Crown Sterling

Crown Sterling is a crank company that exists at the intersection of pseudoscience (numerology, Pythagoreanism, ), and New Age occultism (including, but not limited to, pyramidology). It is a subsidiary of Strathspey Crown, both of which were founded by .Twin Global. (October 2021). "Robert Edward Grant". Archived from twinglobal.org on Oct. 24, 2021.
The company has presented several fraudulent claims about being able to break cryptographic algorithms, and peddled cryptographic snake oil products such as a cryptocurrency and a messaging app.
== The prelude ==
The beginnings of Crown Sterling revolve around the 24-sector dartboard of quasi-primes, that the company's CEO, Robert Edward Grant, has been rehashing ever since he uploaded his PDF "Prime Number Pattern Associated with Icositetragons"Grant, Robert (June 6, 2018). "Prime Number Pattern Associated with Icositetragons". Archived from filesusr.com on July 4, 2021. online on June 6, 2018. 
In the PDF Grant presented dart-board illustrations that re-invented Paul Pritchard's from 1982. In the dartboards on pages 4, 5, and 6, Grant claimed 1 was a prime number and that 2 and 3 are not prime numbers, most likely because reality didn't suit his grift of numerologist woo of perfect symmetry.
Also, perhaps because Grant missed e.g. the then-eight-year-old Stack Exchange thread on the subject,De Tina, Ton (July 27, 2010). "For any prime p>3, why is p2−1 always divisible by 24?" Via Mathematics Stack Exchange. he deluded himself into thinking he had discovered a basic property of primes, that is, ∀p ∈ ℙ, p > 3: p²≡ 1 (mod 24), that is, every prime larger than 3 squared, minus 1 is divisible by 24. Only, Grant was 2000 years late for the party.Squeamish Ossifrage (Sept. 26, 2019). "What is the efficiency of the new Crown Sterling semiprime factoring method?". Via Cryptography Stack Exchange. 
Finally, Grant redefined a subset of composite numbers as quasi-primes, pretended that it mattered, and ended with the following note:
The "may have" turned out to be quite short-lived, as on June 21st, 2018, just over two weeks later, Grant was already preaching the implications of the "discovery" and his plans to invent a new cipher to someone named Matthew Belair:
Establishing a unified narrative has been a struggle for the team from the get-go. Deciding on whether the quasi-prime "discovery" was important was one thing, but the staff also has been unable to even agree on who came up with the mental dandelion it mattered for cryptography.
Crown Sterling team member Adam Apollo describes the early stages of his relationship with Grant and Crown Sterling in his project portfolio:Apollo, Adam (2020). "Crown Sterling". Archived from https://adamapollo.com on January 9, 2024.According to him, he met Grant in 2017, and one year later, after seeing Grant's dartboard, he came up with the insightful idea of "Hey, the uses prime numbers. I wonder if being able to check if a number is a prime can make it trivial to break RSA encryption, you know, because.", and if Apollo is telling the truth, Grant must have jumped at Apollo's brain-fart, because according to Apollo, in December of the same year, he was already working for the company, developing what was to become a replacement for modern cryptography.
=== The preprint peddling ===
From the uploading of the dartboard PDF, it took merely nine months for Grant and his co-worker (a physicist gone crank) to upload the first part of their grift lore, a crank paper titled "Accurate and Infinite Prime Prediction from Novel Quasi-Prime Analytical Methodology".Robert E. Grant and Talal Ghannam (March 20, 2019). "Accurate and Infinite Prime Prediction from Novel Quasi-Prime Analytical Methodology". Via ArXiv.
The paper was uploaded to the arXiv preprint server, leveraging the fact Ghannam had previously uploaded to arXiv and could thus vouch for Grant. The paper then somehow passed arXiv's "Is the paper full of "-filter.
The crank paper itself made two claims:
# The authors had devised an efficient algorithm (that checks if a given number is a prime number).
# The primality test could be used to solve the i.e., factor large semiprimes (product of two large prime numbers) to break the RSA cryptosystem.
In an interview with a fellow numerologist, Grant gave the date the interview was recorded (March 19, 2019), and discussed the implications of the "discovery":
Already, Grant couldn't help but lie about the process of academic publishing when he claimed that arXiv are peer-reviewed publications. Grant has since made this mistake so many times"Grant thinking arXiv preprints are publications". Via imgur.com nobody can say he doesn't know exactly what he's doing.
Grant's answer, about what he thinks the implications of his "discovery" are, had also done a complete 180, but only for a moment: Just two days after the interview, Grant was already doodling away the logo for his company's new cryptosystem in an Instagram post,Grant, Robert (March 21, 2019). "Grant drawing the TIME AI logo on March 21, 2019". Via imgur.com and just seven days later the product trailer dropped.
== The turd breaks the surface ==
On March 28, 2019, Crown Sterling pushed out its first promotional trailer to YouTube.Crown Sterling (March 28, 2019). "Crown Sterling Presents: TIME AI" via YouTube. TIME AI, the unholy matrimony of numerology and was produced with the ridiculously high-quality CGI only VC money can buy. The trailer came bundled with the following word salad:
The emphasized parts highlight lies used as FUD tactics to attack existing established cryptographic algorithms. For context, RSA is not considered "obsolete" because it's weak. The real reason it is being phased out in such as TLSv1.3Internet Engineering Task Force (IETF) - Network Working Group (Oct. 25, 2021). "The Transport Layer Security (TLS) Protocol Version 1.3". Via ietf.org in terms of is because using RSA omits an important property called that protects from situations where an attacker, who gains access to the long-term private keys (that the use of RSA requires), can decrypt massive amounts of data retrospectively.Greenberg, Andy (Nov. 28, 2016). "Hacker Lexicon: What Is Perfect Forward Secrecy?" Archived from Wired Magazine on June 13, 2023. RSA isn't dead, however, as it is still widely used for 
The rest of the trailer sold the viewer that was an anthropomorphic AI — a ridiculousHarrison, Maggie (Sept. 8, 2022). "Analysis: No, AI Isn't Sentient, You Absolute Morons" Archived from futurism.com on Sept. 29, 2023. claim in of itself — and time-traveling cryptographic keys.
The video was dissected by Ph.D. student Mark Carney on Twitter on August 9, 2019:
== Black Hat 2019 ==
The train wreck of compounding public lies began with the CEO's presentation "The Discovery of Quasi-Prime Numbers: What Does This Mean For Encryption?" at the on August 8, 2019. 
=== The pre-party ===
For Crown Sterling, the event started with TIME AI pre-partyGrant, Robert (August 3, 2019). "Introduction to TIME AI party, Blackhat 2019G". Uploaded by Alex Gaynor on YouTube on Aug. 24, 2019., where Grant defined himself as a number theorist and mathematician despite only having a business degree, claimed RSA, elliptic curve cryptography, and the hash function (yes, really, Keccak), are all based on the RSA problem, and claimed to have created a new cipher during the Christmas break 2018 — which contradicts with Grant's own claims from his interview with Matthew Belair, where he said he had been working on the cipher since mid-June, 2018. 
Furthermore, Grant spouted numerologist gibberish about nouns and verbs in mathematical syntax, and something about musical, circular geometry, and again claimed he was the first to have discovered that ∀p ∈ ℙ, p > 3: p²≡ 1 (mod 24). Grant also implied Numberphile did a segment on "his" discovery, ignoring the fact the segment was released back in November 2018, nobody in the academia knew who Grant was, and Matt Parker who hosted the episode didn't even mention Grant.Parker, Matt (Nov. 20, 2018). "Squaring Primes - Numberphile". Via YouTube. Grant then claimed his system could compress an infinite amount of information into a finite memory, that the system uses AI to compose music, and that its public keys express quantum phenomena called quantum entanglement. Finally, Grant promised a consumer, an enterprise, and a government product, revealed they're completely new to the whole thing, and rolled the TIME AI trailer.
=== The talk ===
The next day, during his $115,000 pay-to-playBernoff, Josh (Aug. 27, 2019). "Crown Sterling asserts its legal right to be an idiot". Archived from https://bernoff.com/ on Jan. 16, 2024. talk, Grant presented his dartboard and quasi-prime preprint, repeated the lie that preprints on arXiv are peer-reviewed, spouted a bunch of numerologist gibberish such as "What we found is that phi is where light emerges from darkness", presented the false claim that (another key exchange algorithm) was based on the RSA problem, and ended with the TIME AI trailer.Aumasson, Jean-Philippe (Aug. 8, 2019). Live tweets from "Robert Grant's "The Discovery of Quasi-Prime Numbers: What Does This Mean For Encryption?" presentation, Black Hat 2019. Archived from Twitter on May 23, 2020. The TIME AI "demonstration" that was promised in Crown Sterling's August 7 press releaseBernoff, Josh (Aug. 13, 2019). "Is this Crown Sterling press release from another planet?". Archived from https://bernoff.com/ on Jan. 21, 2024. was never performed.
After the presentation, during the Q&A session, cryptographer Jean-Philippe Aumasson told Grant Diffie-Hellman is not based on factorization but on discrete logarithm problem, cryptographer Thomas Pornin reminded Grant of prior art that was the Grant was rehashing,Aumasson, Jean-Philippe (Aug. 8, 2019). "I started by telling the guy that DH and AES aren't based on factorization, then Thomas Pornin reminded him of the prior art (Eratosthene sieve), then Dan brilliantly finished him" Archived from Twitter on Jan. 28, 2024. and last but certainly not least, Dan Guido, the CEO of Trail of Bits, called Grant out:
Grant had underestimated how hated is among the practitioners of the field, and his attempt to exploit the prestigious conference caused an uproar.Eddy, Max (Aug. 10, 2019). "Black Hat Attendees: Sponsored Session Was 'Snake Oil Crypto'". Archived from PCMag on Jan. 21, 2024. Black Hat organizers realized their mistake and deleted the talk.Franceschi-Bicchierai, Lorenzo; Cox, Joseph (Aug. 10, 2019). "Black Hat Talk About ‘Time AI’ Causes Uproar, Is Deleted By Conference". Archived from Vice on Jan. 21, 2024. Shortly after, Grant showed what a good sport he was, and sued UBM LLC, the company behind the Black Hat conference, for breach of contract.Gallager, Sean (Aug. 24, 2019). "Alleged 'Snake Oil' Crypto Firm Sues Over Boos At Black Hat". Archived from Wired Magazine on Aug. 25, 2019. 
=== The aftermath ===
After the Black Hat 2019, Grant joined the discussion on Twitter and tried to challenge the cryptographer Jean-Philippe Aumasson — who was present in the sponsored talk — into a cracking contest.Grant, Robert (Aug. 10, 2019). "I tell you what, you seem like a pretty smart fellow. I will make the new encryption available for you to test. I will even pay you significantly if you can crack it. Why not?". Archived from Twitter on Jan. 28, 2024. Cracking contests are a well-known bullshit method to assess cipher security, and has explained it in detail as early as 1998,Schneier, Bruce (Dec. 15, 1998). "Cryptogram: The Fallacy of Cracking Contests". Via schneier.com hence why nobody bothered to explain what was wrong with Grant's proposal,Grant, Robert (Aug. 9, 2019). "I’m actually being quite serious. What’s wrong with this? I’ll pay you $100K if you can crack it just one time." Archived from Twitter on Aug. 12, 2019. to Grant.
Crown Sterling was given its James Randi-style opportunity when Jake Williams offered Crown Sterling USD25,000 to break a relevant size RSA-key in a controlled setting.Williams, Jake (Aug. 29, 2019). "I'm throwing down the gauntlet. I'll publicly shave my head, glue pubes to my bald scalp, and give a recorded talk apologizing and publicly endorsing Crown Sterling's TimeAI if they demonstrate decrypting RSA encryption in the next 14 days.". Archived from Twitter on Aug. 30, 2019. Crown Sterling never took on the challenge.
The demands for Grant to publish their factoring methods grew on Twitter, so to avoid the pressure Talal Ghannam tweeted a lengthy (now deleted) post (see screenshot on the right), where he claimed the reason the factoring method was not disclosed, was they were concerned about public safety. Vacillating between positions of desire for full disclosure, or "we have nothing to hide", and on the other hand "responsible" behavior, suited well for the grifters trying to shake off unfavorable attention without admitting they had nothing. This is evident from never following up with promises to disclose the claimed method, and later Grant's complete 180°-turn regarding public safety concerns, when he would completely reveal several methods that he claimed to be even more efficient than this one.
To further shake the negative attention, Grant attempted to appeal to people's self-interest and laziness, by asking people why they cared so much,Grant, Robert (Aug. 10, 2019). "Why do you care so much?". Archived from Twitter on Jan. 25, 2024. and by telling them they were wasting their time.Grant, Robert (Aug. 10, 2019). "Maybe, maybe not. That’s the nature of risk. You are entitled to your views and opinion, I respect that. If you are correct then you are clearly wasting your time in this string.". Archived from Twitter on Jan. 25, 2024.
=== The lawsuit ===
Competitors
In their August 2019 complaintKatz, Michael I.; Bressler, Joshua R. (Aug. 22, 2019). "ECF Case No. 19, CV7900 - CROWN STERLING LIMITED LLC vs UBM LLC aka BLACK HAT USA and DOES 1-10". Via cdn.arstechnica.com Crown Sterling wept crocodile tears about how infosec experts calling them out was a "premeditated, orchestrated attack […] staged by certain industry detractors and competitors." (paragraph 9), as if discussing the upcoming snake oil presentation was some sort of coordination. The people calling Grant out were not competitors.
* JP Aumasson who at the time worked as the VP of Technology, Principal Research Engineer, and Principal Cryptographer in Kudelski Security, a company that has never competed in the fields of cryptocurrency or secure communication solutions with their own product, but that focuses on security assessment, audits, penetration tests etc. for existing ICT systems.Kudelski Security (Aug. 1, 2019). "Kudelski Security website". Archived from kudelskisecurity.com on Aug. 1, 2019.
* Thomas Pornin works as the Technical Vice President of NCC Group, a consulting company that offers services, not in-house products.NCC Group (Accessed March 20, 2024). "NCC Group website". Via nccgroup.com
* Dan Guido, who at the time worked as the CEO of Trail Of Bits, only offered consulting on Binary analysis, blockhain security, osquery support, software hardening, and secure implementation of cryptography in client products.Trail of Bits (Aug. 9, 2019). Trail of Bits. Archived from trailofbits.com on Aug. 9, 2019.
The claim that pointing out glaring factual inaccuracies (such that all public key encryption is based on factorization) that arose during the talk, was detracting, was as ridiculous as the talk itself.
The gold package
In paragraph 9 the company also claimed it purchased the "highest ('gold') sponsorship package". The truth is, gold package wasn't even the highest gold package. There existed four tiers above the one Crown Sterling bought: gold plus, platinum, platinum plus, and diamond packages.UBM LLC, (2019). "Black Hat 2019 Sponsors". Archived from blackhat.com on July 28, 2019.
Non-existent NDAs
In paragraph 11 the company claimed
as if the participants of the conference where contractually bound to not discuss, or laugh at the talk afterwards.
Vaporware
In paragraph 15 the company claimed 
Despite these claims, the company never published a public key encryption algorithm of its own design. The paradigm-shift never happened. TIME AI was never demonstrated in practice, and extremely likely never even written as software. Further evidence of this is, the company only ever used bog-standard public key encryption schemes, such as NIST P-521 EC-DH,National Institute of Standards and Technology (NIST) (Feb. 2023). "Recommendations for Discrete Logarithm-based Cryptography". Via nvlpubs.nist.gov. NTRUEncrypt,Hoffstein, Jeffrey; Pipher, Jill; Silverman, Joseph H. (1998) "NTRU: A Ring-Based Public Key Cryptosystem". Via ntru.org. and CRYSTALS-Kyber,Bos et al. (April 2018). "CRYSTALS – Kyber: a CCA-secure module-lattice-based KEM" via iacr.org. in all of their actual products.
An industry conspiracy
The company also misrepresented the relationship between industry experts and the ciphers in Paragraph 18:
Given that the industry has been moving awayHorowitz, Michael (Jun 21, 2013). "Perfect Forward Secrecy can block the NSA from secure web pages, but no one uses it". Via computerworld.com. from RSA for key exchanges since the the claims that Aumasson, Pornin or Guido were somehow "entrenched in the RSA encryption model" is ridiculous. 
E.g., on July 8, 2019, a month before Blackhat 2019, the Twitter account of Trail of Bits (the company led by Dan Guido) tweeted literally "Fuck RSA", Trail of Bits (July 8, 2019). "Fuck RSA https://blog.trailofbits.com/2019/07/08/fuck-rsa/" Via Twitter while sharing a link to their blog post under the same title, "Fuck RSA".Trail of Bits (July 8, 2019). "Fuck RSA". Archived from trailofbits.com on July 8, 2019.
The article explained how much the company loves RSA, by opening with the following statement:
JP Aumasson retweeted the tweet by Trail of Bits the same day, adding the following comment:
The documentation for the BearSSL library, written by Thomas Pornin, states that
Thus, as per Pornin, Elliptic Curve Diffie-Hellman (Ephemeral key exchange) should be favored over RSA, as it offers forward secrecy.
In conclusion, none of the people who criticized Grant's TIME AI were proponents of RSA.
Crown Sterling also tried to imply RSA was categorically outdated, by referring it to having been created in 1977, where as Crown Sterling would later use a much more modern technology of elliptic curve cryptography described as recently as 1985.
As for whose algorithms would end up being used in Crown Sterling products, fate, it seems, is not without a sense of irony. Crown Sterling later adopted the Argon2 algorithm for its web-app. Argon2 was established as the de-facto password hashing function in the 2013-2015 Password Hashing Competition (PHC).Password Hashing Competition (Accessed March 20, 2024). "Password Hashing Competition" Via password-hashing.net. This competition was initiated by none other than JP Aumasson. Furthermore, Argon2 builds on top of the BLAKE2 hash function,Biryukov, Alex; Dinu, Daniel; Khovratovich, Dmitry (Dec 26. 2015). "Argon2: the memory-hard function for password hashing and other applications". Via password-hashing.net. which was designed by — you guessed it — JP Aumasson.Aumasson, Jean-Philippe (2012—). "BLAKE2 — fast secure hashing". Via blake2.net.
Pay to play
In paragraph 22, the company states
The truth is, Crown Sterling submitted their talk via sponsored talks, precisely because Black Hat wasn't vetting them. There is no reason to waste $115,000 on a talk, if it could get in with its own merits.
Good men, please do nothing
In paragraph 36 the company states it reached out to Black Hat USA, and
This request for Black Hat to provide higher than deserved validation for TIME AI, an obviously snake oil encryption product (that wasn't demonstrated during the event, and that was never delivered), was ridiculous.
The settlement
On April 20, 2020, BlackHat and Crown Sterling settled the lawsuit.
According to an article in CyberScoop,Stone, Jeff (April 22, 2020). "Crown Sterling and Black Hat settle lawsuit, promise to never speak of it again" Via cyberscoop.com the terms of the settlement were "confidential", a claim confirmed also by Crown Sterling in their own statement:
Yet, Grant, the CEO of Crown Sterling, violated the confidentiality of the settlement on his personal Telegram channel on August 19, 2022, by revealing Black Hat had to pay them a settlement:
== Desperate times ==
By September 2019, Grant's quasi-prime crankery had been refuted, and the company stood in the middle of the PR disaster that was Black Hat. 
Two-thirds of the company staff had quit. At the end of July 2019, the company had 27 employees on its team roster.Crown Sterling team roster (July 31, 2019). Archived from crownsterling.io on July 31, 2019. After Black Hat, at the end of the next month, only nine of the original team remained. And of those nine, Adam Apollo, Alan Green, and Talal Ghannam had apparently asked to be taken down from the company's online staff listing, as the team roster had only six original members.Crown Sterling team roster (Aug. 31, 2019). Archived from crownsterling.io on Aug. 31, 2019. Two people appear to have joined Crown Sterling's team, but out of those two, Christine Bock doesn't have Crown Sterling listed in her LinkedIn bio, she instead appears to have been a hired consultant from CB Partners.
===The Doghouse===
Bruce Schneier's legendary snake oil debunking blog series The DoghouseSchneier, Bruce (2004—). "The Doghouse", a series of refutal articles on cryptographic snake oil. Via schneier.com. had made a comeback on September 5, 2019, and the blog postSchneier, Bruce (Sept. 5, 2019). "The Doghouse: Crown Sterling". Archived from Schneier on Security on Jan. 22, 2024. had roasted the company and its key staff to ashes:
The second to last quote by Schneier, a legendary professional cryptographer and the author of the finalist 
highlights the cluelessness of Crown Sterling nicely, as TIME AI was marketed with the following intellectual masterpiece:
== The RSA cracking circus ==
To peddle his snake oil cryptography, Grant first had to create the demand, and that required breaking existing During his talk Q&A at Black Hat 2019, Grant had already fraudulently lumped Diffie-Hellman and its into the same boat with RSA, by claiming both were based on the RSA problem:
This was a flat-out lie, as:
* RSA is based on the Given large public key N, find factors p and q (that make up the private key) such that p⋅q = N),
* Diffie-Hellman is based on the Given common values (generator g and a large prime modulus p), and public key N, find private key s, such that gˢ mod p = N), and
* Elliptic-curve Diffie-Hellman is based on the Find the discrete logarithm of a random elliptic curve element with respect to a publicly-known base point.
With the convenience of that lie, all Grant needed to do was solve the RSA problem. After all, how hard could it be to undo multiplication? What would follow, was several fraudulent claims about Grant and his company being able to factor large semiprimes to break RSA.
=== Time AI as cipher "hacking" software ===
In the September 2019 issue of OC 500 (Orange County Business Journal), Grant claimed TIME AI itself was the software used in "hacking" cryptographic algorithms.OC500 (Sept. 2019). "Orange County Business Journal (Sept. 2019 issue)". Via ocbj.wppcdn.com. For context, ciphertexts are not "hacked". The term "hacking" is reserved for compromising computer systems. Ciphertexts are "cracked". So not only was Grant spewing amateur techno babble, he clearly hadn't even decided was his vaporware encryption software TIME AI about encrypting data (like the TIME AI trailer implied) or about breaking existing encryption algorithms (like the OC500 article implied).
=== The quasi-prime paper ===
As a refresher, the crank preprint Grant and Ghannam uploaded to arXiv made two claims:
# The authors had devised an efficient algorithm (that checks if a given number is a prime number).
# The primality test could be used to solve the RSA problem i.e., factor large semiprimes (product of two large prime numbers) to break the RSA cryptosystem.
==== Mark Carney ====
The quasi-prime paper was originally refuted by Mark Carney in July 2019, a month before Black Hat.Carney, Mark (July 2019). "Reviewing Recent Prime Generation Methods for Breaking Cryptographic Keys". University of Leeds.
The abstract of the paper states the following:
The paper's findings gives Grant's primality test the time complexity of Θ(n - (n/ln n)), where Θ denotes the exact time complexity.
==== Squeamish Ossifrage ====
In their Stack Exchange answer, Squeamish Ossifrage explains what they found in the paper:
==== Time and space complexity of the factoring method ====
On page 5 of the paper, the authors describe the algorithmic steps for "efficient primality testing":
The proposed 15/4-fold speedup leads to of 𝒪 ((4/15)n²), but unfortunately for Grant, in grown-ups' algorithm analysis, coefficients are ignored as insignificantNoble Mushtak (Dec. 27, 2016). "Why are we allowed to ignore coefficients in Big-O notation?". Via Via Math Stack Exchange. when evaluating the algorithm's time complexity, and thus, the algorithm still runs in 𝒪 (n²), or quadratic time, which in the industry, is considered nothing short of "horrible".Rowell et al. (2012—). Big-O Cheat Sheet. The reason for the quadratic time complexity comes from the algorithm's last step:
On closer inspection, this seemingly innocuous step turns out to be quite the fine print, as Grant et al. conveniently fail to mention the work required to generate the Q-prime grid, and the memory requirements to store it.
The Q-grid and Quasi-primes
In the paper, the Q-prime grid is defined as a multiplication table, the horizontal and vertical headers of which contain:
# The required range of primes
# What the authors call quasi-primes, which are defined as with prime factors greater or equal to 5.
However, for semiprime factoring (which is what breaking RSA requires), on page 6 the authors explicitly want to remove the quasi-primes from the grid's headers:
Now, the multiplication table only has the required range of primes in its vertical and horizontal headers. The rest of the cells are semiprimes, that are the product of their matching header-cells' primes.
The same quote also presents the factoring method: perform a reverse lookup in a lookup table.
Determining the Q-grid size
The Q-grid's memory requirement depends on the area of the grid, which in turn depends on knowing the number of cells in the grid's headers that form the top and left sides. To know that, we need to know how many valid RSA primes are there, and to know that, we need to know the upper and lower limit for the valid primes.
The smallest and largest header value
The modern are 2048, 3072, and 4096 bits, and some programs like OpenSSH support even 16,384-bit keys.The OpenSSH Project. "OpenSSH RSA maximum limit for public key modulus size (16,384 bits)". Via github.com.
Since 3072-bits is the current recommendation,National Security Agency (NSA) (2016). "NSA CNSA Suite key size recommendations". Via keylength.com. it will be used below. A 3072-bit RSA public key is created by multiplying two 1536-bit primes.Pornin, Thomas (June 24, 2015). "What prime lengths are used for RSA?". Via Cryptography Stack Exchange.
The primes in RSA have strict upper and lower limits to their value: For N bit public key, the primes must be greater than 2^{(N-1)/2}, and lesser than 2^{N/2}.National Institute of Standards and Technology (NIST) (March 2019). "Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography". NIST Special Publication 800-56B rev 2, Subsection 6.2.1.3.
The number of primes in the header
To estimate how many primes the grid's header cells would need, the states the number of primes below n, is π(n) ≈ n / ln(n).
Calculating the number of all primes up to 3072-bit ones, and subtracting from it the too-small primes (up to 3071-bit ones), results in
P = \frac{2^{3072/2}}{\ln(2^{3072/2})} - \frac{2^{3071/2}}{\ln(2^{3071/2})} = 6.6 \cdot 10^{458} valid primes to choose from for each key."The prime factor space of RSA-3072". Via WolframAlpha.
Thus, the Q-grid for RSA-3072 has sides that are P = 6.6 ⋅ 10⁴⁵⁸ cells long. 
Number of cells in the Q-grid
A naive Q-grid would have P² = 4.39 ⋅ 10⁹¹⁷ cells."Naive number of cells in Q-grid for RSA-3072". Via WolframAlpha. 
Q-grid size optimization 
Due to the of multiplication, a little less than half of the multiplication table is duplicates. The diagonal center-line of the grid's cells has P unique values in it, thus the accurate number of duplicates is (P²-P)/2.
The number of cells in the optimized Q-grid is thus A = (P²-P)/2 = 2.19 ⋅ 10⁹¹⁷ cells."Optimized number of cells in Q-grid for RSA-3072". Via WolframAlpha.
Time complexity 
The algorithm requires populating the grid by performing at least P = 6.6 ⋅ 10⁴⁵⁸ primality tests to fill the headers. It also needs to perform A = 2.19 ⋅ 10⁹¹⁷ multiplications to populate the grid, and an equal number of search operations to find the factors of the semiprime. These two latter steps both take in the order of n² steps, which means the factoring algorithm time complexity is locked to 𝒪 (n²), which, again, as a classification is considered "horrible".
The computational workload 
To put the computational requirement of 6.7 ⋅ 10⁹¹⁷ operations on the scale, Frontier, the fastest supercomputer todayTOP500.org (c) (November 2023). Frontier supercomputer Via top500.org performs 1.68 ⋅ 10¹⁸ operations per second, and by the time our Sun dies in five billion years,National Aeronautics and Space Administration (NASA) (October 25, 2023)."Our Sun: Facts" via nasa.gov that supercomputer would have performed a measly 2.65 ⋅ 10³⁵ operations."Number of calculations the 'Frontier' supercomputer performs before our Sun turns into a white dwarf". Via WolframAlpha.
Space complexity 
Storing (P²-P)/2 cells is in the order of n². This sets the of this algorithm to 𝒪 (n²), which is again, is considered "horrible".
The memory requirement 
To keep the math simple yet fair, instead of 3072 bits per semiprime cell, and 1536 bits per header cell, we assume all cells are 1536 bits.
With 1536 bits per cell, the grid requires a meek 4.214 ⋅ 10⁹⁰¹ Exabytes of storage."Q-grid size for RSA-3072". Via WolframAlpha. 
Storing 4.214 ⋅ 10⁹⁰¹ Exabytes of data runs into a lot of problems, the most pressing of which is, that there only exists 3.28 ⋅ 10⁸⁰ subatomic particles in the entire observable universe to use as memory,Padilla, Tony (July 10, 2017). "How many particles in the Universe?". The University of Nottingham. Via Numberphile. and to put it mildly, that's not enough.
The energy consumption 
The states that the most energy-efficient computer the laws of physics theoretically allow must consume at least 2.9 ⋅ 10⁻²¹ Joules per operation. Ignoring any factoring algorithms, just incrementing a counter in a program from 0 to 6.7 ⋅ 10⁹¹⁷, would have to consume at least 5.4 ⋅ 10⁸⁹³ Watt hours of energy."Minimum Watt hours to count to 6.7*10^917". Via WolframAlpha.
In comparison, the Sun's total energy output to the space is only 3.86 ⋅ 10²⁶ Watts,Kennewell, John; McDonald, Andrew (March 25, 2016). "The Solar Constant". The Bureau of Meteorology, Australia which over its remaining, five billion year lifespan, yields "mere" 1.7 ⋅ 10⁴⁰ Watt hours in total."The Sun's energy output in Watt hours over its remaining five billion years". Via WolframAlpha.
Wasted effort
Building a complete Q-grid is completely unnecessary in any case. Constructing the grid requires determining all valid prime candidates. During this first stage, for every prime p generated, one can simply perform a trial division on the given semiprime N, to see if N ≡ 0 (mod p), or in layman's terms, to see if the prime p divides N evenly. If it does divide evenly, p has been found, and the other factor is q = N/p. With this method, the space requirement is removed entirely, the computing time spent on computing the grid's non-header values is eliminated, and no separate search in the grid needs to be performed. As this is essentially the time complexity improves drastically from 𝒪 (n²) to 𝒪 ( √(n) ).
This, of course, doesn't mean the algorithm can be made practical. Performing P = 6.6 ⋅ 10⁴⁵⁸ primality tests alone exceeds the lifetime of our Sun and the total energy it produces before it dies. Clearly, the authors have never even considered the actual steps required to run the algorithm in full. Alternatively, they knew full well, and they intentionally neglected the Q-grid having the most significant impact on the actual time complexity and pretended that the speedup coefficient of 4/15 mattered.
Misleading prime "prediction":
Crown Sterling has implied the findings of the paper allow "predicting" primes used in RSA:
This is a lie. When they say "predicting", they don't mean predicting which primes were picked for the private key. They mean "predict" if some number is a prime, i.e. "primality testing". Primality tests are used in RSA key generation, where the system generates large random numbers and checks their primality.National Institute of Standards and Technology (NIST) (Feb. 3, 2023). "Construct a Provable Prime (Possibly with Conditions) Based on Contemporaneously Constructed Auxiliary Provable Primes" Digital Signature Standard (DSS). Via nist.gov If an RSA key generation algorithm could break RSA, cryptographers "probably" would have noticed it. This is why Apollo's early pitch to Grant regarding primality tests influencing RSA security was so stupid.
As was shown above, the pool of valid RSA-3072 primes has 6.6 ⋅ 10⁴⁵⁸ primes to randomly choose from.
Even with an efficient primality testing algorithm (such as the ), being able to test if some number belongs in that pool of valid primes, doesn't help in any way to guess which two primes were picked at random from the pool.
Guessing the primes is 5.73 ⋅ 10³⁸¹ times harder than guessing the AES-256 key that was delivered using RSA, and that's used to protect the data in transit."How many times harder is guessing an RSA-3072 prime, than guessing an AES-256 key". Via WolframAlpha.
In layman's terms, the claim of predicting primes is exactly as useful for breaking RSA, as "predicting" if 72 is a valid number for a Powerball lottery ticket, is useful in winning the lottery itself. By knowing one is only supposed to guess numbers between 1 and 69, they're no longer guaranteed to lose, but they still need to beat the odds. Only with RSA-3072, the probability of guessing the primes, is comparable to winning the Powerball jackpot (1 in 292,200,000),The Associated Press (July 19, 2023). "How hard is it to win the lottery? Odds to keep in mind as Powerball and Mega Millions jackpots soar". Archived from AP News on Jan. 22, 2024. 55 times in a row."Odds of guessing a RSA-3072 prime, compared to the number of times needed to win Powerball jackpot". Via WolframAlpha.
==== The "results" ====
Page 6 of the paper discusses the so-called results:
As the emphasized section shows, Grant and Ghannam have not even bothered to fabricate results for the paper. "Trust me, bro, the results were excellent" is the opposite of what an academic paper provides, and given that even kids at elementary school know answers such as "nuh-uh, not telling" gets them an F from any exam, it doesn't take a rocket scientist to know whether Grant's preprint would have passed an actual academic peer-review.
==== The aftermath ====
After the Black Hat conference, Grant tweeted about claimed improvements:
Just under three weeks later, Grant announced on Instagram these claims were being written out by Grant and Ghannam as a paper, titled "Geometry-Based Prediction Algorithm of Semi Prime Numbers". The abstract blathered something about the "Q-grid matrix method", but the paper was never completed, most likely because Grant and Ghannam knew they were full of shit.
Further proof of this is Grant and Ghannam's book Philomath that was released almost two years later in 2021, that after rehashing what the quasi-prime paper said, states
Part III discussed not the "Q-grid matrix method" but weird "Quadrant Symmetries", discussed quasi-primes that the authors had previously said have no place in the Q-grid for semi-prime factoring, showed that summing numbers produce sums of said numbers, threw in the words North and South, went into a tangent about quadrants of a and after hoping the reader had forgotten about what they were promised, ended with 
No "Q-grid matrix method" was ever presented, the authors never presented an efficient way to factor semi-prime numbers with the Q-grid, and the Q-grid of semi-primes was never mentioned again in the book (although the authors re-used the term "Q-grid" later in another context).
Most of the concepts that were in the "improvements" of part III of the book, were already present in Grant's PDF "Quaternion Symmetry Inherent to the Icositetragon"Grant, Robert (July 6, 2018). "Quaternion Symmetry Inherent to the Icositetragon". Archived from filesusr.com on July 4, 2024. that he had uploaded online back on July 6, 2018.Grant, Robert (July 5, 2018). "Quaternion Symmetry Inherent to the Icositetragon – Publication" Archived from https://robertedwardgrant.com on Feb. 2, 2024. This begs the question: If Grant already had the supposed improvements one year before Black Hat 2019, why didn't he include them in the presentation? Why did he come to the conference with a method that has quadratic (worthless) time and space complexity, and then pretend he was doing active research on the topic when he had eight months to add the supposed improvements to the crank preprint he uploaded to arXiv? Why didn't the preprint even mention a work-in-progress regarding the Q-grid matrix method? The simple reason is Grant is making it up as he goes, and he knows his marks don't fact-check him, ever.
==== Summary ====
In summary, the described factoring method is a trivial reverse lookup in a massive table called the Q-grid. With relevant, average size RSA-keys (3072-bits), Q-grid's 
* 𝒪 (n²) time complexity means the time requirement exceeds the clock counting to the death of our Sun,
* 𝒪 (n²) space complexity means the observable universe doesn't have enough particles to use as the memory for the grid, and 
* Table population and search both have an energy requirement that is more than a perfect could collect from our Sun during its remaining lifetime, to feed the most energy-efficient computer the laws of physics allow.
The algorithm's claimed speedup factor of 15/4 is so small it is ignored in the big-O notation. 
In layman's terms, with modern key sizes, the size of the problem is comparable to being tasked with eating an entire pizza the size of our galaxy. Grant and Ghannam boasting that with their algorithm, one only needs to eat 4/15 of it, isn't exactly helping. Nobody has a belly big enough for the cosmic Margherita slices.
The later Q-grid matrix method that was claimed to cut the size of the original pizza was unfortunately for Grant, never backed by anything, and as Hitchens's razor states, that which can be asserted without evidence can also be dismissed without evidence.
=== The medicine show === 
After the refutal of his preprint, the Black Hat PR crisis, Schneier's searing article, and staff quitting Crown Sterling, Grant had to turn the tide. And he had a plan to crack RSA once and for all. On September 19, 2019, Grant hosted a Gallagher, Sean (Sept. 20, 2019). "Medicine show: Crown Sterling demos 256-bit RSA key-cracking at private event". Archived from Ars Technica on Sept. 21, 2019. for the press and non-technical men in suits. During the show, Grant and the company representatives factored a 256-bit RSA key with a program the company had titled the CS BiPrime Algorithm (ver. 1.1).
==== Plagiarism ====
Unfortunately for Grant, the demonstration video showed how Grant's team had botched their efforts to suppress all Info-messages from the CADO-NFS programCADO-NFS Development Team (2006–). CADO-NFS, a software implementation of the Number Field Sieve (NFS) algorithm. gitlabpages.inria.fr. they plagiarized, as one of the messages, which is verifiable from the CADO-NFS August 2019 source code,CADO-NFS Development Team (August 22, 2019). CADO-NFS source line for the popped Info-message from August 22, 2019. popped onto the screen:
 Info:root: Set tasks.threads=32 based on detected logical CPUs
This of course was noticed immediately the next day when the video went live.@vytvso (Sept. 20, 2019). "If they are *so* unique why they should use the same output like CADO-NFS? Or their code is based on it ...". Archived from Twitter on Jan. 5, 2024.
Clearly, all Grant needed for success was an open source program, like CADO-NFS borrowed from its developers, and the idea of using someone else's technology to advance his grift, that he borrowed from 
Furthermore, on the video, one of the team members claimed the factoring was being done on the local device, that was an Apple laptop. However, judging by CADO-NFS output, the laptop apparently had an impossible amount of 97GB of RAM, and the team also managed to botch hiding the fact they used to remotely connect to a beefier computer for the semiprime factoring.
==== Records from the Soviet age ====
During the event Grant and his team factored a minuscule 256-bit RSA key, hoping the layman would not understand the difference between asymmetric and symmetric key strength, and incorrectly associate the 256-bit asymmetric RSA key they broke with 256-bit symmetric encryption (a key size often hand-wavily labeled as “military-grade”). The industry experts immediately passed warnings to journalists about the obvious attempt to mislead.@SwiftOnSecurity (Sept. 20, 2019). "JOURNALISTS: You may be seeing claims about cracking “256-bit encryption” today. DO NOT REPRINT THAT, IT IS MISLEADING CLAIM ON PURPOSE. They selected that bitlength as a part of their misinformation campaign to confuse you and the public. I asked @ParagonIE to tweet about why.". Archived from Twitter on Sept. 20, 2019.
In reality, to break a key with 256-bit level symmetric security, Crown Sterling would have needed to factor a 15,360-bit RSA key.ECRYPT-CSA (2018). "ECRYPT-CSA Recommendations". Via keylength.com.Interestingly enough, the GNFS that Crown Sterling plagiarized, is the most efficient classical factoring algorithm, and precisely because it's so efficient, RSA's key size requirements for some symmetric security level are noticeably larger when compared to those of symmetric or elliptic curve algorithms. Such an attempt would have been unlikely to succeed, given that based on the public none of the people who are not lying, have publicly factored any RSA-key larger than 829 bits.
To put breaking a 256-bit RSA key in 2019 into the right context, a much larger, 330-bit key was broken by Lenstra et al. slightly earlier, April 1991 to be exact. Coincidentally, Lenstra happens to be part of the team that created the GNFS algorithm,A. K. Lenstra, H. W. Lenstra, Jr., M. S. Manasse, and J. M. Pollard, “[The Number Field Sieve https://link.springer.com/chapter/10.1007/BFb0091537],” in A. K. Lenstra and H. W. Lenstra, Jr. (eds.) The Development of the Number Field Sieve, Lecture Notes in Mathematics 1554, Springer-Verlag, New York, pp. 11–42, 1993. that Grant plagiarized during the medicine show.
In fact, the key size is so weak, breaking it was used as a quick, beginner friendly, intermediate-level assignment in the CUCTF event just weeks later.CTFtime team (Sept. 28, 2019). Crown Sterling. Via ctftime.org.
The assignment was so easy it was rewarded with only 150 points. The more challenging ones were awarded 600 points each.CTFtime team (Sept. 28, 2019). "CUCTF 2019 Tasks". Via ctftime.org.
On Crown Sterling's video, it takes 51.92 seconds to factor the 256-bit semiprime 
 83473593554391843334619428139045661537976651941410655062632649869770538548577
Cursory experiments show a relatively new, mid-price AMD Ryzen 7800X3D CPU factors the same semiprime with CADO-NFS in 44.67 seconds, even though it has half the number of threads compared to Crown Sterling's server they ran CADO-NFS on. Thus, the only logical reason for Crown Sterling to call the press to watch them do something anyone's workstation can do in the same time give or take a few seconds, was to mislead the audience. 
These second-scale differences are as insignificant as the key sizes Crown Sterling broke, but they do show a decent desktop computer is already factoring semiprimes faster than the system in Crown Sterling's clown show did, and yet, the world keeps spinning. The second-scale differences did matter to the grifters though, who were desperately trying to get any positive press. 
After Black Hat 2019, Grant had tried to challenge Jean-Philippe Aumasson not just into cracking their cipher, but also into a competition about who could break a 512-bit RSA key the fastest.Grant, Robert (Aug. 10, 2019). "Of course I meant factoring a bi-Prime into its primes factors. Rules: We will do the test on 512Bit (155 decimal digits). I will send you a number and you will send me a number. We will do it simultaneously at a predetermined time.". Archived from Twitter on Jan. 31, 2024. The medicine show and its plagiarism shows Grant was hoping to change the public topic on Twitter from the relevant "who has the best algorithm when its time complexity is analyzed by experts on paper", into "who can afford the most expensive instance to run the CADO-NFS on".
When problem sizes approach the size of modern cryptographic key spaces, even a modest time complexity change affects the algorithm runtime by astronomical units of time. Competing over seconds in results is thus pointless, often within the margin of error, and always governed by computing power. No wonder nobody wanted to entertain another of Grant's PR grifts.
The absurdity and the obscene levels of crankery in the medicine show naturally led to the infosec community roasting the fudge out of the company on Twitter.Post-medicine show roasting-thread (Twitter). Archived from Twitter on Sept. 25, 2019.
=== Reciprocal factoring ===
After facing ridicule over the medicine show, Grant must have realized it was too late to convince the academia and industry, as he opted to publish his RSA factoring "algorithms" on the respected journal of Instagram wall. 
On September 22, 2019, three days after the medicine show, Grant revealed on Instagram he had already put his business degree to good use and designed a replacement for the the world's fastest classical factoring algorithm he had just plagiarized:
His idea was to find prime factors p and q of semiprime N from the decimal expansion of the semiprime's reciprocal, 1/N. 
Impossible time complexity
As the (lower) screenshot shows, Grant claimed the algorithm has an interesting property:
Having solution complexity be inversely proportional to the size of the problem is the kind of claim a numerologist, who believes in literal magic, would make. Grant is essentially making the claim the algorithm runs in 𝒪 (1/n), which is faster than 𝒪 (1), or constant time, which happens to be the best possible time complexity classification for any algorithm. 
As any meaningful algorithm cannot get faster as the input grows,Stack Overflow Community (Jan. 24, 2021). "Are there any O(1/n) algorithms?". Via Stack Overflow. this claim was so stupid it broke Hitchens's razor. Yet, that did not stop Grant from applying for a patent for this crankery,USPTO.report (May 26, 2022). "Decryption of Encrypted Data Missing a Private Key". Via uspto.report. in the hopes of drawing authority from an established institution, and attracting investors with more money than sense.
Minuscule keys
In an Instagram comment Grant claimed the method could break large RSA keys.
No exact definition for large was made, but it's definitely less than six inches, since in Grant's YouTube explainer,Grant, Robert (July 20, 2020). "Novel Reciprocal Wave Factorization Explained: A x B = C". Via YouTube. he says it works with keys that are "32-bit and all the way out". In Grant and Ghannam's book Philomath (2001), Grant reveals they were able to find prime factors for 24-bit semiprimes, and in his document on reciprocal factoring Grant et al. state they have limited their studies to "32-bit semiprimes at maximum".
No explicit claims of finding factors of relevant size (2048-bit or larger) semiprimes were presented. Grant's YouTube crankery video implied 2048-bit keys, but with that Grant stumbled and hurt himself badly with the shards of Hitchen's razor.
This did not stop Grant (and the co-author Ghannam) from blatantly lying about the origin of the factored semi-primes in their book Philomath, and thus from giving the semi-primes false credibility and their size ridiculously exaggerated importance:
The claim that the RSA official website had 24-bit RSA keys is a complete lie: the smallest number ever hosted on the RSA Laboratories website was RSA-576,"The RSA Challenge Numbers". Archived from rsasecurity.com on May 23, 2004. the range of RSA factoring challenges started from 100 digits,van Tilborg, Henk C.A. (2005). "Encyclopedia of Cryptography and Security" p. 435 (448) and the smallest RSA challenge, the had a 330-bit public key.
Lack of functional correctness
In his YouTube video, Grant claimed the algorithm only works with numbers whose reciprocal's decimal expansion is periodic. However, this is a lie, as e.g. 1/(11⋅13) = 0.006993… is periodic but does not contain the prime factors 11 or 13, as pointed out by the user Squeamish Ossifrage in their Stack Exchange answer. The algorithm therefore does not work reliably, even with small numbers.
Nonexistent efficiency
In his Instagram post, Grant implied the prime factors can be found relatively close to one another, implying the method is highly efficient in stumbling upon the prime factors. However, as explained by Squeamish Ossifrage:
Thus, not only does Grant's WolframAlpha screenshot show he has no idea how to implement his algorithms as programs, but it also shows his nonexistent Photoshop skills to cover his lie.
Furthermore, by resorting to random trial division, i.e. monkeys-bang-typewriters-until-Hamlet-comes-out technology, Grant reveals he has failed to understand the purpose and time complexity of (bogosort = bogus+sort). Always a strong sign of expertise when someone comes up with a proposal for an algorithm the equivalents of which are used in the basic literature of the field and Algorithms 101 college courses, as an example of the worst possible algorithm, and thus as a cautionary example of what one should definitely not do.
Summary
To summarize, after facing humiliation for factoring 256-bit keys 28 years too late, Grant decided to downgrade his CADO-NFS supercar into a and factor 32-bit semiprimes with an algorithm that doesn't always work, that runs in 𝒪 ( √(n) ) which with RSA-3072 requires ridiculous 2¹⁵³⁶ operations,"The number of operations required for factoring a 3072-bit RSA public key with trial division". Via WolframAlpha. and that by the definition of bogosort class of algorithms, makes exactly zero effort to intelligently solve the semiprime factoring problem.
=== Pythagorean factoring ===
On Christmas Eve, 2020, Grant uploaded his third poke at breaking RSA: the Pythagorean factorization method.Grant, Robert (Dec. 24, 2020). "Prime Factor-Based Encryptions Rendered Useless by Right Triangle-Based Constant Time Solution". Archived from robertedwardgrant.com on Jan. 11, 2024.
 The claims 
In his post, Grant's claims reached an entirely new level of crankery:
The excerpt highlights three claims:
# Grant fraudulently claimed his novel method of semiprime factorization could break not just RSA, but also ECC. However, as was shown , elliptic curve cryptography is not based on the RSA problem. No example of breaking any size ECC key was given, most likely due to Grant having again cut himself with Hitchen's razor.
# Grant also claimed he was able to factor keys of "various lengths/sizes", but he was somehow unable to specify the relevant part, the size of the keys. Factoring 1000 minuscule keys is of no significance. Factoring an unfactored large key from the pool of would be. On April 8, 2022, Grant claimed on Telegram they had been able to factor public keys with |p−q|>10¹³⁰⁰, which is what an 8700-bit RSA key would have.
# Last, but certainly not least, Grant made the fraudulent claim the algorithm runs in 𝒪 (1), or constant time, which is nothing short of impressive, given that not even the bane of RSA, runs in less than 𝒪 (72(log N)²).Shor, Peter (Nov. 4, 2013). "Shor's Algorithm speed". Via Computer Science Stack Exchange. A constant time algorithm solves a problem regardless of its size, in the exact same number of steps. Thus, Grant claimed to be able to factor any size semiprime, i.e., break any size RSA key, in the same number of steps.
The implementation
In his article Grant reveals that he used what he called the "Pythagorean Calculator", implemented in Microsoft Excel of all things.Grant, Robert (December 2020). "Pythagorean Factorization - Largest semiprime factored to record" (screenshot). Via imgur.com Always a solid sign when someone who claims to speak eight languages,Grant, Robert (July 22, 2019). "It's Time to Fight Back for Data Sovereignty with TIME AI". Archived from robertedwardgrant.com on Jan. 22, 2024. struggles with learning a single programming language, a core tool for anyone implementing algorithms they design.
Grant left his reader base on the sidelines by not publishing the Excel document, but he did publish a ridiculous illustration with no beginning or end, presumably drawn with Microsoft Paint.Grant, Robert (Dec. 24, 2020). "Pythagorean Factorization" (illustration). Archived from robertedwardgrant.com on Jan. 11, 2024. Even so, the image conveys enough information to fully implement Grant's trivial algorithm. Below is one implementation, written in just fourteen source lines of Python:
import math
def pythagorean_factorization(semiprime: int):
 B = math.sqrt(semiprime)
 r = math.ceil(B) - B
 x = 0
 while True:
 # Solve leg A with the formula in Grant's image
 A = math.sqrt((x+r) * (2*B+(x+r)))
 # Note: Grant's 'ready-to-use' formula is
 # missing the square root used above, but it
 # is present in the bottom right of the image, 
 # where A=24 is obtained with sqrt(576).
 # Solve the hypotenuse with the Pythagorean theorem
 C = round(math.sqrt(A**2 + B**2))
 # Prime factor candidates
 p = round(C - A)
 q = round(C + A)
 if p * q == semiprime:
 print(f"The factors of {semiprime=}" \
 f" are {p=} and {q=}." \
 f" Factoring required {x+1} steps.")
 return
 x += 1
pythagorean_factorization(12193)
 The results 
Running the implementation reveals that factoring 12193, the 16-bit example semiprime Grant used in his weird Microsoft Paint implementation of the algorithm, requires 3 steps, that is, iterations of the while-loop. A cursory experiment of a slightly smaller semiprime 11379 shows it requires 1,792 steps."A Python implementation of Grant's Pythagorean Factorization algorithm". Via Online Python. Having the factoring of a smaller semiprime take 597 times more steps, reveals Grant's algorithm runs in anything but 𝒪 (1), i.e., constant time.
Grant knows the number of steps varies, but as is typical with grifters, he has hidden this fine print in one of the images of the announcement,Grant, Robert (Dec. 24, 2020). "Pythagorean Factorization" (fine print hidden in notes: "Note: if not a perfect square, then proceed (to iterate) x=1,2,3,4,5,6... "). Archived from robertedwardgrant.com on Jan. 11, 2024. where the notation "x=1,2,3,4,5,6,..." reveals he expects x to get iterated (as it does in the implementation above), but Grant fails to acknowledge doing so completely voids the constant time claim.
More plagiarism
Closer inspection reveals Grant's algorithm is just a slightly obfuscated version of the 380-year-old "Step-by-step proof to show Pythagorean Factorization is just Fermat's Factorization algorithm". Via Pastebin. This is also confirmed by the number of steps the algorithm takes. When compared with properly generated keys, the two algorithms take identical number of steps, regardless of key size."Comparison of Fermat's factorization method and the Pythagorean Factorization Algorithm". Via Online Python. The only difference was, instead of brute-forcing the hypotenuse of the right triangle, Grant decided to move things around, and brute force the leg A instead.
On September 25, 2021, nine months after the Pythagorean Factorization Algorithm was uploaded, Grant et al. uploaded an article titled "The Sum Product Conjecture"Grant et al. (Oct. 9, 2021). "The Sum Product Conjecture". Archived from https://robertedwardgrant.com on Jan. 16, 2024. where they "re-derive Fermat’s factorization identity through a geometrical approach.", and "exploit its Pythagorean triangle configuration to investigate the relationship between the sum of two numbers and their product." Apparently taking credit for the work of one of the greatest mathematicians in human historyOduenyi, Valentine (2017). "The 50 Greatest Mathematicians" Via sapaviva.com. was too much for even someone like Grant. This however, did not prompt Grant to issue corrections in the original upload, where he would give credit to Fermat, and where he would retract the absurd and obviously false claims about the time complexity.
The 𝒪 (1) lie
Fermat's factorization method time complexity is governed by the distance of the two primes, and its time complexity is \mathcal{O}\bigl( \frac{|p-q|^2}{4\sqrt{n}} \bigr).
With random primes, i.e. in the normal case, the method runs in 𝒪 ( √(n) ) time.
The 2023 paper by Shatnawi et al. states on page 7 that "N can be factorized in 𝒪 (1) if the [prime factor] difference is small". On page 9 the exact formula for the constant time bound is given:
"N can be factorized in 𝒪 (1) when p³ − 2p²(q+1) + p(q²+1) ≤ 2N where p>q."
Thus, Grant's claim for 𝒪 (1) time complexity without constraints, is a lie. 𝒪 is used to denote the upper bound, i.e., the worst-case scenario.von Brand, Horst H. (Aug. 27, 2020). "What is the difference between Big O, Omega, and Theta?" Via Computer Science Stack Exchange. Since Fermat's factorization method Grant was rehashing runs in constant time only in the best case, i.e. when |p-q| is within the constant time bound, the correct marking for that constant time lower bound with random keys, is Ω (1), not 𝒪 (1).
In layman's terms, the distinction between these two is not exactly a nuance. In the context of the Powerball lottery, the Ω (1) means in the best case, one could win the lottery, whereas 𝒪 (1) means one is going to win it every time after a small fixed number of tries, no matter what.
A rigged challenge
Because of the absurdly efficient best-case scenario of Fermat's algorithm, Grant was able to rig his semiprime factoring demonstrations. By choosing semiprimes with the prime factors close enough to one another, any size semiprime, even ones that match the size of modern RSA key sizes, seems to factor in constant time. This rigging can not be detected just by observing the semiprime. It can only be done after the factoring has been done, by seeing if |p-q| is within the constant time bound presented above. The illustration serves as another layer to hide this. A step-by-step analysis"Pythagorean Factorization crank algorithm refutal". Via imgur.com. of the MS Paint implementation, shows how the work has been done beforehand, as the illustration has the value of x pre-baked into the image. Similarly, Grant presented his Excel calculator (on a now-deleted video) with small enough numbers his computer could fill the Excel document cells faster than the human eye can see, which then allowed Grant to imply all values of x are calculated at the same time, and not cell-by-cell.
It however turns out, that with real RSA, there are no rigged challenges, and there is no Ω (1) case.
The attack that never existed
On page 9 of the original RSA paper (1978), the authors Rivest, Shamir, and Adleman state:
The dangers of the prime-factors p and q being close to one another was thus known by the RSA authors before RSA was published, and the attack never existed for properly implemented systems.
The required checks for prime distance are usually expressed as |p-q|>2^{nBits/2-100}, and are present in both the modern implementation requirements, and modern cryptographic libraries.OpenSSL Project Authors (1999—). "OpenSSL implementation of NIST SP800-56Br1 6.4.1.2.1 requirement for checking the safe distance of prime factors. Legion of the Bouncy Castle Inc (2000—). BouncyCastle implementation of NIST SP800-56Br1 6.4.1.2.1 requirement for checking the safe distance of prime factors.
This hasn't prevented inexperienced programmers from implementing their own naive, and thus vulnerable, RSA key generation programs. Fermat's algorithm has been used as recently as 2022, to break certificates of Canon and Fujifilm printers, as well as four random PGP keys.Goodin, Dan (March 14, 2022). "Researcher uses 379-year-old algorithm to crack crypto keys found in the wild". Archived from Ars Technica on March 22, 2022.
But broken novice implementations do not mean RSA is broken. They only mean Grant either never even bothered to read the then-41-year-old paper, or he read it and decided to append his grift lore with another lie.
Summary
A bit over a year after constructing his soapbox to replace his CADO-NFS supercar, Grant spent his Christmas Eve 2020, riding a he stole from the Musée Fermat.
With fraudulent claims to be able to
* Break ECC, yet never back up that claim with anything,
* Factor 8700-bit RSA keys, yet only factoring a 46-bit RSA key, that was rigged with small prime factor distance, and
* Factor any semiprime in 𝒪 (1), or constant time, yet to have the algorithm turn out to be Fermat's factorizing algorithm with a fresh coat of paint, and that runs in useless 𝒪 ( √(n) ) time, as the Ω (1) best-case Grant boasted about, was identified and mitigated by the authors of RSA back in 1978, before RSA was published,
Grant rode around until he noticed the license plate wasn't his, and then proceeded to tell all about it in his article "Horse Carriage Conjecture", where he investigated the relation of the cart wheel's diameter and circumference, and re-derived Pi.
=== Geometric factoring ===
It's simple, we draw the primes
As his fourth RSA cracking napkin math example, Grant shared his crank geometric factorization equation on Telegram, on April 7, 2022. The crank equation wasn't even an algorithm, but a geometric equation, and Grant's proof was anything but proper It was a class example of "proof"-by-scruffy-picture. It implied any large RSA public key or semiprime could be factored simply by creating an image where the hypothenuse of a right-angle triangle would cross some points.
Scaling issues
A common theme with Grant's grifts is, that the presented methods appear to work, but only do so with tiny semiprimes. This equation is no exception.
The immediate problem with this equation is trying to draw the picture with integer-level precision. That level of precision is the minimum requirement when trying to find a prime, as all primes are integers. With 0.0625-inch technical drawing paper and one integer every 0.0625 inches, fitting a 1536-bit prime of an RSA-3072 key, would require a paper width of 4.3⋅10⁴⁴³ 
"0.0625-inch technical paper's side length, in light-years". Via WolframAlpha. Unfortunately the observable universe is just 9.4⋅10¹⁰ light-years across.National Aeronautics and Space Administration (NASA) (March 2018). "Age & Size of the Universe Through the Years". Via nasa.gov.
Computers are no different. Storing geometric surfaces with (2¹⁵³⁶)² = 10⁹²⁴ pixels, runs as with all Grant's algorithms, into the issue of the observable universe running out of subatomic particles to use as memory. There are, again, only 3.28 ⋅ 10⁸⁰ of them.
The inequation
The major issue with Grant's Geometric Factorization doodle is, that his claim about the intersections of the hypothenuse of the right triangle is a straight-up lie, obfuscated by the lack of resolution and by the large green markings covering the area. The refutal"Geometrical Factorization crank equation refutal". Via imgur.com. of this crank equation shows this in practice, by re-creating the image with exact values in and by showing that even with the claimed correct answers for p and q, and with zoom to mere tenths or less, there is no intersection and thus, the equation does not hold.
=== Conclusion ===
To summarize, here are the RSA factoring algorithms relevant to Crown Sterling's case, arranged by their true time complexity, from best to worst.
Crown Sterling name 	Real name 	Real author 	Claimed time complexity (or efficiency claims) 	True time complexity 	Largest RSA key broken 	Notes
n/a (Listed for comparison) 	Shor's algorithm (1994) 	Peter Shor 	n/a 	𝒪 (72(log N)²r)Shor, Peter (Nov. 4, 2013). "Shor's Algorithm speed". Via Computer Science Stack Exchange. 	5 bits 	Requires a sufficiently large
CS BiPrime algorithm (2019) 	General Number Field Sieve (GNFS) (1993)	Lenstra et al. 	Implied RSA-15360 (with 256-bits of symmetric security) breaks in under one minute [source]	\mathcal{O}\biggl(\exp\left(\left((64/9)^{1/3}+o(1)\right)\left(\log n\right)^{1/3} \left(\log\log n\right)^{2/3}\right)\biggr)	829 bitsZimmermann, Paul (Feb. 28, 2020). "Factorization of RSA-250" Via Cado-nfs-discuss Mailing List. 	Plagiarized
Pythagorean Factorization (2020)	Fermat's factorization method (1643) 	Pierre de FermatPierre de Fermat (1643). Oeuvres de Fermat, vol. 2, p. 256.	𝒪 (1) [source] 	𝒪 ( √(n) ) 	p-q|. Grant's standing factoring record for Fermat's method is from a now-deleted Instagram video (Screenshot: https://imgur.com/a/puZw8oj), where he factored 53019184700161 = 7274171 ⋅ 7288691, where |p-q|=14520. Fermat's method solved it in four iterations. With random (i.e. non-rigged) primes, this is the equivalent of breaking a 16-bit RSA key with an 𝒪 ( √(n) ) algorithm, as √(16) = 4 This evaluation method may seem strange, but it detects false claims of factoring large keys with small prime factor distance.	Plagiarized
Reciprocal Factorization (2019) 	Random trial division 	Robert E. Grant 	𝒪 (1/n) [source] 	𝒪 ( √(n) ) 	32 bits [source] 	The factoring equivalent of "shuffle deck of cards until it's sorted"
Infinite Prime Prediction (2019)	Multiplication-table reverse-lookup 	Robert E. Grant 	"Unprecedented efficiency"[source]"The results were excellent" 	𝒪 (n²) [source] 	0 bits 	𝒪 (n²) space complexity
Geometric Factorization (2022) 	n/a 	Robert E. Grant 	Implied 𝒪 (1): Just complete the equation [source] 	⊥ [source] 	n/a 	The method does not work
* The CS BiPrime Algorithm was the best algorithm ever demonstrated by the Crown Sterling team. However, both the algorithm (GNFS) and its implementation (CADO-NFS) were plagiarized. GNFS is not able to factor even RSA-1024, let alone modern RSA-3072.
* The Pythagorean Factoring algorithm was also plagiarized and grossly misrepresented. The authors claimed it runs in 𝒪 (1), but in reality that happens only in the best case. The syntax for best case is Ω (1), not 𝒪 (1). Since the issue of small prime distance |p-q| has been addressed in all proper RSA implementations since its conception, the average case for the algorithm is 𝒪 ( √(n) ) which makes it useless. 
* The Reciprocal Factoring algorithm makes no intelligent effort to solve the problem. The reciprocal value 1/N is effectively a poor man's random number generator, and stumbling upon the prime factors takes in the order of √(n) steps which sets the time complexity at useless 𝒪 ( √(n) ). 
* The Infinite Prime Prediction pattern requires performing reverse lookups from a multiplication table the size of which is in the order of n², which sets both the time and the space complexity to horrible 𝒪 (n²). 
* The Geometric Factoring equation straight up doesn't work as the equation provably does not hold.
The Pythagorean and Reciprocal factoring methods presented appear to work because they were demonstrated with minuscule key sizes. Their shared time complexity of 𝒪 ( √(n) ) means the algorithms grind to a halt at 180-bit RSA,√(2¹⁸⁰) =2⁹⁰ which is roughly the computational power of major nation-states. The current magical limit of what is considered within the grasp of major nation-states, is somewhere between 80 and 100 bits. For those who want to dive more into this, keylength.com is your friend. long before they can factor relevant size RSA-3072 keys.
The purpose of the napkin-math algorithms (Pythagorean, Reciprocal, and Geometric Factorization) is mostly to leech off admiration from Grant's numerologist fan base who unfortunately for themselves, lack the formal training in mathematics and computer science to be able to tell the napkin math is worthless.
Despite claims to crack 2048-bit RSA (with Reciprocal factoring), and 8192-bit RSA (with Pythagorean factorization), Grant and his team have not managed to solve even a single unsolved These challenges exist exclusively to track the progress of attacks against RSA.
With all that being said,
* The refutals of the methods presented above,
* The endless factual errors and lies made by Grant, 
* The claims of having supposedly solved the RSA problem multiple times, yet still forgetting about it a week later, instead of hosting another press conference,
* The need to plagiarize the work of others, 
* The incompetence in time complexity analysis,
* The inconsistency of coming up with algorithms that have factually worse time complexity than what they have already plagiarized,
* The inconsistency of coming up with algorithms that have worse time complexity than what they claim to already have,
* Peddling a method like Geometric Factorization that straight up doesn't work, and
* Not claiming the glory and global press coverage from winning the 
all say Grant and his team have absolutely nothing of substance when it comes to breaking RSA.
To give some perspective on what real cryptanalysis of RSA looks like, Claus Schnorr's 2021 (failed) attemptSchnorr, Claus Peter (June 16, 2021). "Fast Factoring Integers by SVP Algorithms, corrected (work in progress)". Via iacr.org. highlights the complexity of the math involved in efficient attacks.
== More plagiarism ==
To seem more legitimate as a cybersecurity company, Crown Sterling pushed out topical articles. On March 23, 2020, Crown Sterling's newsroom published an unauthored article titled "Cybersecurity: Under Half of Organizations are Fully Prepared to deal with Cyberattacks".Crown Sterling (March 23, 2020). "Cybersecurity: Under Half of Organizations are Fully Prepared to deal with Cyberattacks". Archived from crownsterling.io on Nov. 25, 2021. This article was plagiarized word-for-word from ZDNET's article under the same title, written by Danny Palmer.Palmer, Danny (Nov. 4, 2019). "Cybersecurity: Under half of organisations are fully prepared to deal with cyberattacks". Archived from zdnet.com on Jan. 27, 2024. The only changes were the Americanization of the word "organisation" to "organization", and changing the apostrophe styling. The article has since been removed by Crown Sterling.
== Snake oil cryptography ==
After lying about all public key encryption being based on the RSA problem, and lying about RSA being weak, Crown Sterling was ready to release its own algorithms. To the surprise of absolutely no one, the algorithms were as full of lies and deceit as their earlier claims, and as broken as one would expect from numerologists, who try to solve post-doctoral-level research problems in a sophisticated branch of applied mathematics, with middle-school-level math.
In September 2021, Crown Sterling released its Lite Paper. "THE CROWN SOVEREIGN - Lite Paper (2021)". Archived from crownsterling.io on Sept. 26, 2021. Later, the same year, the company released a more detailed, full White Paper titled "Crown Sterling - Cryptographic Security Protocol".Crown Sterling (2021). "CROWN STERLING - CRYPTOGRAPHIC SECURITY PROTOCOL" Archived from hubspotusercontent10.net CDN on Dec. 19, 2021.
In these documents, the authors described a broken cryptographic protocol built from broken cryptographic primitives.
=== Broken RNG ===
As and all depend on cryptographic randomness, it's vital for any cryptosystem to use a proper 
Oh, the irony
In their White Paper, the authors reveal what they decided to use as CSPRNG:
 is a CSPRNG from 1986. It is rarely used because it's computationally heavy and slow.Omorog, Challiz D. and Gerardo, Bobby D. and Medina, Ruji P. (2018). "Enhanced pseudorandom number generator based on Blum-Blum-Shub and elliptic curves". 2018 IEEE Symposium on Computer Applications & Industrial Electronics (ISCAIE). Via ieee.org.
Its authors have proven its security reduces to factoring of large semiprimes which is exactly the type of cryptography Grant has been trying to get rid of since his Matthew Belair interview in summer 2018, where Grant said:
Questionable choice
In his tweet cryptographer Markku-Juhani O. Saarinen explains why the selection of Blum-Blum-Shub was highly questionable:
A point that needs repeating. Professional cryptographers think the only reason to select Blum-Blum-Shub as the DRBG, i.e. the random number generator, is to have a backdoor.
Userland seeds
On page 4 of the White Paper, the authors explain how the BBS RNG is seeded:
As Scott Arciszewski explained to the Monero project in October 2016, userland PRNGs are considered antipattern.Arciszewski, Scott (Oct. 29, 2016). "Don't use Insecure Userland PRNG for random_scalar()". Via github.com This includes things like keystrokes that can in cases like the leakRutkowska, Joanna (Apr. 23, 2011). "The Linux Security Circus: On GUI isolation". Via blog.invisiblethings.org a major part of the RNG's seeding entropy to any malicious program running on the system.
The model shows Kernel is the most privileged part of the operating system and using less privileged CSPRNGs is an extremely vulnerable design; leaked internal state of an RNG breaks all cryptographic systems that rely on the RNG.
Judging by Talal Ghannam's Stack Exchange question,Ghannam, Talal (Dec 18, 2019). "Should the seed of CSPRNG produce the same random number?". Archived from crypto.stachexchange.com on March 7, 2024. the team apparently struggled even with understanding the concept of what a seed is, when he asked if a CSPRNG (which is a could be made more secure by having it function non-deterministically (impossible) with some seed. The company was thus definitely not in a place where it should be designing its own CSPRNG.
I wonder what this knob does
Despite Grant's earlier lies, the truth is, that semi-prime factoring remains a hard problem and thus, BBS remains a secure CSPRNG, if left as such. So naturally, to ensure maximum crankery, after Talal Ghannam had asked about the topic on December 12, 2019,Ghannam, Talal (Dec. 12, 2019). "using non prime numbers in Blum Blum Shub or Blum Micali". Archived from crypto.stachexchange.com on Dec. 8, 2023. and received no reply, Grant and his team, in their numerologist paranoia, just went ahead and changed stuff:
The team replaced the semi-prime factorization problem of BBS, with factoring decimal expansions from irrational numbers, which unlike the numerologists would like to believe, are not magical, but your average everyday composite numbers, and thus trivial to factor. E.g., WolframAlpha can factor the number 
 14159265358979323846
 26433832795028841971
 69399375105820974944
 59230781640628620899
 86280348253421170679
created from first 100 decimals of Pi in seconds."Factor integer formed from first 100 decimals of Pi". Via WolframAlpha
Aaron Toponce, a security and system engineer, explained on Reddit exactly how this influences the RNG behavior:
An RNG that has a short period starts repeating itself much sooner. This means the attacker can store its complete output, try all subsections of it, and easily break everything that relies on the RNG's output, which might include password and key generation including cryptocurrency wallet private keys, nonces, initialization vectors, etc.
=== Quantum encryption ===
Since TIME AI, the company has been advertising quantum encryption:
Quantum encryption isn't a thing outside , and QKD isn't an app. It requires dedicated fiber optic cables as installed in topology. Anyone who's ever had to install the last mile of fiber to connect online can probably guess how much it would cost to install an all-the-way fiber between their house, and the house of every peer they have, and then throw on top of that the very, very expensive hardwareQuantumCTek (2024). "QKD-POL1250 - High-speed Quantum Key Distribution Terminal". Via quantum-comm.com. (one for each peer) that's capable of handing an actual QKD protocol such as so one can talk to them.
However, it turns out QKD is only needed to make cryptography provably unbreakable. It isn't needed to make cryptography secure against quantum computers.
One-minute crash course
Cryptographic algorithms are built typically as where is used to protect content in transfer, and is only used to exchange the key for the symmetric cipher. The slow advances in quantum computing have implications for these two types of cryptography. 
Symmetric algorithms are affected by which has the efficiency of 𝒪 ( √(n) ). This means it cuts key-strength of symmetric ciphers in half. This means 128-bit ciphers are reduced to too weak 64 bits, but 256-bit symmetric ciphers remain secure as their security is only reduced to 128 bits. This algorithm runtime is however only theoretical. In practice, the circuit depth is limited to roughly 2⁴⁰ logical gates, which means breaking 128-bit AES requires more than 2¹²⁸ operations.Valsorda, Filippo (July 6, 2022). "This MAXDEPTH is realistically around 2⁴⁰, which makes a quantum attack against a 128-bit cipher take more than 2¹²⁸ anyway. This is because ideal Grover requires an unrealistically long-running serial computation, and can't be parallelized well per https://arxiv.org/pdf/quant-ph/9711070.pdf". Via Twitter.
Asymmetric, or, public-key cryptography is matched against that can break RSA, Diffie-Hellman, and its elliptic curve variant regardless of key size, as it runs polynomial in log N time, that is, in a reasonable time. Because of this, public key cryptography is in transit towards 
Grant and his team probably opened up the news and realized this at some point, as they decided to pivot from snake oil "quantum cryptography" to snake oil post-quantum cryptography.
=== The "post-quantum" key exchange ===
After much hype about their system being secure against quantum computers, Crown Sterling finally revealed their post-quantum suite in their White Paper on page 21:
So after all that hype, their strategy to beat quantum computers was to use elliptic-curve Diffie-Hellman (EC-DH) for key exchange. What makes this choice particularly stupid is, that not only is EC-DH vulnerable to Shor's algorithm, but breaking EC-DH requires a much smaller quantum computer than breaking RSA does, as the estimate tableGagliardoni, Tommaso (Aug. 24, 2021). "Quantum Attack Resource Estimate: Using Shor’s Algorithm to Break RSA vs DH/DSA VS ECC" Via kudelskisecurity.com. from Kudelski Security shows:
Symmetric security	RSA bits	Qubits requiredfor Shor's alg.against RSA	ECC bits	Qubits requiredfor Shor's alg.against ECC
112 	2048 	4098 	224 	2042
128 	3072 	6146 	256 	2330
192 	8192 	15362 	384 	3484
And then it got even more stupid
When questioned about how EC-DH could be made post-quantum in Crown Sterling's Telegram channel, Naomi Mathew, a Crown Sterling research team member revealed their strategy:
Mathew's response is phenomenal in all of its crankery.
Elliptic curve private keys are not prime numbers
As explained by Squeamish Ossifrage on Stack Overflow:
Thus, elliptic curve private keys are not limited to only prime numbers. Any will do. This includes any primes that happen to also be elements of the field. If there was a check that ensured the scalar was not a prime, that would only make the number of possible keys smaller, which would only aid the attacker.
46-bit keys, if you're Google
As a numerologist, Grant has littered his Instagram wall with pictures of transcendental numbers such as Pi containing every possible value at some point of its decimal expansion.Grant, Robert (April 7, 2019). "Grant sharing numerologist Pi woo". Via imgur.com. Ignoring the philosophy and woo, it's true. But that also means that Grant knows the decimal expansion of Pi contains all 521-bit private keys NIST P-521 EC-DH would normally use, including ones that are primes, at some point. This is a contradiction to Grant's team claiming the keys generated from Pi's irrational decimal expansion are more secure than the normal keys. Thus, the logical conclusion is — any valid private key generated with cryptographic RNG is equally secure, and Grant and his team are full of shit. Furthermore, in practice, the irrational keys are much weaker, because of the massive computational overhead to generate the keyspace to pick a key randomly from.
A sequence from an irrational number such as Pi, is just a number produced with an insecure PRNG, with a known seed. The PRNG in this case is the most efficient algorithm for approximating Pi, the and the seed values are the baked-in coefficients necessary to generate Pi.
The decimal expansion needs to be as secure as NIST-P521 EC-DH, and that requires there be at least as many keys as there would normally be. Since the key is not the value, but the random offset, this requires 2⁵²¹ offsets to choose from. (The length of the key requires additional ⌈log₁₀ 2⁵²¹⌉ = 157 digits in the offset space"Length of key in decimal expansion". Via WolframAlpha. but it can be ignored as insignificant.)
Unfortunately for Crown Sterling, Pi has only been calculated to a precision of 100 trillion digits. This was done by Emma Haruka Iwao, a researcher at Google in 2022.Emma Haruka Iwao (June 9, 2022). "Even more pi in the sky: Calculating 100 trillion digits of pi on Google Cloud". via Google Cloud Blog. This caps the number of offsets and thus the number of distinct keys to only 100 trillion unique values. A cryptographic key that has 100 trillion choices, has the strength of a log₂ 100,000,000,000,000 = 46.51 bit key."Bit strength key space that matches of 100 trillion offset space". Via WolframAlpha.
Given that the Chudnovsky algorithm runs in 𝒪 (n (log n)³),Yee, Alexander (Oct. 25, 2023). "Formulas and Algorithms" Via numberworld.org generating a 521-bit key requires roughly 2⁵²¹ ⋅ ln(2⁵²¹)³ = 2⁵⁴⁶ᐧ⁴⁸⁹ operations,"Base2 Exponent for number of operations for Pi with 2^521 decimals.". Via WolframAlpha. which is 47 million times more work than breaking the NIST P-521 EC-DH with brute force."How many times larger is generating 2^521 offsets from Pi, than trying all 2^521 offsets". Via WolframAlpha.
The reason modern cryptography is so strong is because it's computationally easy to generate a large random key, and computationally hard to break that key. What Crown Sterling's scheme proposes, is that it's computationally harder to pick the 521-bit private key from 2⁵²¹ possible offsets than it is to break the key exchange by trying all 521-bit keys.
In practice, it means even Google's research team with Google's computing power (128 vCPUs, 864GB of RAM, 515TB of disk space, and just under 158 days of number crunching), struggles to generate a 46-bit key. 46-bit keys haven't been secure from state actors practically ever, and academics broke the 1,024 times stronger 56-bit cipher back in 1998 with the EFF's machine. Thus, a state actor who puts in the same time to pre-compute the decimals as Google did, can cycle through them and try all 100 trillion offsets in a matter of hours. This is of course only the worst-case scenario, that is, if an entity such as Google would generate the key. An average end-user device couldn't generate but a fraction of the key space in a reasonable amount of time, which greatly reduces the time and space it takes for the attacker to generate the pre-computed table and cycle through it.
Shor go brrr
Last but certainly not least, Shor's algorithm solves the for finite abelian groups. It will find the private key just by looking at the public key. It doesn't care how random the private key is. Many EC-DH private keys are generated with that are the only thing that yields non-algorithmic, truly random numbers, and nobody's thinking they're somehow able to make EC-DH safe from quantum adversaries.
=== Crown-OTP: a broken stream-cipher ===
For symmetric encryption, Crown Sterling claimed they had picked the 
Definition of OTP
A one-time pad (OTP) is a cipher with an extremely specific definition. In computerized OTP, 
# The plaintext and key are binary strings, and encryption is done by adding the two modulo 2, that is, by the two together.
# The key must be generated with a Using any algorithm to expand the key by any amount, immediately changes the cipher from an OTP into a 
# The generated key must be at least as long as the message,
# The key must be used only once, as repeated use of the key and
# The key must be destroyed immediately after use to ensure forward secrecy.
When used exactly this way, OTP is that is, decrypting a ciphertext without the key in a is impossible.
Secure use of OTP
Secure usage of OTP in real life requires additional steps.
# Since OTP is an additive cipher, it's any change in the ciphertext will result in a changing of the plaintext. If the attacker knows the plaintext content for any reason (perhaps the protocol adds predictable header values), they can change it to say whatever they want. To prevent this, OTP must be paired with unconditionally secure authentication, such as or Carter-Wegman MAC.Cederlöf, Jörgen (June 2005). "Authentication in quantum key growing" Linköping University. Via liu.se
# Since OTP is the only information-theoretically secure algorithm, using any other algorithm to exchange the key, makes it exactly as weak as the key exchange algorithm. This is why OTP was traditionally delivered either in person or via a dead drop spikeCrypto Museum (Aug. 4, 2015). "Dead drop spike". Via cryptomuseum.com, or as it is sometimes today, with the ridiculously expensive quantum-key-distribution (QKD) apparatus, as was discussed above.
Crown-OTP
In their White Paper, Crown Sterling reveals how their system for OTP was created.
Crown Sterling's solution was to just ignore the exact requirement that forbids expanding the key. This automatically changed the cipher from OTP into a stream cipher.
Modern 256-bit stream ciphers, such as and -, are not information-theoretically secure, but they would have satisfied Grant's desire for post-quantum security if used with . But then Grant decided to remove post-quantum security by exchanging keys with Diffie-Hellman.
Square roots are not magic
The golden rule of cryptography is "Don't roll your own cryptography". Yet, in their numerologist hubris, Grant and his team went and did just that. As the excerpt above shows, in their Crown-OTP stream cipher, they chose to expand a shared secret into a keystream with square root of all things. For context, all stream ciphers require expanding the key into the keystream with a proper, cryptographically secure pseudo random generator (CSPRG).Khurana, Dakshita (Aug. 27, 2020). "Pseudorandom Generators (PRGs), Stream Ciphers". Via courses.grainger.illinois.edu
Unlike the grifters who would like their marks to believe, a square root decimal expansion isn't some magical truly random number compressed into the radicand. Square root function is just that, a It is an entirely deterministic (and thus trivially replicable) operation that creates the decimal expansion from an input value. The square root function can be expressed e.g. with the following implementation of Newton's method, written in Python:Runestone Academy (Jan. 20, 2022). "Newton’s Method". Via runestone.academy."Implementation of Newton's method for square roots with arbitrary precision". Via Online Python.
from decimal import Decimal, getcontext
def newton_sqrt(n: int, decimals: int) -> float:
 """Calculate square root using Newton's method.
 From https://runestone.academy/ns/books/published/thinkcspy/MoreAboutIteration/NewtonsMethod.html
 Modified for arbitrary precision.
 """
 getcontext().prec = decimals + 1
 half = Decimal(1/2)
 approx = half * n
 better = half * (approx + n / approx)
 while better != approx:
 approx = better
 better = half * (approx + n / approx)
 return approx
print(newton_sqrt(16, decimals=100))
print(newton_sqrt(2, decimals=100))
The cipher was broken immediately
The reason why only experts should be designing ciphers became clear, when on December 31, 2021 — just over three months after the Lite Paper came out — Sophie Schmieg, the leader of Google's Cryptography ISE team, wrote an application that used to recover the seed from the square root's decimal expansion, regardless of its offset,Schmieg, Sophie (Dec. 31, 2021). "I was a bit bored, so I decided to reconstruct an integer from the fractional part of its square root. You never know when you might need such an algorithm, after all.". Archived from Twitter on Feb. 11, 2024. effectively breaking this toy cipher.
All CSPRGs must have a property called unpredictability, which means it's computationally infeasible for an adversary to determine future output from the already given output.Boneh, Dan (Sept. 27, 2013). "Cryptography I - Stream ciphers and pseudo random generators" Via VideosCoursera Yet, by recovering the radicand, the obviously deterministic square root function could be used to generate the keystream to decrypt future ciphertexts.
Schmieg's findings about Crown-OTP were confirmed the next day by the cryptographer Markku-Juhani O. Saarinen.Saarinen, Markku-Juhani O. (Jan. 1, 2022). "...yes frac(sqrt(x)) is most definitely a bad one-way function if someone proposed it as such, and a slow one too." Archived from Twitter on Feb 5. 2024.
Four months later, to avoid their followers from learning about the break, Crown Sterling created a low-profile Twitter account, @cs_mathresearch, which they then used to inquire about the break.Crown Sterling Research Team (May 22, 2022). "Let's say you want to reconstruct an integer using only a segment of its square root mantissa, starting at an arbitrary index. How would this method be applied to do that?". Archived from Twitter on Jan. 29, 2024. Crown Sterling never thanked Schmieg for saving their customers' ciphertext confidentiality from a complete break, nor did they report the vulnerability to the 
Despite Schmieg's break, Grant still went ahead and applied for a patent for the ridiculous cipher.Grant, Robert (May 16, 2023). " Use of irrational number sequences to secure state transition function in blockchain transactions". Via patents.google.com
Horrible PRG performance
On February 24, 2024, Schmieg published a blog post about the attack.Schmieg, Sophie (Feb. 24, 2024). "Lattices vs Cranks". Via keymaterial.net
The post explained how the keystream generation in fact takes in the order of \mathcal{O}(n{^\frac{3}{2}}\ log\ n) operations, and explains its implications:
In layman's terms, as the key is used, every bit that gets encrypted encrypts more slowly than the previous bit. A cursory test shows generating just a 65kB keystream (enough to encrypt a tiny image, or a short article) takes more than 30 seconds.
Ridiculously efficient attack
The lattice reduction runtime is 𝒪 (n³) which means the crank-PRG is slightly faster, but the attack only requires a 256-bit chunk of keystream to recover the keystream, thus extracting the key from the keystream takes in the order of milliseconds, even for very large plaintexts.
Useless offset hardening
The proposed OTP scheme uses unknown offsets that discard some of the most significant bits. However, as Schmieg explained in her blog post:
=== What authentication? ===
In their TIME AI trailer, Crown Sterling advertised the authentication mechanism:
This word salad is about as clear as mud, but it implies some sort of authentication mechanism would be implemented for the protocol.
However, nowhere in the Lite Paper or White Paper is authentication mentioned, and in Figure 11, on page 30 of the White Paper, it is clear that the message and pad are XORed together, and the resulting ciphertext is then delivered as is, to the contact for "reverse XOR". No authentication was used at all for the system, which in the case of malleable stream ciphers such as the Crown-OTP, is nothing short of a disaster. A , as demonstrated above, could allow the attacker to change the content whether it's the message, sum to transfer, or anything in between, to whatever they want.
=== Theon Technology ===
The same bastardized stream cipherTheon Technology (Nov. 15, 2022). "How to Reduce OTP Key Storage and Transmission Overhead". Archived from theontechnology.com on Nov. 28, 2022. was apparently also sold business-to-business, via another of Grant's companies, called Theon Technology.Theon Technology Theon Technology website Archived from theontechnology.com (now defunct) on Nov. 29, 2023.
Interestingly, Grant's face wasn't anywhere to be found on the company website. Perhaps he was unsure if Black Hat had been forgotten yet. Instead of Grant, or the CEO, the company's public face seemed to be a New York Institute of Technology graduate and author of some infosec books. How this man descended from Lockheed Martin and got his hands dirty consulting a snake oil cryptography peddler, remains a mystery.
The company CEO Scott Bledsoe left the company in June 2023, and in February 2024, the company's website started to redirect to Crown Sterling's company website. It would thus appear the company has pivoted from cryptography to by disappearing for good.
== Cryptocurrency ==
In his search for a use-case for his broken protocol, Grant decided it was time to pivot his business model to the surprise of absolutely no one, and as predictedMatthew Green (Sept. 20, 2019). "These Crown Sterling people are going to launch a cryptocurrency, mark my words.". Archived from Twitter on Jan. 5, 2024. by some of the most notable experts, into cryptocurrencies.
While Crown Sterling's normal stock was offered at no less than USD 4980 a share,U.S. Securities and Exchange Commission (SEC) Info (Dec. 22, 2020). Crown Sterling Ltd. LLC - Notice of an Exempt Offering of Securities. Archived from secinfo.com on Jan. 22, 2024. the ICO that was the CSOV token, offered an unregistered security at more reasonable prices to retail investors. Unfortunately for Grant, the ICO bubble had burst already in 2018 with the SEC going after ICOs.Popper, Nathaniel (Feb. 28, 2018). "Subpoenas Signal S.E.C. Crackdown on Initial Coin Offerings". Archived from The New York Times on March 1, 2018. Announced two years after the bubble burst, released four years too late, the CSOV token's price crashed in just two months, and it never recovered. 
As a pre-mined coin, it's effectively Monopoly money with no scarcity and thus no real value. As CoinTrust states, "These coins are distributed among a few people who can then manipulate the coin’s value as they desire. [...] Once the coin is traded at an exchange and increases in value, the founders of the coin sell their pre-mined coins and disappear from the scene." CoinTrust (July 2019). "Major Features of Scam Coins". Via cointrust.com The main purpose of the token seems to have been a) to have at least something to show the stock investors, and b) to provide some cash inflow from retail investors buying the worthless 
The cryptographic protocol was never implemented as Crown Sterling's own blockchain that could make use of the claimed post-quantum transactions. The CSOV token operates as a Polkadot parachain, and the WCSOV token as an Ethereum smart contract.Etherscan. "Create: WrappedCSOV". Via etherscan.io The Ethereum smart contract contains absolutely nothing that would imply WCSOV uses anything described in the Lite Paper or White Paper. Polkadot's signatures use sr25519Polkadot. "Keypairs and Signing". Via wiki.polkadot.network. and Ethereum uses ECDSA, neither of those is post-quantum.
The only good thing to say about the cryptocurrency grift is, that it hasn't gotten very far, as WCSOV has only 115 holders.Ethplorer. "Token WrappedCSOV Holders". Via https://ethplorer.io
==== Scammy exchanges ====
The (W)CSOV token is offered on five exchanges that are FMFW.io, Changelly PRO, HitBTC, BitMart, and Uniswap.
FMFW.io
Originally Bitcoin.com Exchange, the exchange rebranded itself as FMFW.io in September 2021. Trustpilot shows only five reviews, all one star.Fmfw reviews Via trustpilot.com
Global Fraud Protection found deeply concerning irregularities.
Purchasing CSOV via the FMFW.io exchange is being marketed by a company called Sarson Funds.Sarson Funds (Sept. 28, 2021). "A New Paradigm of Personal Data Sovereignty.". Archived from sarsonfunds.com on Dec. 8, 2023. Dirty Bubble Media found the Sarson Funds had "steered their investors' money into one scam after another", and they captioned an illustration of the CSOV token price crash with the concise message: "Rug. Pulled.".Dirty Bubble Media (Feb. 24, 2023). "Don't Forget to Feed the Ponzi". Archived from dirtybubblemedia.com on March 1, 2024.
Changelly PRO
The subreddit /r/monero lists Changelly PRO under "Do not use the following exchange(s),/r/monero (Accessed March 1, 2024). "Distrusted by the Community". Archived from reddit.com on June 11, 2023. citing three threads.moneroexchange13 (April 11, 2018). "Major issues with changelly. Support does NOTHING. Changelly still trying to attract more customers.". Archived from reddit.com on June 10, 2023.Nttwo (Aug. 17, 2017). "Changelly scam... I think so.". Archived from reddit.com on June 7, 2023.[Deleted user] (Aug. 8, 2017). "Major issues with changelly. Support does NOTHING. Changelly still trying to attract more customers." Archived from reddit.com on June 10, 2023.
HitBTC
Trustpilot lists just under 900 one-star reviews for HitBTC.TrustPilot (Accessed March 1, 2024). "HitBTC reviews". Via trustpilot.com
The subreddit /r/monero lists (also) HitBTC under "Do not use the following exchange(s),. Archived from reddit.com on June 11, 2023. citing two threads.shadomoon (Aug. 25, 2017). "HitBTC.com Scam - Stolen Tokens worth 150 ETH ($50,000 USD)". Archived from reddit.com on June 10, 2023.sQtWLgK (March 27, 2017). "HitBTC exchange suspends withdrawals "until the hard fork" ". Archived from reddit.com on June 6, 2023.
Cointelligence gave the exchange a perfect score of 0 points in every aspect, flagging it as a complete scam.Cointelligence (Jan 28, 2022). "(SCAM ALERT) HitBTC ". Archived from cointelligene.com on Jan. 28, 2022.
In his article "(s)HitBTC holds <10% solvency, and selectively scamming more users than not.",Sanders, Richard (Dec 25, 2019). "(s)HitBTC holds <10% solvency, and selectively scamming more users than not". Archived from medium.com on Dec 27, 2022. Richard Sanders explains the scam:
Thus, even honest positive reviews only aid the scammers in exploiting those with no legal protection.
BitMart
Trustpilot shows the exchange has over 850 one-star reviews.Trustpilot (Accessed March 1, 2024). "BitMart reviews". Via trustpilot.com Sitejabber has six reviews, all one-star, for the exchange.sitejabber (Accessed March 1, 2024). "BitMart reviews". Via sitejabber.com
Bitcoin Forum has a discussion about the exchange being a scam.timz (Aug. 7, 2023). "(SCAM REPORT) Bitmart.com SCAM, stolen over $100k" via bitcointalk.org
The victims of the scam are aggregated under the Twitter account @bitmartscam.
Uniswap
81% of the total 38 reviews on Trustpilot gave the exchange one star out of five.Trustpilot (Accessed March 1, 2024). "uniswap.org reviews". Via trustpilot.com
Malwaretips lists the exchange as a scam website that has anonymous owners and hosting, that has blocked access to accounts after receiving payments, and that has "created deep fake videos and doctored screenshots of business leaders endorsing the project".Orsolya, Thomas (Nov. 19, 2023). "Don’t Fall For the Wallets-uniswap.org Crypto Scam". Via malwaretips.com
Conclusion
Every single exchange the (W)CSOV token is being offered is an outright scam, which is rather fitting for a scam token. As the vendor of the token, Crown Sterling obviously does not care if the funds can be withdrawn by the users later. As per CoinMarketCap,CoinMarketCap (Accessed March 1), 2023. "Top Cryptocurrency Spot Exchanges" Via coinmarketcap.com the exchanges rank, in the order of least scammy service first, as follows:
# BitMart (rank 32)
# FMFW.io (rank 70)
# HitBTC (rank 94)
# Changelly PRO (rank 146)
# Uniswap (did not even make the cut)
== Orion Messenger ==
After realizing they had missed the ICO boom, Crown Sterling decided the best way to pump value into their token would be to offer a VPN called Orion.Grant, Robert (July 21, 2022). "DEFI Summit Conference - Day 2". Dcentral Con. Via YouTube. Something must have happened, however, as one year later Orion was a "quantum secure" messaging app.Grant, Robert (Nov. 17, 2023). "Introducing ORION Messenger". Archived from robertedwardgrant.com on Jan. 11, 2024. Not like the authors cared too much: the messenger's Lite Paper, released in May 2023,Crown Sterling (May 10, 2023). "Orion Lite Paper" Archived from crownsterling.io on June 6, 2023. still, a year later, refers to the messenger as "Bellatrix".
=== The Lite Paper ===
Two cryptographers going by the pseudonyms RazeHer and Geyblade effectively killed the da Vinci virus by combing through the Lite Paper in their Quackers series blog postRazeHer, Geyblade (Jan. 29, 2024). "Is “Orion” by Crown Sterling Legit? Nope!". Via quackers.blog. in detail. Additional points are made below:
The Lite Paper states Orion uses "AES256" without describing the relevant part, the While the key size is safe, it contradicts Grant's plans he revealed to Matthew Belair in June 2018:
The Lite Paper also reveals the company was still trying to bake in the broken snake oil Crown-OTP stream cipher dissected . The internal workings of the system are not documented which gives no reason to trust it.
The messaging app runs in a browser — a horribleArcieri, Tony (Dec. 30, 2013). "What’s wrong with in-browser cryptography?". Archived from tonyarcieri.com on April 27, 2022. idea in of itself. 
On Lite Paper's page 5, the app is advertised as "trustless", but it is still closed source, meaning no one can independently verify it uses the encryption algorithms claimed in the documentation, let alone verify whether they're safely implemented and used.
=== Orion Beta ===
If it looks like a backdoor and walks like a backdoor...
Crown Sterling took special precautions to enforce the uninspectability of their web app's source code by compiling it as This, however, wasn't done soon enough, and a cursory peek at the application's code they pushed to anyone who bothered to open the web app's website, shows that the client fetches — what appears to be the user's plaintext NTRU private key used for end-to-end encryption of messages — from the server as the user logs in.
In cryptography, encryption is only a tool to convert a confidentiality problem into a key management problem. In messaging apps, those who control the private keys have access to message content. Thus, Orion appears to be a grifter's paradise, as it appears to give the company's staff full control over their marks' communication, from controlling the discourse regardless of promises, to possibly even eavesdropping on everything they say. This is in strict contrast with what's being promised by Crown Sterling to their customers. 
Because of what the peek into the messenger's source code showed, the app should not be trusted until the company joins apps like Signal, Wire, Threema, Session, Element, and many others, which all not only end-to-end encrypt everything by default, but have open source clients. Open source client ensures the vendor's claims about end-to-end encryption can be verified by not just audit companies, but much more importantly, by independent security researchers. Security without transparency is called and it has never worked. It only opens possibilities of abuse, as was again seen here.
=== The White Paper ===
That's the fault of yesterday's me!
On Feb. 5, 2024, in a responseCrown Sterling (Feb. 5, 2024). "In all seriousness, we've got a new whitepaper which will be published soon and will explain even more about ORION's cryptographic protocol. Here is the first look at the draft for anyone who wishes to take a peek". Archived from Telegram on Feb. 7, 2024. to a heckler asking about this very RationalWiki article, Crown Sterling took special time and care to refute the math, findings of inconsistencies in the company's story, pictorial evidence, and all references of this article with the step-by-step methodology of telling it contains "so much falsehood". Next, in the post, the company laughed at their apparently backdoored code being too old for it to matter. They conveniently ignored they had at one point designed the application to upload the NTRU private key to their servers. The fact they ever even considered such a protocol reflects their incompetence. Furthermore, given that Orion isn't older than July 2022, it's not like their incompetence is from past times. The post ended by sharing a draft White PaperCrown Sterling (Jan. 2024). "Crown Sterling Orion Messenger qE2EE Whitepaper". Via imgur.com. for the Orion Messenger on Telegram.
The heckler then proceeded to laugh at the protocol's amateur design and demanded Crown Sterling to follow up with their claims of being able to break RSA by cracking the RSA-2048 challenge and to release the client's source code for the sake of transparency. These requests were followed by the expert PR take of deleting everything the heckler said, and banning them — according to their second post,Crown Sterling (Feb. 7, 2024). "Crown Sterling's response to the heckler". Archived from Telegram on Feb. 7, 2024. — for violating the company's policy of "respectful dialog".
In their second post, the company also stated they are working with "university cryptographers", while conveniently failing to name a single one. They then proceeded to formally prove the security of Orion messenger's protocol with a promise to have it audited by "respected third parties", which were not specified. The promise of audit is hollow, as audit companies typically don't have permission to publish unredacted results on their own. Also, audits are expensive and thus always finite in scope, and because audits are rule-based, they are trivial to rig to ignore relevant aspects. Audits are similar to RNGs' statistical tests: they are only useful if they show issues in the evaluated system. In information security, passing an audit is not a guarantee of anything, but failing an audit is a guarantee of there still being issues to fix.
The post also stated: "we recognize the importance of open sourcing critical aspects of our protocol to allow developers to be able to build on top of our quantum-secure network", which together with the announcement to only allow selected entities to audit the full codebase threw a wet blanket to those hoping the company would publish the source code for the entire client, which is the requirement for being trustless, and for independent verifiability of the system's holistic security.
But, it would be rude not to accept Crown Sterling's courteous invitation to peek under the hood by evaluating what the Orion whitepaper states.
Pointless unmaintained cryptographic libraries
On page 6 of their White Paper, the authors state they are using CryptoJS, which is an unmaintained cryptographic library.crypto-js. Via https://www.npmjs.com. Always a strong sign when a company that claims to use modern cryptography uses libraries that nobody fixes vulnerabilities for. CryptoJS has a dubious past of using non-cryptographic random number generation with math.random(). This has since been fixed, but given that the library doesn't add anything, means Crown Sterling has no idea they're just using a pointless wrapper for the browser's native Crypto API.mdn web docs_ (April 7, 2023). "Crypto: getRandomValues() method" Via https://developer.mozilla.org.
What is a KDF?
On page 4 of their White Paper, the authors reveal their failure to understand the difference between and that perform as the authors decided to use Argon2id to derive the remote data fetching token from the client-side data encryption key. PHFs are not used as normal KDFs because they are pointlessly slow. Passwords need to be stretched to improve their strength, but given that the first pass of Argon2id already yields the key that can decrypt all of the user's data on the server, it makes no sense to use Argon2id again to create the token for fetching the file the vendor already has access to.
While this is not a strict vulnerability, it is a much less secure design: PHFs are always time-limited by user experience, and redirecting half of the time available for key stretching to do a pointless "super-secure" KDF operation, shows major incompetence. The company's staff clearly have no idea which blocks fit which hole, and the reason this matters is, that it's such an obvious mistake, that any cryptographer would have immediately told them this, which proves they are not working with any cryptographers. As for the Argon2id itself, the relevant part, i.e. the parameters (time cost, memory cost, parallelism) were also not disclosed, which puts the algorithm's memory hardness (its key selling point) and the authors' expertise in disclosing what matters, into question.
Hard choices 
On page 5 of their White Paper, the authors show their choice for AES mode of operation is AES-CBC/GCM. With their lack of expertise, the company apparently struggles to choose between that is unauthenticated and vulnerable to and which as an is by default and considered the best practice. Not knowing this trivial distinction, again shows the company staff hasn't done their homework, and they sure as hell don't employ any cryptographers.
Brain-farts
On page 7, the authors state: "Please note that the original master password cannot be stored anywhere to prevent the attacker from breaking into other users' accounts in the case the user reuses the master password somewhere else".
Having the account security of other users be dependent on storing one user's master password is so ridiculously stupid, and so absurdly dangerous and bad design, this statement should probably be dismissed as having been written after falling into daydreaming mode after a tall glass of bourbon. Then again, designing something this stupid would be more than on-brand for the company of "infinite wave conjugations".
No secrecy from the future, no secrecy from the past
On page 8, the authors state: "A novelty and differentiating feature of the ORION messenger is the capability to have large multi-user group chats that are entirely qE2EE, making ORION the first post-quantum large group messenger on the market. This is guaranteed by the flow of creating chats. In our case, the user who is responsible for adding members is also responsible for generating the individual credentials for each member to grant them access to the group chat messages. The first step is to generate a chat session key. The session key is shared across all members."
So, in their desire to provide end-to-end encryption for groups so large confidentiality starts to lose its meaning, Crown Sterling decided to implement a protocol without best practices such as Also, judging by the fact the White Paper states on the same page "session key rotation is not part of the current implementation", not just future secrecy, but even the crucial property of from 1990,Günther C. G. (1990). "An identity-based key-exchange protocol". Advances in Cryptology EUROCRYPT '89 (LNCS 434). Pages 29-37. first deployed by the in 2004, has been left as an afterthought. What makes this particularly funny and ironic is, that the RSA algorithm that Grant hates so much, is being phased out precisely because of its lack of forward secrecy, not because it's weak like Grant has fraudulently claimed.
Acquiring the knowledge on how to deploy a group key exchange is clearly pointless, when the planned alternative is according to the White Paper's page 8, to force group admins to deliver a new group key for every member, every time a user joins or leaves the group, a fun way to needlessly slow down the group admin's device, consume their battery, and possibly data plan. In their defense, the authors are aware of the limitations, so they proceed to misrepresent them:
"Please note that this procedure of encrypting the Session Secret must be repeated for each member, thus adding members has linear complexity and will take considerable time for large groups. However this is not expected to be an issue as the process is performed only once for each member, and chat size is expected to grow over time (as opposed to large, fast influxes of users)."
Unfortunately for Crown Sterling, to be able to read each other's messages, all group members need to be on the same page about what the key is. While they claim key rotation is not expected to be an issue, what they fail to take into account is, as the group grows into e.g. 3,000 members, every time a member joins, all 3,000 members will need a new key, preferably right away. And precisely because the number of members varies only slightly, a group that has gotten too large is doomed to stay resource-intensive. The fact it takes time for users to populate the group has a nice property of showing the users how the group member limit is not like the authors would like their customers to think, infinite, but capped by the performance of the group owner's device. This also opens up obvious denial-of-service attack vectors for very large open groups, that can be performed by simply joining and leaving the group rapidly. The fact the authors don't even consider trivial attacks like these tells us they lack the adversarial mindset it takes to design secure protocols.
Mixing up the mixnets
On page 10 of the White Paper, the authors mention plans for the future:
"Another feature for switching to a decentralized backend is the anonymization of users through a mechanism similar to onion routing"
Failure to understand that (e.g. ) is used for anonymization of traffic, not decentralized storage, which is what software such as has been doing for the past 24 years, is funny and again, telling.
Who's going to be running this network of onion routing nodes is also unclear. If it's going to be Crown Sterling themselves, there is no anonymity, because control over the entry and exit node breaks anonymity with a simple end-to-end correlation attack.Arminius (Jan. 5, 2017). "How do traffic correlation attacks against Tor users work?". Via Information Security Stackexchange.
The innovation of redundancy
Page 10 also states: "Having a decentralized storage system will bring many benefits to the messenger. It will ensure redundancy as the data will be shared across multiple nodes in the network."
The company's plans to have "ensured redundancy" in the future, calls into question what server-rack-in-the-cleaning-room technology is being used by the system currently. All datacenters use or to ensure redundancy.
No public-key fingerprints
 have been used to guard against in the very first end-to-end encrypted system, at least since 1997. Although the comparison of fingerprints is an integral part of practically every modern end-to-end encrypted messaging app, the White Paper doesn't even mention them. The authors are thus apparently completely unaware of basic attacks against cryptographic protocols, or they stayed quiet about the feature to maintain the possibility of eavesdropping on their users with an MITM attack, which unlucky for the users are without fingerprints, undetectable. 
Furthermore, it is not only Crown Sterling that can perform MITM attacks: The certificate system that the between the user's browser and Crown Sterling's servers uses, is not considered safe from entities like nation-states who run programs such as and are the typical adversary with access to quantum computers. The inconsistency in threat modeling where a web app of all things is supposed to offer protection against the most well-funded adversaries, again shows the ridiculous incompetence.
Empty promises to open the source
In their second Telegram post, Crown Sterling stated they intended to release "critical aspects" of the source code. However, on page 3 of the White Paper, the authors state they intend to deploy their Kyber-x25519 hybrid key exchange as an unauditable Rust WebAssembly binary blob.
For context, open-sourcing a protocol without open-sourcing the client that uses it, is worthless, as parameters delivered to and from a verified protocol's API can break the system's security completely. For example, the UI elements are responsible for showing the public key fingerprint to the user. This is a convenient place to hide a backdoor that lies about the value of the fingerprint. Crown Sterling's promise to release the source code for just the protocol, and not the entire client, is thus worthless.
Passwords over keys
On page 11, the authors state:
"From a UX perspective, we enable compatibility with legacy systems by using the embedded password manager, as this allows the user to access the data based on his master password, instead of basing the security around the private keys."
Failure to understand which is stronger, a 256-bit key generated by a proper CSPRNG, or a 40.54-bit password generated by an average user,Florêncio, Dinei; Herley, Cormac (May 12, 2007). "A Large-Scale Study of Web Password Habits". Archived from research.microsoft.com on March 27, 2015. is also more than telling about what the security of the system will ultimately be.
Oh right, the blockchain
To fill the quota on buzz-words and the relevance of their token, the team ended the White Paper with the following note:
"We are confident we will be able to merge our revolutionary quantum security with the latest high-speed blockchain solutions creating a first-of-its-kind secure social and community platform alongside a thriving development community."
This is the first and only time the word blockchain appeared in the paper. Hopefully, it will remain the only time it's ever associated with a secure messenger, given that the idea of storing communications ciphertexts — the keys of which depend only on knowing the password — in an append-only distributed ledger anyone can access, invites every malicious actor in the world to a bingo of cracking passwords of non-technical users to read their messages.
Summary
During their journey, Crown Sterling has had to learn the hard way, that they don't need to burn their reputation with false claims about breaking standard encryption, before coming up with a product that uses standard encryption. The next rock they banged their shin against, was learning self-invented stream ciphers are trivially breakable, and right after that, that butchering relatively safe primitives like the Blum-Blum-Shub only gets them bad press. 
They have now reached the point where they use standard primitives of the industry. But they are still figuring out which brick goes through which hole in the shape sorting cube of protocol design. The protocol lacks all basic properties like forward secrecy, future secrecy, public key fingerprints, and group key exchanges. The amateur mistakes show Crown Sterling definitely isn't working with "university cryptographers". Also, advertising the continued use of WebAssembly for cryptographic primitives shows the company did not actually have plans to open the source, even for the most relevant part, the algorithm implementations, that need to be verifiable by anyone and everyone.
== The staff ==
Here are the Crown Sterling team members who have participated in the company's "research", preprints, and self-published PDFs.
=== Robert Edward Grant ===
Grant, a man who unfortunately failed to meet the notability guideline of Wikipedia,User:Premeditated Chaos (Nov. 4, 2021). "Wikipedia:Articles for deletion/Robert Edward Grant". Via wikipedia.org ,User:Epitalon (Sept. 28, 2024). "Wikipedia:Requests for deletion/Requests/2024/Robert E. Grant". Via simple.wikipedia.org thrice,User:Auntof6 (Nov. 27, 2024). "Wikipedia:Requests for deletion/Requests/2024/R. Edward Grant". Via simple.wikipedia.org deserves an introduction.
A blog post, authored by the nickname Quasiprimes, dug up interesting things about Grant,quasiprimes (Sept. 20, 2019). "Robert Grant of Crown Sterling". Archived from wordpress.com on Sept. 26, 2019. which have been incorporated below.
Formal education
According to The Org,The Org (~2021). "Robert Edward Grant" Via theorg.com. Grant has the following formal education:
# Bachelor of Arts (BA) in Korean and International Relations, from Brigham Young University (1988-1994)
# Master of Business Administration (MBA) in International Finance, from Thunderbird School of Global Management (1997-1998)
# YPO/OMP program in the Presidents' Program in Leadership, from Harvard Business School (2009-2017)
No degree in mathematics, or computer science, the prerequisites of proficiency in cryptography.
Work history
According to UCI Samueli School of Engineering,UCI Samueli School of Engineering (Jan. 2010). "Robert E. Grant, Allergan Medical on Entrepreneurship". Via engineering.uci.edu. before 1997, Grant held several management and leadership positions, including
* General manager (Australasia)
* Director of Marketing (Asia Pacific), and 
* Country manager (Japan)
for medical device manufacturers, such as 
* Sulzer Medica AG (Switzerland), and 
* The Nucleus Group of Pacific Dunlop Ltd (Australia).
Lumenis, Inc. (1997-2003)
# 1997-1998: Director of Business Development for HGM, Inc., later acquired by Lumenis.Securities and Exchange Commission (~2005). "FORM 10-K, BIOLASE TECHNOLOGY, INC." Via sec.gov.
# 1998-2001: Managing Director of European Operations for the Coherent Medical Group, (Dieburg, Germany).
# 2000-2001: Vice President of Business Development of the Coherent Medical Group.
# 2001: President of the Surgical Business of the Coherent Medical Group, a subsidiary of Coherent, Inc., later acquired by Lumenis.
# 2002: Executive Vice President and General Manager of the Surgical and Ophthalmic Business of Lumenis.
# 2002-2003: Executive Vice President and General Manager of the Medical Business of Lumenis in Santa Clara, California. 
BIOLASE Technology, Inc. (2003-2006)
Grant joined BIOLASE Technology, a publicly traded Cosmetic Dentistry company, in June 2003 as the Chief Operating Officer (COO) and as the Chief Financial Officer (CFO).BioSpace (June 16, 2010). "Bausch & Lomb Names Robert E. Grant as CEO and President of Its Surgical Business". Via biospace.com
In October 2004, Grant was appointed as the Director and President and Chief Executive Officer, and in March 2006, as the acting chairman.BioSpace (March 29, 2006). "BioLase Technology, Inc. Expands Board Of Directors And Appoints Robert E. Grant As Acting Chairman". Archived from biospace.com on March 2, 2024.
Allegedly, after nearly destroying BIOLASE, Grant was either fired, or he bolted from the company.Ron Z (Dec. 14, 2011). "Organizational Announcement - Robert Grant" Archived from cafepharma.com on March 2, 2024.
Allergan, Inc. (2006-2010)
In May 2006, Grant was appointed as the Chairman and President and CEO of Allergan plc. According to Quasiprimes, Grant's presence there has mixed reviews, and he has been accused of pilfering millions from physicians:
Bausch and Lomb (2010-2011)
Grant became the CEO and President of Global Surgical BusinessBausch + Lomb (May 2011). "Executive Leadership Team" Archived from on May 6. 2011. at Bausch and Lomb on August 1, 2010.Ophthalmology Times (July 1, 2010). "Bausch and Lomb appoints Grant for surgical business" Archived from ophthalmologytimes.com on March 2, 2024. 
On December 13, 2011, Brent Saunders announced Grant leaving the company.Saunders, Brent L (Dec. 13, 2011). "Surgical Organization Update" Via cafepharma.com. Grant was allegedly fired for not getting along with Brad Paddock,Anonymous (Dec. 16, 2011). "Organizational Announcement - Robert Grant" Archived from cafepharma.com on March 2, 2024. the vice president of sales.BioSpace (Nov. 05, 2010). "Bausch & Lomb Makes Three Management Appointments To Surgical Business". Archived from biospace.com on March 2, 2024.
According to Quasiprimes,
The alleged patent trolling might have been the last straw to the industry, as Grant never worked for another company in the industry after leaving Bausch and Lomb in December 2011. Grant went on to start Strathspey Crown, his holding company of grifts almost immediately, in January 2012.
Allegations of sexual harassment
Grant has been accused of sexually harassing women as early as April 2012,Anonymous (April 8, 2012). "Organizational Announcement - Robert Grant" archived from cafepharma.com and again in February 2014.Anonymous (Feb. 19, 2014). "Aesthetic Expansion" Archived from cafepharma.com on March 2, 2024.
Allegations of investor fraud
Strasphey Crown founded a company called Alphaeon Corporation in July 2013.PR Newswire (July 22, 2013). "Strathspey Crown Establishes Alphaeon Corporation, The First Self-Pay Lifestyle Healthcare Company". Via prnewswire.com. In September 2015, Alphaeon launched a product product called ShoutMD.PR Newswire (Sept. 15, 2015). "ALPHAEON Launches ShoutMD 3.0, The First Social Commerce Store For Lifestyle Healthcare Products". Via prnewswire.com.
On November 9, 2019, a group of hackers sharedtimecop (Nov. 9, 2019). "Crown Sterling hacked". Via schneier.com on Schneier's Friday Squid Blog, an off-topic thread for miscellaneous infosec topics, an old-school — -style e-zineTimecop (Nov 5, 2019). "TIMECOP - TIME AI". Via pastebin.com where they revealed they had breached ShoutMD's private forums, and that it was trivial due to non-existent security. The e-zine presents some interesting claims and some serious allegations:
Verifying the allegations is hard, but something may have happened, as per the Wayback Machine, the website quietly disappeared during 2019.Internet Archive (Accessed March 15, 2024). "Wayback Machine: shoutmd.com". Via archive.org.
Conclusion
Grant's career trajectory, marked by his terminations from several companies, as well as alleged patent trolling, investment fraud, and sexual harassment, starkly contrasts with the story dressed as humor, that he told at the TIMEAI pre-party, about exiting the industry because he "couldn't be evil anymore". 
None of Grant's education, or earlier work has any intersection with cryptography.
=== Talal Ghannam ===
Formal education
Ghannam's 2003 Master's thesis from Western Michigan University was about "Optical Solitons in a Three-State Medium".Ghannam, Talal (June 2003). "Optical Solitons in a Three-State Medium". Archived from scholarworks.wmich.edu on May 18, 2021. Ghannam's 2007 PhD dissertation was about "Quantum Properties of Light Emitted by Dipole Nano-Laser".Ghannam, Talal (December 2007). "Quantum Properties of Light Emitted by Dipole Nano-Laser". Archived from scholarworks.wmich.edu on March 22, 2020.
In addition to the dissertation, Ghannam has ten other publications.ResearchGate (Accessed March 7, 2024). "Talal Ghannam". Via researchgate.com. Unfortunately for Crown Sterling, it's all in the field of physics. The only use his degree would have been for the company was to teach about the process of academic publishing. Instead, his degree was abused to gain upload rights to ArXiv's preprint server.
Crank publications
Considering his reputable academic background, Ghannam has seriously sold out: In 2012 he self-published a crank book titled "The Mystery of Numbers: Revealed through their Digital Root", and later, in 2021, another of the same sort, titled "GeoNumeronomy: Unraveling the universe through numbers and forms". Ghannam has also co-authored with Grant the book Philomath.
False credentials
Despite the lack of any degree or research in mathematics, Ghannam has been claimed by Crown Sterling to be a number theorist.Crown Sterling (Nov. 9, 2023). "Crown Sterling Limited LLC Founder Publishes Novel Geometric Model of Natural Spirals". Archived from prnewswire.com on Nov. 9, 2021.
=== Alan Green ===
On his archived website,"Alan Green, Biography". Archived from tobeornottobe.org on Nov. 11, 2020. Green explains his background:
Grant meets crank
Following his career in the music industry, Green began in 2004 his crank work of "deciphering codes hidden within Shakespeare's works, which finally solves history's most persistent cover-up.""Alan Green, Biography". Archived from tobeornottobe.org on Dec. 5, 2023. His YouTube videos, among other things, tie the crank decodings of Shakespeare's sonnets to the Great Pyramid of Giza:Green, Alan (Bard Code) (July 20, 2020). "Pyramid Structure of the Sonnets" Via YouTube. a novel form of pyramidology.
While Green was interviewing Grant on Dec 1, 2020,Green, Alan (Bard Code) (Dec. 1, 2020). "Bardcast™ 8 - special guest Robert Edward Grant". Via YouTube Grant said he had been a follower of Green's work, and that in 2017 he had stumbled on Green's 2016 CPAKCPAK, or Conference on Precession and Ancient Knowledge is a conference that offers a buffet of cranks doing presentations and book signing, all for the low low price of $399. presentation, where Green explained how he had through trial and error stumbled upon approximations of mathematical constants in his measurements of the Great Pyramid of Giza. Coincidentally, Grant, in his infinite wisdom, had realized that יהוה, the Tetragrammaton (Hebrew block script for Yahweh) from 840 BCE, can be interpreted as mathematical syntax: ו and י can be interpreted as 7 and ⁷ respectively, and ה as π.
All one has to do is squint their eyes enough, and ignore the entire relevant history of the Hebrew alphabet and Western Arabic numerals:
# The letter ה, or evolved from the Egyptian hieroglyphs representing the words thread, jubilation, and court, which look nothing like the Greek letter π.
# The letter ו, or evolved from the Egyptian hieroglyph representing the word mace which looks nothing like 7. 
# Similarly, י, or evolved from the for the word hand that also looks nothing like 7. 
# The didn't precede book "On the Calculation with Hindu Numerals", which wasn't written until 825CE.
# The that contains π didn't exist until 9th century BCE, and π wasn't used to denote the mathematical constant until the mathematician decided to do so in 1706.
One should also completely ignore that the Hebrew language has its own ancient cultural practice of assigning numbers to words called where
* Waw (ו) is associated with the number 6 (not 7),
* Yodh (י) is associated with the number 10 (not 7), and
* He (ה) is associated with the number 5, not 3.14159265358979323846…
But Grant put his expertise on history of ancient cultures and numerology to good use, ignored all that, and decided יהוה was the equation π7π⁷. After realizing π7π⁷ = 7π⁸ ≈ 66419.717 doesn't really mean anything, he then through trial and error figured out that π⁷ / π7 = 137.34131, which to numerologists, who love to adjust precision as needed, was exactly the same as the 180⋅(3−√(5)) ≈ 137.50776.Unfortunately Grant missed the precise value of the golden ratio is of the form A⋅(B − √(C)), where A=180 is the highest score one can achieve with three darts, B=3 which is the number of letters in "CIA", and C=5 is the number of Twilight movies. Yes. It's all connected.
Grant then reached out and called Green, who pretended to be very busy, and after Grant had explained the Tetragrammaton crankery, Green said he had figured out, that in the ratio between the volume of the and its sarcophagus was also 137.5.
Green's discovery be easily seen from the respective dimensions of the King's chamber 10.5m ✕ 5.2m ✕ 5.8m = 316.68 m³, and the dimensions of the granite sarcophagus 0.987m ✕ 1.051m ✕ 2.276m = 2.361m³.Löhner, Franz; Zuberbühler, Teresa (2006). "The Great Pyramid of Khufu (Cheops)". Archived from cheops-pyramide.ch on Dec. 2. 2020. Together these two give the ratio of 316.68m³ / 2.361m³ = 134.130 which again, to the numerologists was exactly the same as the value Grant came up with, 137.341. All you need is enough rounding. Alas, 137 rounds up to 140 and 134 down to 130, but on a positive note, both values round down to an even 100, which happens to be the number of Dalmatians acquired by the Radcliffes, plus an offset factor.
Considering the shared ability to ignore mathematical precision, historical accuracy, sense of chronology, the concept of and the shared understanding there's easy money to be made from gullible pyramidologists even with trivially falsifiable claims, it is no surprise the two saw eye-to-eye, and agreed they should meet.
Crank in command
Later in the video, Green brought out his expertise by explaining how the Diffie-Hellman key exchange works:
Thinking Diffie-Hellman revolves around multiple large prime numbers shows Green can not tell RSA and Diffie-Hellman apart. So, naturally, Crown Sterling positioned Green as the "Director of Cryptography".Gallagher, Sean (Aug. 29, 2019). "Snake oil or genius? Crown Sterling tells its side of Black Hat controversy". Via arstechnica.com. Green's background was ridiculed on Twitter, the day after BlackHat 2019.Margaritelli, Simone (Aug. 9, 2019). "HOW DARE YOU MAKE FUN OF THEM!! Don't you know that their Director of Cryptography "dedicated the last fifteen years to decrypting mathematical codes in Shakespeare’s writings that have revealed unknown sacred geometry hidden in the pyramids of Giza" FOR F SAKE?! BOW, NOW.". Archived from twitter.com on March 7, 2024.
Despite his position, Green never contributed to a single preprint or PDF self-published by the company, and he has stayed relatively far back from the public eye of the company.
=== Amanda Kennedy ===
Amanda Kennedy popped up with Crown Sterling's PR Newswire article that announced another crank preprint on ArXiv,Grant, Robert E.; Ghannam, Talal; Kennedy, Amanda (March 20, 2019). "A Novel Geometric Model of Natural Spirals Based on Right Triangle Polygonal Modular Formations". Via ArXiv. this time about spirals, and with no mention of cryptography.
As per her LinkedIn, she joined the company as a summer intern in June 2021 and was promoted a researcher two months later. Apart from the preprint, Kennedy stayed in the background throughout her employment. 
Lucky for her, she left the company in April 2023 and she has since found a job at Aerojet Rocketdyne, that matches her formal education (aerospace engineering and rocketry) from University of Central Florida (UCF).
=== Naomi Mathew ===
Naomi Mathew has, as per her LinkedIn,Linkedin (Accessed March 7, 2024). "Linkedin, Naomi Mathew". Via linkedin.com a BA in mathematics from the University of California, Riverside (UCR). Being an undergraduate is nothing to sneeze at: from the looks of it, she's apparently the only one in the company who has a formal degree in mathematics.
She joined Crown Sterling in March 2021, and according to her LinkedIn, her degree has been put to good use. She has since co-authored the crank paper sum-product conjecture, and she has also
*Built a high-precision calculatorMathew, Naomi (March 2024). "POLYMATH Calculator Integrates Arithmetic, Geometry, Music & Cosmology: The Quadrivium". Via Youtube. with several features, such as graphing/geometry, right triangle calculator, and access to several math/physics constants,
*Built other applications to help support current math research on a wide variety of topics such as geometry and prime numbers, and
*Documented proprietary research to present to patent attorneys.
=== Conclusion ===
None of the people who work, or who have worked for the company have a degree that involves cryptography. Given the company's abysmal reputation, and lack of evidence that any cryptographer has ever worked for them, or with them, it's clear the company and its staff are just winging it while flying low — near the cryptocurrency industry, that has way too little oversight and way too many cranks for anyone to pay attention.
== Editorial note to the scam victims ==
Just because you pay for the product, doesn't mean you're not the product. E.g., you pay for Spotify, yet it spies on you.Beres, Derek (Feb. 20, 2019). "How Spotify manipulates your emotions and sells your data". Archived from bigthink.com on Feb 2. 2024.
In contrast, the entire open source initiativeOpen source initiative. "Open source initiative". Via opensource.org and movement (free as in freedom), and their creations such as the or most of what's listed on e.g. privacyguides.org, is living proof that privacy respecting non-snake-oil applications don't always cost money. The fact Grant isn't a proponent of open-source systems and transparent security is also quite telling: he doesn't want his marks to know about things that would force him to walk the talk.
In fact, the sheer number of lies told by the company and its CEO, are aching to the concept of telling a It is hard to believe someone would have the impudence to distort the truth to this extent.
If you choose to stay in this roach motel because you're craving for the community and validation for your numerologist/New-Age views in the personality cult that is REG, sure, be our guest. If you're just cashing in with the line-go-up-distributed Ponzi scheme that is (W)CSOV, feel free to stay and gamble. It's your money.
But if you somehow wandered into the group looking for data sovereignty, or how non-grifters call it, privacy tech, such as secure communication, run. See securemessagingapps.com for real alternatives to Orion, join Reddit's /r/privacy community or PrivacyGuides forum for proper peer support. 
The movement against has been actively fought by people since the initiated it 32 years ago. The real privacy community isn't filled with people with business degrees pretending they're da Vinci, Indiana Jones, and a professional cryptographer at the same time. It has people with Ph. D.s in computer science and mathematics, with a focus on cryptography, working hard in businesses and during their free time to make the world a less dangerous place, every day.
==In summary==
==External links==
*Crown Sterling
==Notes==
==Equations==
The links to equations here allow for easy verification of the results obtained via the presented formulae.
==Illustrations==
 
The links to illustrations here refute the proof-by-picture crank algorithms and equations presented by Grant. The use of external image hosting avoids clutter in the main article.
==Programs==
The links to programs here allow for easy inspection of the algorithm implementations used to generate the results and provide a one-button method to independently run them for verifying the presented results.
==References==
Category:Cryptocurrency
Category:Computing woo
Category:Pseudomathematics
Category:Quantum woo
Category:Scams