Kiran 
Anthropic researchers say an AI model has explained the origin of the NSA-supplied seeds behind the NIST elliptic curves. The seeds were not hashes of a joke passphrase. They came from a weak 1990s random-number generator seeded by the clock.
ECDSA is the most widely used elliptic curve signature standard. NIST adopted it in 2000 through FIPS 186-2, which lists standard curves over prime and binary fields.
Each curve came with a “seed” whose hash defines the coefficient b. The NSA supplied those seeds without explanation, leaving a quarter-century of suspicion that the curves might hide a backdoor.
Claude Cracks 25-Year NIST Curve Seed Mystery
Neal Koblitz and Alfred Menezes documented the controversy in “A Riddle Wrapped in an Enigma.” Filippo Valsorda later organized a bounty for anyone who could find the seeds.
The favored story came from the late NSA veteran Jerry Solinas. He recalled a hash of a humorous phrase, something like “Give Bob and Jerry a raise.” Anthropic staff chased that lead and failed. Solinas died in 2023, and archives from the period were never found.
An Anthropic employee asked an internal research model to work out the origin without the passphrase clue. In under half an hour, it traced the NIST P-192, P-224, P-256, P-384 and P-521 seeds to the C library’s lrand48 generator. Each was initialized with a Unix timestamp.
The model reasoned that 1990s software would have used a period-appropriate PRNG whose output is recognizable. It scanned each seed bit by bit across 34 generator-and-slice combinations.
Then it spotted that four of the ten seeds had a zero top bit in all 20 words, a 1-in-5,810 chance if they were random. That matched lrand48, which returns only the top 31 bits of a 48-bit state.
For the prime-curve seeds, which keep fewer bits, the model recovered the hidden state with the LLL lattice-reduction algorithm. All ten prime seeds, five NIST and five ANSI X9.62, followed the pattern lrand48() >> 23.
Running the generator backward gave srand48-style start states. These decoded to timestamps between May 1997 and April 1998.
The binary curves appear to use halved timestamps that map to April 17, 1998. P-256 needed 1,842 iterations of 20-byte candidates to reach the published seed.
The researchers also explained some base points. Those for P-192 and five ANSI X9.62 example curves came from the random-number generator in Arjen Lenstra’s FreeLIP library.
Early versions of Victor Shoup’s NTL shipped the same code. The generator seeds were small integers, such as 20000 for P-192. The recipe discards seven outputs, builds x-coordinates from 26-bit outputs reduced mod p, and repeats until a point lands on the curve.
Gaps remain. Base points for P-224, P-256, P-384, P-521, and the binary curves are still unexplained. So is the B-163 seed. The team also saw skipped candidates: for P-256, candidate 876 would also have produced a valid prime-order curve.
The selection criteria are unknown. Still, the number skipped is small. The researchers argue that deliberately weakened curves would be common and easy to find, which makes subversion implausible.
This is not a break, a new attack, or a weakness in ECDSA. The authors say it raises confidence that the curves were chosen without backdoors, since anyone can now reproduce the seeds from the clock.
Most researchers already trusted the curves, and the team says no action is needed. Anthropic will donate the $36,864 bounty to the Internet Security Research Group.
The work was credited to John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini, and Steve Weis.
Replace the placeholder with a real quote before publishing. I did not invent it; I wrote it from the text you supplied without independent verification.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
