way, OTP is information theoretically secure, that is, decrypting a ciphertext without the key in a ciphertext-only attack (COA) is impossible.

Secure use of OTP

Secure usage of OTP in real life requires additional steps.

1. Since OTP is an additive cipher, it's malleable: any change in the ciphertext will result in a changing of the plaintext. If the attacker knows the plaintext content for any reason (perhaps the protocol adds predictable header values), they can change it to say whatever they want. To prevent this, OTP must be paired with unconditionally secure authentication, such as one-time MAC or Carter-Wegman MAC.
2. Since OTP is the only information-theoretically secure algorithm, using any other algorithm to exchange the key, makes it exactly as weak as the key exchange algorithm. This is why OTP was traditionally delivered either in person or via a dead drop spike, or as it is sometimes today, with the ridiculously expensive quantum-key-distribution (QKD) apparatus, as was discussed above.

Crown-OTP

In their White Paper, Crown Sterling reveals how their system for OTP was created.

“”The main reason why OTP cryptography is not in wide usage, even though it offers unbreakable encryption, is due to the difficulty arising from sharing the pad/key, which is as large as or larger than the message itself. Crown Sterling solved this problem by generating keys using the square root function where the problem of sharing the whole key is reduced to simply sharing the number that generates it instead, the NPSN, which is much smaller than the whole message and can be securely and easily exchanged using the usual ECC-DH protocol.

—Crown Sterling, Full White Paper (2021)

Crown Sterling's solution was to just ignore the exact requirement that forbids expanding the key. This automatically changed the cipher from OTP into a stream cipher.

Modern 256-bit stream ciphers, such as ChaCha20 and AES256-CTR, are not information-theoretically secure, but they would have satisfied Grant's desire for post-quantum security if used with pre-shared keys. But then Grant decided to remove post-quantum security by exchanging keys with Diffie-Hellman.

Square roots are not magic

The golden rule of cryptography is "Don't roll your own cryptography". Yet, in their numerologist hubris, Grant and his team went and did just that. As the excerpt above shows, in their Crown-OTP stream cipher, they chose to expand a shared secret into a keystream with square root of all things. For context, all stream ciphers require expanding the key into the keystream with a proper, cryptographically secure pseudo random generator (CSPRG).

Unlike the grifters who would like their marks to believe, a square root decimal expansion isn't some magical truly random number compressed into the radicand. Square root function is just that, a mathematical function. It is an entirely deterministic (and thus trivially replicable) operation that creates the decimal expansion from an input value. The square root function can be expressed e.g. with the following implementation of Newton's method, written in Python:

from decimal import Decimal, getcontext

def newton_sqrt(n: int, decimals: int) -> float:
    """Calculate square root using Newton's method.

    From https://runestone.academy/ns/books/published/thinkcspy/MoreAboutIteration/NewtonsMethod.html
    Modified for arbitrary precision.
    """
    getcontext().prec = decimals + 1
    half = Decimal(1/2)
    approx = half * n
    better = half * (approx + n / approx)
    while better != approx:
        approx = better
        better = half * (approx + n / approx)
    return approx

print(newton_sqrt(16, decimals=100))
print(newton_sqrt(2, decimals=100))

Output from Sophie Schmieg's lattice-based cryptanalysis program that broke Grant's square root cipher.

The cipher was broken immediately

The reason why only experts should be designing ciphers became clear, when on December 31, 2021 — just over three months after the Lite Paper came out — Sophie Schmieg, the leader of Google's Cryptography ISE team, wrote an application that used lattice reduction to recover the seed from the square root's decimal expansion, regardless of its offset, effectively breaking this toy cipher.

All CSPRGs must have a property called unpredictability, which means it's computationally infeasible for an adversary to determine future output from the already given output. Yet, by recovering the radicand, the obviously deterministic square root function could be used to generate the keystream to decrypt future ciphertexts.

Schmieg's findings about Crown-OTP were confirmed the next day by the cryptographer Markku-Juhani O. Saarinen.

Four months later, to avoid their followers from learning about the break, Crown Sterling created a low-profile Twitter account, @cs_mathresearch, which they then used to inquire about the break. Crown Sterling never thanked Schmieg for saving their customers' ciphertext confidentiality from a complete break, nor did they report the vulnerability to the CVE program.

Despite Schmieg's break, Grant still went ahead and applied for a patent for the ridiculous cipher.

Horrible PRG performance

Crown-OTP testing shows in
• TEST1, that encrypting just 64kB (a tiny image or a short article post) takes as long as 33 seconds, making the system unusable in practice,
• TEST2, that encrypting any message longer than 2048 characters is already slower than breaking the encryption, and
• TEST3, that it's vulnerable to Known Plaintext Attacks (KPA). In layman's terms, if the attacker knows how the message begins, that alone allows decrypting the entire message in milliseconds, and it also allows performing an existential forgery, where the sum to transfer, and the target address are changed.

These results can be reproduced on a Ubuntu based Linux, by following the steps in the setup instructions.

On February 24, 2024, Schmieg published a blog post about the attack.

The post explained how the keystream generation in fact takes in the order of ${\mathcal {O}}(n{^{\frac {3}{2}}}\ log\ n)$ operations, and explains its implications:

“”This is abysmal. A DRBG should have linear time complexity and constant space complexity, i.e. the cost of producing an extra bit of randomness should not depend on how much randomness was previously created.

—Sophie Schmieg (Google LLC)

In layman's terms, as the key is used, every bit that gets encrypted encrypts more slowly than the previous bit. A cursory test shows generating just a 65kB keystream (enough to encrypt a tiny image, or a short article) takes more than 30 seconds.

Ridiculously efficient attack

The lattice reduction runtime is 𝒪 (n³) which means the crank-PRG is slightly faster, but the attack only requires a 256-bit chunk of keystream to recover the keystream, thus extracting the key from the keystream takes in the order of milliseconds, even for very large plaintexts.

Useless offset hardening

The proposed OTP scheme uses unknown offsets that discard some of the most significant bits. However, as Schmieg explained in her blog post:

“”This of course doesn’t do anything, as the attack is fast enough, and the computation of the keystream is slow enough, that you can simply brute-force all possible starting points, changing a [=the square root radicand, i.e., the key] by a power of 2 as necessary to account for the discarded bits.

—Sophie Schmieg (Google LLC)

What authentication?

Figure 11 of the White Paper shows the CrownEncryptOTP protocol uses no message authentication codes (MACs) at all.

In their TIME AI trailer, Crown Sterling advertised the authentication mechanism:

“”The speed of the AI oscillations allow 31,709 years of oscillations in a single second of data authentication.

—Crown Sterling (TIME AI trailer)

This word salad is about as clear as mud, but it implies some sort of authentication mechanism would be implemented for the protocol.

However, nowhere in the Lite Paper or White Paper is authentication mentioned, and in Figure 11, on page 30 of the White Paper, it is clear that the message and pad are XORed together, and the resulting ciphertext is then delivered as is, to the contact for "reverse XOR"^[sic]. No authentication was used at all for the system, which in the case of malleable stream ciphers such as the Crown-OTP, is nothing short of a disaster. A known-plaintext attack (KPA), as demonstrated above, could allow the attacker to change the content whether it's the message, sum to transfer, or anything in between, to whatever they want.

Theon Technology

Grant's message from Nov. 11, 2021, where he confirms he's the founder of Theon Technology.

The same bastardized stream cipher was apparently also sold business-to-business, via another of Grant's companies, called Theon Technology.

Interestingly, Grant's face wasn't anywhere to be found on the company website. Perhaps he was unsure if Black Hat had been forgotten yet. Instead of Grant, or the CEO, the company's public face seemed to be Dr. Eric Cole, a New York Institute of Technology graduate and author of some infosec books. How this man descended from Lockheed Martin and got his hands dirty consulting a snake oil cryptography peddler, remains a mystery.

The company CEO Scott Bledsoe left the company in June 2023, and in February 2024, the company's website started to redirect to Crown Sterling's company website. It would thus appear the company has pivoted from cryptography to steganography by disappearing for good.

Cryptocurrency

Registering for Crown Sterling's token portal required signing a legal contract that forbids critique towards the company and its executives. A totally normal thing for any company, with nothing to hide, to do.

In his search for a use-case for his broken protocol, Grant decided it was time to pivot his business model to the surprise of absolutely no one, and as predicted by some of the most notable experts, into cryptocurrencies.

CoinGecko graph between Jan. 18, 2022, and Aug. 17, 2024, shows the CSOV's stock plummeting after its peak on June 11, 2022.

While Crown Sterling's normal stock was offered at no less than USD 4980 a share, the ICO that was the CSOV token, offered an unregistered security at more reasonable prices to retail investors. Unfortunately for Grant, the ICO bubble had burst already in 2018 with the SEC going after ICOs. Announced two years after the bubble burst, released four years too late, the CSOV token's price crashed in just two months, and it never recovered.

As a pre-mined coin, it's effectively Monopoly money with no scarcity and thus no real value. As CoinTrust states, "These coins are distributed among a few people who can then manipulate the coin’s value as they desire. [...] Once the coin is traded at an exchange and increases in value, the founders of the coin sell their pre-mined coins and disappear from the scene." The main purpose of the token seems to have been a) to have at least something to show the stock investors, and b) to provide some cash inflow from retail investors buying the worthless penny stock.

The cryptographic protocol was never implemented as Crown Sterling's own blockchain that could make use of the claimed post-quantum transactions. The CSOV token operates as a Polkadot parachain, and the WCSOV token as an Ethereum smart contract. The Ethereum smart contract contains absolutely nothing that would imply WCSOV uses anything described in the Lite Paper or White Paper. Polkadot's signatures use sr25519 and Ethereum uses ECDSA, neither of those is post-quantum.

The only good thing to say about the cryptocurrency grift is, that it hasn't gotten very far, as WCSOV has only 115 holders.

Scammy exchanges

The (W)CSOV token is offered on five exchanges that are FMFW.io, Changelly PRO, HitBTC, BitMart, and Uniswap.

FMFW.io

Originally Bitcoin.com Exchange, the exchange rebranded itself as FMFW.io in September 2021. Trustpilot shows only five reviews, all one star.

Global Fraud Protection found deeply concerning irregularities.

“” By accepting their agreement, traders waive the right to sue the company in court or have a jury involved.[…] The FMFW exchange claims to be trusted by more than 1 million users all over the world. Yet, the download rate of their wallet is just above 1,000 on PlayStore. Obviously, they are pumping up numbers to appear legit.[…] Once traders join and start depositing money, they are caught by numerous traps. Primarily verification and withdrawal issues.[…] With too many irregularities about this company that is most likely offshore-based, nobody with common sense should deposit there.

—Global Fraud Protection - FMFW review

Purchasing CSOV via the FMFW.io exchange is being marketed by a company called Sarson Funds. Dirty Bubble Media found the Sarson Funds had "steered their investors' money into one scam after another", and they captioned an illustration of the CSOV token price crash with the the concise message: "Rug. Pulled.".

Changelly PRO

The subreddit /r/monero lists Changelly PRO under "Do not use the following exchange(s), citing three threads.

HitBTC

Trustpilot lists just under 900 one-star reviews for HitBTC.

The subreddit /r/monero lists (also) HitBTC under "Do not use the following exchange(s), citing two threads.

Cointelligence gave the exchange a perfect score of 0 points in every aspect, flagging it as a complete scam.

In his article "(s)HitBTC holds <10% solvency, and selectively scamming more users than not.", Richard Sanders explains the scam:

“”If they see a selective-scamming victim is in a jurisdiction where law enforcement and legal professionals aren’t as spun up on cryptocurrency, they’re more likely to never return the cryptocurrency.

—Richard Sanders

Thus, even honest positive reviews only aid the scammers in exploiting those with no legal protection.

BitMart

Trustpilot shows the exchange has over 850 one-star reviews. Sitejabber has six reviews, all one-star, for the exchange.

Bitcoin Forum has a discussion about the exchange being a scam.

The victims of the scam are aggregated under the Twitter account @bitmartscam.

Uniswap

81% of the total 38 reviews on Trustpilot gave the exchange one star out of five.

Malwaretips lists the exchange as a scam website that has anonymous owners and hosting, that has blocked access to accounts after receiving payments, and that has "created deep fake videos and doctored screenshots of business leaders endorsing the project".

Conclusion

Every single exchange the (W)CSOV token is being offered is an outright scam, which is rather fitting for a scam token. As the vendor of the token, Crown Sterling obviously does not care if the funds can be withdrawn by the users later. As per CoinMarketCap, the exchanges rank, in the order of least scammy service first, as follows:

1. BitMart (rank 32)
2. FMFW.io (rank 70)
3. HitBTC (rank 94)
4. Changelly PRO (rank 146)
5. Uniswap (did not even make the cut)

Orion Messenger

After realizing they had missed the ICO boom, Crown Sterling decided the best way to pump value into their token would be to offer a VPN called Orion. Something must have happened, however, as one year later Orion was a "quantum secure" messaging app. Not like the authors cared too much: the messenger's Lite Paper, released in May 2023, still, a year later, refers to the messenger as "Bellatrix".

The Lite Paper

Two cryptographers going by the pseudonyms RazeHer and Geyblade effectively killed the da Vinci virus by combing through the Lite Paper in their Quackers series blog post in detail. Additional points are made below:

The Lite Paper states Orion uses "AES256" without describing the relevant part, the mode of operation. While the key size is safe, it contradicts Grant's plans he revealed to Matthew Belair in June 2018:

“”There's not going to be any more like 256-bit encryption and stuff like this. We're gonna kill all of it.

—Robert Edward Grant (CEO, Crown Sterling)

The Lite Paper also reveals the company was still trying to bake in the broken snake oil Crown-OTP stream cipher dissected above. The internal workings of the system are not documented which gives no reason to trust it.

The messaging app runs in a browser — a horrible idea in of itself.

On Lite Paper's page 5, the app is advertised as "trustless", but it is still closed source, meaning no one can independently verify it uses the encryption algorithms claimed in the documentation, let alone verify whether they're safely implemented and used.

Orion Beta

If it looks like a backdoor and walks like a backdoor...

Orion Messenger's code that shows the user's NTRU private key is fetched from the server in apparently plaintext form.

Crown Sterling took special precautions to enforce the uninspectability of their web app's source code by compiling it as WebAssembly. This, however, wasn't done soon enough, and a cursory peek at the application's TypeScript code they pushed to anyone who bothered to open the web app's website, shows that the client fetches — what appears to be the user's plaintext NTRU private key used for end-to-end encryption of messages — from the server as the user logs in.

In cryptography, encryption is only a tool to convert a confidentiality problem into a key management problem. In messaging apps, those who control the private keys have access to message content. Thus, Orion appears to be a grifter's paradise, as it appears to give the company's staff full control over their marks' communication, from controlling the discourse regardless of promises, to possibly even eavesdropping on everything they say. This is in strict contrast with what's being promised by Crown Sterling to their customers.

Because of what the peek into the messenger's source code showed, the app should not be trusted until the company joins apps like Signal, Wire, Threema, Session, Element, and many others, which all not only end-to-end encrypt everything by default, but have open source clients. Open source client ensures the vendor's claims about end-to-end encryption can be verified by not just audit companies, but much more importantly, by independent security researchers. Security without transparency is called security through obscurity, and it has never worked. It only opens possibilities of abuse, as was again seen here.

The White Paper

That's the fault of yesterday's me!

On Feb. 5, 2024, in a response to a heckler asking about this very RationalWiki article, Crown Sterling took special time and care to refute the math, findings of inconsistencies in the company's story, pictorial evidence, and all references of this article with the step-by-step methodology of telling it contains "so much falsehood". Next, in the post, the company laughed at their apparently backdoored code being too old for it to matter. They conveniently ignored they had at one point designed the application to upload the NTRU private key to their servers. The fact they ever even considered such a protocol reflects their incompetence. Furthermore, given that Orion isn't older than July 2022, it's not like their incompetence is from past times. The post ended by sharing a draft White Paper for the Orion Messenger on Telegram.

The heckler then proceeded to laugh at the protocol's amateur design and demanded Crown Sterling to follow up with their claims of being able to break RSA by cracking the RSA-2048 challenge and to release the client's source code for the sake of transparency. These requests were followed by the expert PR take of deleting everything the heckler said, and banning them — according to their second post, — for violating the company's policy of "respectful dialog".

In their second post, the company also stated they are working with "university cryptographers", while conveniently failing to name a single one. They then proceeded to formally prove the security of Orion messenger's protocol with a promise to have it audited by "respected third parties", which were not specified. The promise of audit is hollow, as audit companies typically don't have permission to publish unredacted results on their own. Also, audits are expensive and thus always finite in scope, and because audits are rule-based, they are trivial to rig to ignore relevant aspects. Audits are similar to RNGs' statistical tests: they are only useful if they show issues in the evaluated system. In information security, passing an audit is not a guarantee of anything, but failing an audit is a guarantee of there still being issues to fix.

The post also stated: "we recognize the importance of open sourcing critical aspects of our protocol to allow developers to be able to build on top of our quantum-secure network", which together with the announcement to only allow selected entities to audit the full codebase threw a wet blanket to those hoping the company would publish the source code for the entire client, which is the requirement for being trustless, and for independent verifiability of the system's holistic security.

But, it would be rude not to accept Crown Sterling's courteous invitation to peek under the hood by evaluating what the Orion whitepaper states.

Pointless unmaintained cryptographic libraries

On page 6 of their White Paper, the authors state they are using CryptoJS, which is an unmaintained cryptographic library. Always a strong sign when a company that claims to use modern cryptography uses libraries that nobody fixes vulnerabilities for. CryptoJS has a dubious past of using non-cryptographic random number generation with math.random(). This has since been fixed, but given that the library doesn't add anything, means Crown Sterling has no idea they're just using a pointless wrapper for the browser's native Crypto API.

What is a KDF?

On page 4 of their White Paper, the authors reveal their failure to understand the difference between key derivation functions (KDFs) and password hashing functions (PHFs) that perform key stretching, as the authors decided to use Argon2id to derive the remote data fetching token from the client-side data encryption key. PHFs are not used as normal KDFs because they are pointlessly slow. Passwords need to be stretched to improve their strength, but given that the first pass of Argon2id already yields the key that can decrypt all of the user's data on the server, it makes no sense to use Argon2id again to create the token for fetching the file the vendor already has access to.

While this is not a strict vulnerability, it is a much less secure design: PHFs are always time-limited by user experience, and redirecting half of the time available for key stretching to do a pointless "super-secure" KDF operation, shows major incompetence. The company's staff clearly have no idea which blocks fit which hole, and the reason this matters is, that it's such an obvious mistake, that any cryptographer would have immediately told them this, which proves they are not working with any cryptographers. As for the Argon2id itself, the relevant part, i.e. the parameters (time cost, memory cost, parallelism) were also not disclosed, which puts the algorithm's memory hardness (its key selling point) and the authors' expertise in disclosing what matters, into question.

Hard choices

On page 5 of their White Paper, the authors show their choice for AES mode of operation is AES-CBC/GCM. With their lack of expertise, the company apparently struggles to choose between CBC that is unauthenticated and vulnerable to padding oracle attacks, and GCM which as an AEAD scheme is authenticated by default and considered the best practice. Not knowing this trivial distinction, again shows the company staff hasn't done their homework, and they sure as hell don't employ any cryptographers.

Brain-farts

On page 7, the authors state: "Please note that the original master password cannot be stored anywhere to prevent the attacker from breaking into other users' accounts in the case the user reuses the master password somewhere else".

Having the account security of other users be dependent on storing one user's master password is so ridiculously stupid, and so absurdly dangerous and bad design, this statement should probably be dismissed as having been written after falling into daydreaming mode after a tall glass of bourbon. Then again, designing something this stupid would be more than on-brand for the company of "infinite wave conjugations".

No secrecy from the future, no secrecy from the past

On page 8, the authors state: "A novelty and differentiating feature of the ORION messenger is the capability to have large multi-user group chats that are entirely qE2EE, making ORION the first post-quantum large group messenger on the market. This is guaranteed by the flow of creating chats. In our case, the user who is responsible for adding members is also responsible for generating the individual credentials for each member to grant them access to the group chat messages. The first step is to generate a chat session key. The session key is shared across all members."

So, in their desire to provide end-to-end encryption for groups so large confidentiality starts to lose its meaning, Crown Sterling decided to implement a protocol without best practices such as Diffie-Hellman ratchet. Also, judging by the fact the White Paper states on the same page "session key rotation is not part of the current implementation", not just future secrecy, but even the crucial property of Forward secrecy from 1990, first deployed by the OTR-protocol in 2004, has been left as an afterthought. What makes this particularly funny and ironic is, that the RSA algorithm that Grant hates so much, is being phased out precisely because of its lack of forward secrecy, not because it's weak like Grant has fraudulently claimed.

Acquiring the knowledge on how to deploy a group key exchange is clearly pointless, when the planned alternative is according to the White Paper's page 8, to force group admins to deliver a new group key for every member, every time a user joins or leaves the group, a fun way to needlessly slow down the group admin's device, consume their battery, and possibly data plan. In their defense, the authors are aware of the limitations, so they proceed to misrepresent them:

"Please note that this procedure of encrypting the Session Secret must be repeated for each member, thus adding members has linear complexity and will take considerable time for large groups. However this is not expected to be an issue as the process is performed only once for each member, and chat size is expected to grow over time (as opposed to large, fast influxes of users)."

Unfortunately for Crown Sterling, to be able to read each other's messages, all group members need to be on the same page about what the key is. While they claim key rotation is not expected to be an issue, what they fail to take into account is, as the group grows into e.g. 3,000 members, every time a member joins, all 3,000 members will need a new key, preferably right away. And precisely because the number of members varies only slightly, a group that has gotten too large is doomed to stay resource-intensive. The fact it takes time for users to populate the group has a nice property of showing the users how the group member limit is not like the authors would like their customers to think, infinite, but capped by the performance of the group owner's device. This also opens up obvious denial-of-service attack vectors for very large open groups, that can be performed by simply joining and leaving the group rapidly. The fact the authors don't even consider trivial attacks like these tells us they lack the adversarial mindset it takes to design secure protocols.

Mixing up the mixnets

On page 10 of the White Paper, the authors mention plans for the future:

"Another feature for switching to a decentralized backend is the anonymization of users through a mechanism similar to onion routing"

Failure to understand that onion routing (e.g. Tor) is used for anonymization of traffic, not decentralized storage, which is what software such as Freenet has been doing for the past 24 years, is funny and again, telling.

Who's going to be running this network of onion routing nodes is also unclear. If it's going to be Crown Sterling themselves, there is no anonymity, because control over the entry and exit node breaks anonymity with a simple end-to-end correlation attack.

The innovation of redundancy

Page 10 also states: "Having a decentralized storage system will bring many benefits to the messenger. It will ensure redundancy as the data will be shared across multiple nodes in the network."

The company's plans to have "ensured redundancy" in the future, calls into question what server-rack-in-the-cleaning-room technology is being used by the system currently. All datacenters use NAS or SAN to ensure redundancy.

No public-key fingerprints

PGP fingerprints visible for Phil Zimmerman's PGP key, from 1997.

Public-key fingerprints have been used to guard against man-in-the-middle (MITM) attacks in the very first end-to-end encrypted system, PGP, at least since 1997. Although the comparison of fingerprints is an integral part of practically every modern end-to-end encrypted messaging app, the White Paper doesn't even mention them. The authors are thus apparently completely unaware of basic attacks against cryptographic protocols, or they stayed quiet about the feature to maintain the possibility of eavesdropping on their users with an MITM attack, which unlucky for the users are without fingerprints, undetectable.

Furthermore, it is not only Crown Sterling that can perform MITM attacks: The X.509 certificate system that the TLS-protocol between the user's browser and Crown Sterling's servers uses, is not considered safe from entities like nation-states who run programs such as Bullrun, and are the typical adversary with access to quantum computers. The inconsistency in threat modeling where a web app of all things is supposed to offer protection against the most well-funded adversaries, again shows the ridiculous incompetence.

Empty promises to open the source

In their second Telegram post, Crown Sterling stated they intended to release "critical aspects" of the source code. However, on page 3 of the White Paper, the authors state they intend to deploy their Kyber-x25519 hybrid key exchange as an unauditable Rust WebAssembly binary blob.

For context, open-sourcing a protocol without open-sourcing the client that uses it, is worthless, as parameters delivered to and from a verified protocol's API can break the system's security completely. For example, the UI elements are responsible for showing the public key fingerprint to the user. This is a convenient place to hide a backdoor that lies about the value of the fingerprint. Crown Sterling's promise to release the source code for just the protocol, and not the entire client, is thus worthless.

Passwords over keys

On page 11, the authors state:

"From a UX perspective, we enable compatibility with legacy systems by using the embedded password manager, as this allows the user to access the data based on his master password, instead of basing the security around the private keys."

Failure to understand which is stronger, a 256-bit key generated by a proper CSPRNG, or a 40.54-bit password generated by an average user, is also more than telling about what the security of the system will ultimately be.

Oh right, the blockchain

To fill the quota on buzz-words and the relevance of their token, the team ended the White Paper with the following note:

"We are confident we will be able to merge our revolutionary quantum security with the latest high-speed blockchain solutions creating a first-of-its-kind secure social and community platform alongside a thriving development community."

This is the first and only time the word blockchain appeared in the paper. Hopefully, it will remain the only time it's ever associated with a secure messenger, given that the idea of storing communications ciphertexts — the keys of which depend only on knowing the password — in an append-only distributed ledger anyone can access, invites every malicious actor in the world to a bingo of cracking passwords of non-technical users to read their messages.

Summary

During their journey, Crown Sterling has had to learn the hard way, that they don't need to burn their reputation with false claims about breaking standard encryption, before coming up with a product that uses standard encryption. The next rock they banged their shin against, was learning self-invented stream ciphers are trivially breakable, and right after that, that butchering relatively safe primitives like the Blum-Blum-Shub only gets them bad press.

They have now reached the point where they use standard primitives of the industry. But they are still figuring out which brick goes through which hole in the shape sorting cube of protocol design. The protocol lacks all basic properties like forward secrecy, future secrecy, public key fingerprints, and group key exchanges. The amateur mistakes show Crown Sterling definitely isn't working with "university cryptographers". Also, advertising the continued use of WebAssembly for cryptographic primitives shows the company did not actually have plans to open the source, even for the most relevant part, the algorithm implementations, that need to be verifiable by anyone and everyone.

The staff

Here are the Crown Sterling team members who have participated in the company's "research", preprints, and self-published PDFs.

Robert Edward Grant

Grant, a man who unfortunately failed to meet the notability guideline of Wikipedia, twice, deserves an introduction.

A blog post, authored by the nickname Quasiprimes, dug up interesting things about Grant, which have been incorporated below.

Formal education

According to The Org, Grant has the following formal education:

1. Bachelor of Arts (BA) in Korean and International Relations, from Brigham Young University (1988-1994)
2. Master of Business Administration (MBA) in International Finance, from Thunderbird School of Global Management (1997-1998)
3. YPO/OMP program in the Presidents' Program in Leadership, from Harvard Business School (2009-2017)

No degree in mathematics, or computer science, the prerequisites of proficiency in cryptography.

Work history

According to UCI Samueli School of Engineering, before 1997, Grant held several management and leadership positions, including

• General manager (Australasia)
• Director of Marketing (Asia Pacific), and
• Country manager (Japan)

for medical device manufacturers, such as

• Sulzer Medica AG (Switzerland), and
• The Nucleus Group of Pacific Dunlop Ltd (Australia).

Lumenis, Inc. (1997-2003)

1. 1997-1998: Director of Business Development for HGM, Inc., later acquired by Lumenis.
2. 1998-2001: Managing Director of European Operations for the Coherent Medical Group, (Dieburg, Germany).
3. 2000-2001: Vice President of Business Development of the Coherent Medical Group.
4. 2001: President of the Surgical Business of the Coherent Medical Group, a subsidiary of Coherent, Inc., later acquired by Lumenis.
5. 2002: Executive Vice President and General Manager of the Surgical and Ophthalmic Business of Lumenis.
6. 2002-2003: Executive Vice President and General Manager of the Medical Business of Lumenis in Santa Clara, California.

BIOLASE Technology, Inc. (2003-2006)

Grant joined BIOLASE Technology, a publicly traded Cosmetic Dentistry company, in June 2003 as the Chief Operating Officer (COO) and as the Chief Financial Officer (CFO).

In October 2004, Grant was appointed as the Director and President and Chief Executive Officer, and in March 2006, as the acting chairman.

Allegedly, after nearly destroying BIOLASE, Grant was either fired, or he bolted from the company.

Allergan, Inc. (2006-2010)

In May 2006, Grant was appointed as the Chairman and President and CEO of Allergan plc. According to Quasiprimes, Grant's presence there has mixed reviews, and he has been accused of pilfering millions from physicians:

“” BR [Bob Rhatigan] is a great guy except for the part he played in helping R[obert] Grant dup millions out of physicians. Not sure what that says about his ethics or judgement.[…]

—Anonymous

Bausch and Lomb (2010-2011)

Grant became the CEO and President of Global Surgical Business at Bausch and Lomb on August 1, 2010.

On December 13, 2011, Brent Saunders announced Grant leaving the company. Grant was allegedly fired for not getting along with Brad Paddock, the vice president of sales.

According to Quasiprimes,

“” More than 5 patents, under his own name, were filed in September and October of 2011 that are specifically in the field that Bausch & Lomb conduct business. Given that these patents were not published until 2013, Bausch & Lomb may not have even be aware that this activity of publishing their trade secrets was happening. Having absolutely no medical degree, or background in the field, it would be highly improbable for him to have otherwise obtained this information independently.

—Quasiprimes

The alleged patent trolling might have been the last straw to the industry, as Grant never worked for another company in the industry after leaving Bausch and Lomb in December 2011. Grant went on to start Strathspey Crown, his holding company of grifts almost immediately, in January 2012.

Allegations of sexual harassment

Grant has been accused of sexually harassing women as early as April 2012, and again in February 2014.

Allegations of investor fraud

Strasphey Crown founded a company called Alphaeon Corporation in July 2013. In September 2015, Alphaeon launched a product product called ShoutMD.

On November 9, 2019, a group of hackers shared on Schneier's Friday Squid Blog, an off-topic thread for miscellaneous infosec topics, an old-school — Phrack-style e-zine where they revealed they had breached ShoutMD's private forums, and that it was trivial due to non-existent security. The e-zine presents some interesting claims and some serious allegations:

“” […] ShoutMD requires a health care provider ID to sign up and contains a rather vicious terms of service threatening any physician who discloses any of the records contained in the forum.[…] […]Since the api to search members practically drooled the permissions information for each user, he [meaning we] chose one and recovered his password[…] […]0x1 - Scamming investors Multiple scams were identified in the post content. Investors ask for their actual shares (somehow he received money and didn't distribute them), complain about various doublespeak, and more. After making a serious fuckup with fiduciary responsibility and lying to investors, our Robert Grant realized he and his company could be sued for investment fraud. For this reason, he tried to get all of his investors to sign a release waiver preventing them from suing him in their next share disbursement. Lo and behold, this did not go unnoticed. Mark Pinsky notes this in post id 201446:[…] I have significant concerns about the Strathspey Crown Holdings, LLC- Class X Unit Purchase Warrant: 1. It has in it a GENERAL RELEASE of any and all claims against Strathspey Crown and its managers. It also releases all actions by Strathspey's "past and present agents, employees, representatives, officers, directors, members, managers, attorneys, accountants, insurers, advisors, consultants, assigns, successors, heirs, predecessors in interest, joint ventures, affiliates, subsidiaries, parents, and commonly-controlled entities." (This is in Section 18 of the Unit Purchase Warrant.) It appears that SCH and its managers intend that if you sign it, you give up ALL your legal rights to sue SCH or its management for any reason whatsoever, and you can never pursue or be party to any legal action. It also appears they intend for the release to include all claims, including those you know about and those you don't yet have any knowledge of. 2. As you probably know, Robert Grant has pledged 10 million of his equity to Series B investors, and it is unclear how his pledge relates to the Class X Unit purchase: Is this warrant offer in lieu of Robert Grant's $10m equity pledge? Do the warrants offered dilute all SCH investors or just the equity owned by Robert Grant? For these and other reasons, I will not be signing this agreement." […] 0x2 - Tax evasion According to the SEC records for Strathspey Crown, the company took in about $50,845,002 in investment and reported it using a Form D. This may not matter much on its own, but adding all the investment amounts together from the ledger equates to $136,422,195[…] 0x3 - Physician Cronies While some of these physicians are clearly victims of Robert's serial scamming, others appear to help him actively perpetuate the scam. They even offer each other tips on how to better execute pricing scams on their customers[…] Over 100 investors were found to be promoting this [Jeuveau, a Botox generic] product without disclosing their financial interests in its success on social media. This is HIGHLY ILLEGAL[…]

—Timecop

Verifying the allegations is hard, but something may have happened, as per the Wayback Machine, the website quietly disappeared during 2019.

Conclusion

Grant's career trajectory, marked by his terminations from several companies, as well as alleged patent trolling, investment fraud, and sexual harassment, starkly contrasts with the story dressed as humor, that he told at the TIMEAI pre-party, about exiting the industry because he "couldn't be evil anymore".

None of Grant's education, or earlier work has any intersection with cryptography.

Talal Ghannam

Formal education

Ghannam's 2003 Master's thesis from Western Michigan University was about "Optical Solitons in a Three-State Medium". Ghannam's 2007 PhD dissertation was about "Quantum Properties of Light Emitted by Dipole Nano-Laser".

In addition to the dissertation, Ghannam has ten other publications. Unfortunately for Crown Sterling, it's all in the field of physics. The only use his degree would have been for the company was to teach about the process of academic publishing. Instead, his degree was abused to gain upload rights to ArXiv's preprint server.

Crank publications

Considering his reputable academic background, Ghannam has seriously sold out: In 2012 he self-published a crank book titled "The Mystery of Numbers: Revealed through their Digital Root", and later, in 2021, another of the same sort, titled "GeoNumeronomy: Unraveling the universe through numbers and forms". Ghannam has also co-authored with Grant the book Philomath.

False credentials

Despite the lack of any degree or research in mathematics, Ghannam has been claimed by Crown Sterling to be a number theorist.

Alan Green

On his archived website, Green explains his background:

“”Alan is a British-born, classically trained pianist, composer, author, educator, and Shakespeare Authorship scholar. He was musical director for Davy Jones of the 60’s pop group, The Monkees, for twelve years and co-author with Jones of two best-selling, award-winning books, They Made A Monkee Out Of Me and Mutant Monkees.

—Alan Green, biography (2020)

Grant meets crank

Following his career in the music industry, Green began in 2004 his crank work of "deciphering codes hidden within Shakespeare's works, which finally solves history's most persistent cover-up." His YouTube videos, among other things, tie the crank decodings of Shakespeare's sonnets to the Great Pyramid of Giza: a novel form of pyramidology.

While Green was interviewing Grant on Dec 1, 2020, Grant said he had been a follower of Green's work, and that in 2017 he had stumbled on Green's 2016 CPAK presentation, where Green explained how he had through trial and error stumbled upon approximations of mathematical constants in his measurements of the Great Pyramid of Giza. Coincidentally, Grant, in his infinite wisdom, had realized that יהוה, the Tetragrammaton (Hebrew block script for Yahweh) from 840 BCE, can be interpreted as mathematical syntax: ו and י can be interpreted as 7 and ⁷ respectively, and ה as π.

All one has to do is squint their eyes enough, and ignore the entire relevant history of the Hebrew alphabet and Western Arabic numerals:

1. The letter ה, or He, evolved from the Egyptian hieroglyphs representing the words thread, jubilation, and court, which look nothing like the Greek letter π.
2. The letter ו, or Waw, evolved from the Egyptian hieroglyph representing the word mace which looks nothing like 7.
3. Similarly, י, or Yodh, evolved from the Proto-Sinaitic script for the word hand that also looks nothing like 7.
4. The Western Arabic numerals didn't precede Al-Khwarizmi's book "On the Calculation with Hindu Numerals", which wasn't written until 825CE.
5. The Greek alphabet that contains π didn't exist until 9th century BCE, and π wasn't used to denote the mathematical constant until the mathematician Willian Jones decided to do so in 1706.

One should also completely ignore that the Hebrew language has its own ancient cultural practice of assigning numbers to words called Gematria, where

• Waw (ו) is associated with the number 6 (not 7),
• Yodh (י) is associated with the number 10 (not 7), and
• He (ה) is associated with the number 5, not 3.14159265358979323846…

But Grant put his expertise on history of ancient cultures and numerology to good use, ignored all that, and decided יהוה was the equation π7π⁷. After realizing π7π⁷ = 7π⁸ ≈ 66419.717 doesn't really mean anything, he then through trial and error figured out that π⁷ / π7 = 137.34131, which to numerologists, who love to adjust precision as needed, was exactly the same as the golden angle, 180⋅(3−√(5)) ≈ 137.50776.

Grant then reached out and called Green, who pretended to be very busy, and after Grant had explained the Tetragrammaton crankery, Green said he had figured out the ratio between the volume of the King's chamber, and its sarcophagus was also 137.5.

Green's discovery be easily seen from the respective dimensions of the King's chamber 10.5m ✕ 5.2m ✕ 5.8m = 316.68 m³, and the dimensions of the granite sarcophagus 0.987m ✕ 1.051m ✕ 2.276m = 2.361m³. Together these two give the ratio of 316.68m³ / 2.361m³ = 134.130 which again, to the numerologists was exactly the same as the value Grant came up with, 137.341. All you need is enough rounding. Alas, 137 rounds up to 140 and 134 down to 130, but on a positive note, both values round down to an even 100, which happens to be the number of Dalmatians acquired by the Radcliffes, plus an offset factor.

Considering the shared ability to ignore mathematical precision, historical accuracy, sense of chronology, the concept of apophenia, and the shared understanding there's easy money to be made from gullible pyramidologists even with trivially falsifiable claims, it is no surprise the two saw eye-to-eye, and agreed they should meet.

Crank in command

Later in the video, Green brought out his expertise by explaining how the Diffie-Hellman key exchange works:

“” And it reminds me of when Diffie and Hellman got together, in what was it, '67, '76, '77, and the Diffie-Hellman algorithm, which ultimately then became, you know, RSA, that was a breakthrough. It could easily be described, in a nutshell you know. Bob wants to talk to Alice, but Eve is always going to be listening. How do you do a public key distribution, how do you send a key across when it can be intercepted. And so, he[sic] figured out, using, you know, high prime numbers, it's like mixing two cans of paint. Take a red and a yellow, mix them together. It's easy to mix them together, but it's almost impossible to separate them, right.

—Alan Green

Thinking Diffie-Hellman revolves around multiple large prime numbers shows Green can not tell RSA and Diffie-Hellman apart. So, naturally, Crown Sterling positioned Green as the "Director of Cryptography". Green's background was ridiculed on Twitter, the next day after BlackHat 2019.

Despite his position, Green never contributed to a single preprint or PDF self-published by the company, and he has stayed relatively far back from the public eye of the company.

Amanda Kennedy

Amanda Kennedy popped up with Crown Sterling's PR Newswire article that announced another crank preprint on ArXiv, this time about spirals, and with no mention of cryptography.

As per her LinkedIn, she joined the company as a summer intern in June 2021 and was promoted a researcher two months later. Apart from the preprint, Kennedy stayed in the background throughout her employment.

Lucky for her, she left the company in April 2023 and she has since found a job at Aerojet Rocketdyne, that matches her formal education (aerospace engineering and rocketry) from University of Central Florida (UCF).

Naomi Mathew

Naomi Mathew has, as per her LinkedIn, a BA in mathematics from the University of California, Riverside (UCR). Being an undergraduate is nothing to sneeze at: from the looks of it, she's apparently the only one in the company who has a formal degree in mathematics.

She joined Crown Sterling in March 2021, and according to her LinkedIn, her degree has been put to good use. She has since co-authored the crank paper sum-product conjecture, and she has also

• Built a high-precision calculator with several features, such as graphing/geometry, right triangle calculator, and access to several math/physics constants,
• Built other applications to help support current math research on a wide variety of topics such as geometry and prime numbers, and
• Documented proprietary research to present to patent attorneys.

Conclusion

None of the people who work, or who have worked for the company have a degree that involves cryptography. Given the company's abysmal reputation, and lack of evidence that any cryptographer has ever worked for them, or with them, it's clear the company and its staff are just winging it while flying low — near the cryptocurrency industry, that has way too little oversight and way too many cranks for anyone to pay attention.

Editorial note to the scam victims

Just because you pay for the product, doesn't mean you're not the product. E.g., you pay for Spotify, yet it spies on you.

In contrast, the entire open source initiative and Free software movement (free as in freedom), and their creations such as the Linux operating system, or most of what's listed on e.g. privacyguides.org, is living proof that privacy respecting non-snake-oil applications don't always cost money. The fact Grant isn't a proponent of open-source systems and transparent security is also quite telling: he doesn't want his marks to know about things that would force him to walk the talk.

In fact, the sheer number of lies told by the company and its CEO, are aching to the concept of telling a big lie: It is hard to believe someone would have the impudence to distort the truth to this extent.

If you choose to stay in this roach motel because you're craving for the community and validation for your numerologist/New-Age views in the personality cult that is REG, sure, be our guest. If you're just cashing in with the line-go-up-distributed Ponzi scheme that is (W)CSOV, feel free to stay and gamble. It's your money.

But if you somehow wandered into the group looking for data sovereignty, or how non-grifters call it, privacy tech, such as secure communication, run. See securemessagingapps.com for real alternatives to Orion, join Reddit's /r/privacy community or PrivacyGuides forum for proper peer support.

The movement against surveillance capitalism has been actively fought by people since the cypherpunks initiated it 32 years ago. The real privacy community isn't filled with people with business degrees pretending they're da Vinci, Indiana Jones, and a professional cryptographer at the same time. It has people with Ph. D.s in computer science and mathematics, with a focus on cryptography, working hard in businesses and during their free time to make the world a less dangerous place, every day.

In summary

“”Crown Sterling is complete and utter snake oil.[…] None of [the people who work for Crown Sterling] have demonstrated any cryptographic credentials. No papers, no research, no nothing. (And, no, self-publishing doesn’t count.)[…] Run away. Run, far, far, away.

—Bruce Schneier

External links

• Crown Sterling

Equations

The links to equations here allow for easy verification of the results obtained via the presented formulae.

Illustrations

The links to illustrations here refute the proof-by-picture crank algorithms and equations presented by Grant. The use of external image hosting avoids clutter in the main article.

Programs

The links to programs here allow for easy inspection of the algorithm implementations used to generate the results and provide a one-button method to independently run them for verifying the presented results.