Anthropic’s Claude finds five NIST curve seeds came from timestamps, not hashes

ECDSA, the most widely used elliptic-curve signature standard, was adopted by NIST in 2000 in FIPS 186-2. Its curves are partly defined by seed values that the NSA supplied without explanation, which fed years of suspicion that they could hide backdoors, and a bounty for whoever found the seeds’ origin.

An Anthropic employee asked an internal research model how the seeds were made, without pointing it to the rumoured clue that they were hashes of a humorous phrase. In under half an hour, Claude showed that the P-192, P-224, P-256, P-384 and P-521 seeds came from lrand48, the C library’s random number generator, seeded with Unix timestamps, readings of the computer clock, from May 1997 to April 1998.

Claude spotted a pattern in the seeds’ top bits, recovered the generator’s hidden state and checked that each recovered state regenerates all 160 bits of its seed, which does not happen by chance. It also explained the base points, the fixed point every public key on a curve is derived from, of P-192 and five ANSI X9.62 example curves.

Anthropic says this is not a break of, attack on or weakness in ECDSA, and that a simple, reproducible method makes deliberately weakened curves much less plausible. The $36,864 bounty will go to the Internet Security Research Group.

The seed of the binary curve B-163 and the base points of P-224, P-256, P-384 and P-521 remain unexplained, and Anthropic doesn’t know why some runs passed over workable curves.