NIST elliptic curves: Claude traces the origins of the ECDSA ‘seeds’ and dispels suspicions of an NSA backdoor

The values provided by the NSA in the late 1990s, without any explanation, were generated by a simple pseudo-random number generator from the C library, initialised using the machine’s clock.

For more than twenty years, cryptographers have wondered about the "seeds" (seeds) that define the elliptic curves standardized by NIST in 2000 (FIPS standard 186-2), including the widely used P-256. The NSA had provided them without any justification, which fueled the hypothesis of curves chosen to conceal a hidden weakness. A bonus of $36,864 was even offered to those who would return to their origin. The most common track, that of a humorous phrase chopped by Jerry Solinas, an NSA engineer who died in 2023, had given nothing.

A generator from the 1990s and a Unix time stamp

Solicity by an Anthropic employee with no starting index, an internal research model found the answer in less than half an hour: seeds of P-192, P-224, P-256, P-384 and P-521 come from no hash function, but from the pseudo-random generator lrand48 Library C, initialized with a Unix time stamp. Claude identified a statistical signature (bits of heavily zero weights), then reconstructed the internal state of the generator by network reduction (LLL algorithm). The dates found are from May 1997 to April 1998; for P-256, the published seed is the 1,842th successful candidate. By the way, the model also explained the base points of six curves from the generator of the FreeLIP library in Arjen Lenstra.

For Anthropic, it is neither an attack nor a weakness: such a banal and reproducible procedure makes a manipulation much less plausible. Some areas of shadow remain: the B-163 binary curve seed remains unexplained, as well as the P-224 to P-521 baselines, and some viable candidates were rejected according to unknown criteria. The bonus will be donated to the Internet Security Research Group.