Some of the most important numbers in modern security arrived with no explanation. The elliptic curves standardised by NIST in 2000, the P-curves that underpin ECDSA signatures across the web, in software updates and in cryptocurrencies, were each defined partly by a seed value that the NSA supplied without saying how it was chosen. For a quarter of a century that silence fed a serious suspicion: that the curves might have been selected to contain a weakness only their designers knew. New analysis reported this month suggests the truth is almost comically mundane. Our technology coverage explains the finding and why cryptographers are taking it seriously.
A riddle wrapped in an enigma
Cryptographic parameters are supposed to be nothing-up-my-sleeve numbers, generated by a transparent process anyone can check. The NIST seeds failed that test: values such as the P-256 seed were simply published, unexplained, and a standing bounty, worth $36,864, awaited whoever could explain them. The folklore held that NSA cryptographer Jerry Solinas had hashed a humorous passphrase, something like a joke about giving colleagues a raise, to produce the seeds. It was a good story. According to Anthropic’s published research, it was also wrong.
Timestamps, not a trapdoor
Anthropic says one of its Claude models, asked how the seeds were made, noticed that their top bits were consistently zero, a fingerprint of lrand48, an old pseudorandom number generator from the C standard library that only produces 31-bit values. Working backwards with lattice-reduction techniques, the analysis recovered the generator’s internal state and showed the seeds are what you get when lrand48 is initialised with a Unix timestamp, a computer clock reading, from between May 1997 and April 1998. Even the iteration counts are now known: P-256’s seed took 1,842 draws. In other words, the mysterious numbers were not ground out of a secret phrase or searched for hidden weakness; they fell out of a commonplace generator started from the clock, and anyone can now reproduce them with the published code.
Why this makes a backdoor much less plausible
The backdoor scenario that cryptographers feared, formalised by Daniel Bernstein and Tanja Lange, required the designer to try many candidate curves and secretly keep one with a exploitable flaw. A seed that is simply the output of a timestamp-seeded generator, found in order, leaves essentially no room for that search: the process is too simple and too constrained to hide a selection step. That is why the researchers and independent verifiers describe the result as increasing confidence in the curves, not merely solving a puzzle. The bounty organiser re-implemented the algorithm, confirmed the seeds regenerate exactly, and the prize money is being donated to the Internet Security Research Group, the nonprofit behind Let’s Encrypt, a detail reported in coverage such as daily.dev’s summary.
What remains unexplained, and what it means
Not every mystery closed. The seed for the binary curve B-163 and the base points of the larger P-curves are still unaccounted for, and healthy scepticism says the finding, while independently reproduced for the seeds, should keep being probed. But the practical conclusion for engineers is reassuring: this is not a break, not a new attack and not a reason to migrate away from ECDSA. It is a reminder that trust in cryptography should rest on processes that can be replayed and checked, and that twenty-five years of suspicion were ultimately answered not by an authority’s assurance but by arithmetic anyone can run. That may be the healthiest outcome the field could have asked for. More security analysis is at Veganizoo.
There is also a lesson here about how standards should be made now. Modern cryptographic design competitions publish their parameter generation in full, precisely so that no future generation has to spend twenty-five years wondering. The NIST curves were products of a more closed era, and the suspicion they attracted was, in that sense, earned by the process even if the numbers themselves turn out to be innocent.
