An internal Anthropic research model traced the seeds behind five NIST elliptic curves to a simple random-number generator in the C library, started with Unix timestamps from 1997 and 1998, Anthropic said. The NSA supplied the seeds without explanation, and their origin had been the subject of long-running speculation about possible backdoors.

The curves, P-192, P-224, P-256, P-384 and P-521, were standardized in 2000 in FIPS 186-2, the Digital Signature Standard that defines ECDSA. Each comes with a published seed whose hash defines one of the curve’s coefficients. The NSA provided the seeds “with no explanation or justification,” Anthropic wrote.

“This is not a cryptographic break, new attack, or weakness in the ECDSA curves,” the company said. It added that the finding makes it “more confident the curves were chosen without any backdoors or intentional weaknesses.”

Several Anthropic employees had searched unsuccessfully for a hashed phrase, following a 2015 recollection by longtime NSA employee Jerry Solinas that the seeds came from a humorous message such as “Give Bob and Jerry a raise.” Solinas died in 2023. In October, an employee asked an internal research model, which Anthropic did not name, to work out how the seeds were generated without pointing it to that clue. Claude identified their origin in under half an hour, according to Anthropic.

Claude wrote a scanner that tested whether chunks of each seed matched the output of generators shipped with 1990s C libraries, then identified lrand48. It recovered the generator’s internal state using lattice reduction and stepped it back to its starting value. For the five NIST seeds and the seeds of five example curves in the ANSI X9.62 standard, that starting value was a Unix timestamp between May 1997 and April 1998. The P-256 seed was the 1,842nd 20-byte candidate from a generator seeded with a timestamp from August 16, 1997.

Anthropic said the model also explained four of the five seeds for NIST’s binary-field curves, along with the base points of P-192 and the five ANSI curves, which came from the random-number generator in Arjen Lenstra’s FreeLIP arithmetic library. The B-163 seed and the base points of P-224, P-256, P-384 and P-521 remain unexplained.

The Anthropic team claimed a bounty that cryptographer Filippo Valsorda announced in 2023 for recovering the five prime-curve seeds. Valsorda wrote that the claim arrived at 01:07:51 UTC on October 15 and that he reimplemented the algorithm in Go to verify it. The team donated the prize to the Internet Security Research Group, the nonprofit that operates Let’s Encrypt, which tripled it to $36,864 under the bounty’s terms.

Valsorda wrote that the findings “completely rule out” a technique Daniel Bernstein and Tanja Lange had described that could have exploited about 70 bits of freedom in seed selection. Even if the NSA had been free to pick any timestamp in 1997 or 1998 and any of the first 16 prime-order candidates, he wrote, it would have had “barely 30 bits of freedom.”

Not every candidate produced a usable curve, and some usable ones were skipped: for P-256, candidate 876 of the same run also yields a valid curve. Anthropic said it does not know what criteria were applied, but because few candidates were skipped, it does not believe weakened curves were selected. Valsorda identified two undocumented criteria beyond those in ANSI X9.62, “one fairly clear and one that still escapes us.”

Anthropic published code that reproduces the seeds. “There is no action to be taken or things to do differently,” the company wrote.

Sources: Anthropic, Filippo Valsorda

–
By the Control Plane Editorial Team