Decades-old cryptography mystery solved: NIST curve "seeds" came from a random-number generator seeded with 1997-98 timestamps, not a secret phrase

A long-running mystery about where the numbers behind some of the internet's most widely used encryption curves came from has been solved, according to the company Anthropic and cryptographer Filippo Valsorda.

The "seeds" used to generate five NIST elliptic curves, including P-256, were produced by a standard C-library random-number generator started from Unix timestamps in 1997 and 1998, the two said in write-ups published Friday, Oct. 16. They were not hashes of a forgotten English sentence, as cryptography lore had long held.

Anthropic says one of its employees asked an internal research version of its Claude AI model whether it could work out how the seeds were made, and the model found the answer "in under half an hour".

Why the seeds mattered

NIST published the curves P-192, P-224, P-256, P-384 and P-521 in its FIPS 186-2 digital signature standard in 2000. Each was derived from a seed value supplied by the National Security Agency with no explanation of where it came from.

That gap fed years of suspicion that the seeds might have been picked to plant a hidden weakness. The best-known story was that Jerry Solinas, a longtime NSA employee who died in 2023, generated them by hashing humorous phrases.

What the researchers found

According to the write-ups, the seeds came from the POSIX drand48 family of random-number generators. The generator was started with the then-current Unix timestamp and produced bytes one at a time; each 20-byte block was tried as a seed and thrown out if it did not yield a valid curve. (Anthropic's post names the lrand48 function; Valsorda's names drand48. Both belong to the same POSIX family.)

For P-256, the published seed was the 1,842nd candidate from a generator started at a timestamp corresponding to Aug. 16, 1997, according to the results Valsorda published. Anthropic's write-up gives the same candidate number. Valsorda said he reimplemented the algorithm in the Go programming language to check the claim.

Is anything broken?

No, according to both write-ups. "This is not a cryptographic break, new attack, or weakness in the ECDSA curves," Anthropic wrote. "In fact, this makes us more confident the curves were chosen without any backdoors or intentional weaknesses". "There is no action to be taken," the company added.

Valsorda noted that even before the discovery there were "no serious concerns among practitioners" about the curves. He wrote that the findings "completely rule out" a seed-manipulation technique described by cryptographers Daniel Bernstein and Tanja Lange.

The bounty

Valsorda had offered a bounty for the answer three years ago. A team of 10 Anthropic researchers, including Nicholas Carlini and Steve Weis, claimed it on Oct. 15 at 01:07:51 UTC (9:07 p.m. ET on Oct. 14), he wrote. The team chose to donate the prize to the Internet Security Research Group, the nonprofit that operates Let's Encrypt, which tripled its value to $36,864, Valsorda wrote.