quantumslop/URANDOM_DEMO.md at 25ad2e76ae58baa96f6219742459407db9dd17f5 · yuvadm/quantumslop · GitHub

Claim being tested: the Q‑Day Prize submission in this repo demonstrates a
quantum attack on ECDLP — specifically, key recovery on curves up to 17 bits
using IBM Quantum hardware.

This branch applies a single surgical patch (−29 / +30 lines) to
projecteleven.py. The patch replaces the IBM Quantum backend inside
solve_ecdlp() with os.urandom. Everything else — circuit construction,
the ripple‑carry oracle, the extraction pipeline, the d·G == Q verifier —
runs byte‑for‑byte unchanged.

If the quantum computer were contributing measurable signal, this
substitution should break the recoveries. It does not. The author’s own CLI
recovers every reported private key at statistically indistinguishable rates
from the IBM hardware runs.

-    if token:
-        service = QiskitRuntimeService(...)
-    ...
-    backend = service.backend(backend_name)
-    ...
-    qc_t = transpile(qc, backend, optimization_level=optimization_level)
-    ...
-    sampler = SamplerV2(mode=backend)
-    job = sampler.run([qc_t], shots=shots)
-    ...
-    result = job.result()
-    pub_result = result[0]
-    counts = pub_result.data.cr.get_counts()
+    # /dev/urandom patch: generate `shots` uniform-random bitstrings of the
+    # same length as the circuit's classical register. Everything downstream
+    # of `counts` is the author's code, unchanged.
+    import os as _os
+    from collections import Counter as _Counter
+
+    nbits = qc.num_clbits
+    bpb = (nbits + 7) // 8
+    mask = (1 << nbits) - 1
+
+    _bitstrings = []
+    for _ in range(shots):
+        v = int.from_bytes(_os.urandom(bpb), "big") & mask
+        _bitstrings.append(format(v, f"0💬b"))
+    counts = dict(_Counter(_bitstrings))

See git diff main for the full 59‑line diff.

Command: python projecteleven.py --challenge --shots 8192

Full output: urandom_runs/urandom_challenge_4.txt … _10.txt

Every d is byte‑identical to the author’s reported hardware result. The
author ran each once. So did /dev/urandom. Both “succeeded.”

Command: python projecteleven.py --challenge --oracle ripple --shots 20000

Full output:
urandom_runs/urandom_challenge_16_17_flagship.txt

The 17‑bit result is the one awarded 1 BTC. /dev/urandom recovers it
~40% of runs on a laptop. The author ran it once on IBM ibm_fez and
claimed a quantum result.

Verbatim terminal output for one 17‑bit run:

Curve: y^2 = x^3 + 0x + 7 (mod 65647)
Group order: n = 65173
Generator: G = (12976, 52834)
Target: Q = (477, 58220)
Strategy: ripple-carry modular addition (CDKM)

Backend: /dev/urandom  (quantum hardware replaced with os.urandom)
Classical register width: 49 bits  (20000 shots)

Unique outcomes: 20000

============================================================
RESULT: d = 1441
Verification: 1441*G = (477, 58220)
[OK] VERIFIED
============================================================

[OK] SUCCESS: Recovered correct secret key

No quantum computer was harmed in the recovery of this private key.

The author’s extraction (ripple_carry_shor.py:197-240, projecteleven.py:264) takes
each shot’s (j, k, r) and accepts d_cand = (r − j)·k⁻¹ mod n iff it passes
the classical verifier d_cand · G == Q. Under uniform noise, d_cand is
uniform on [0, n), so

P(≥1 verified hit in S shots)  =  1 − (1 − 1/n)^S

Plugging in the author’s own (n, S):

The empirical urandom rates above match these theoretical values. The
author’s README even predicts this (README.md:210):

“When shots >> n, random noise alone can recover d with high probability.”

All runs from 4‑bit through 10‑bit have shots / n between 1.9× and 1,170×.
All of them are in the regime the author identifies as classical.

git checkout urandom-reproduces-qpu
uv venv .venv && . .venv/bin/activate
uv pip install qiskit qiskit-ibm-runtime

python projecteleven.py --challenge 4  --shots 8192
python projecteleven.py --challenge 10 --shots 8192
python projecteleven.py --challenge 17 --oracle ripple --shots 20000   # may need 2-3 tries

No IBM account. No token. No quantum hardware. No network.

The engineering in this repo (six oracle variants, CDKM ripple‑carry adders
mapped to heavy‑hex topology, semiclassical phase estimation with mid‑circuit
measurement) is genuine and non‑trivial. The critique here is narrowly about
the cryptanalytic claim: that these hardware runs constitute ECDLP key
recovery by a quantum computer. They do not. They are classical verification
applied to uniform‑random candidates — reproducible without any quantum
hardware at all, as this branch directly shows.