Claude traces NIST curve seeds to timestamps, Anthropic says

An internal Anthropic research model worked out in under half an hour how the seeds for five widely used NIST elliptic curves were generated, answering a question cryptographers have asked for years, Anthropic said Friday in a research post.

The mystery: NIST adopted the curves in 2000 as part of the FIPS 186-2 Digital Signature Standard. Their seed values were provided by the NSA with no explanation, which led some to wonder whether they hid deliberate weaknesses, according to the post.

What Claude found: The seeds for the P-192, P-224, P-256, P-384 and P-521 curves were not hashes of a phrase, as a long-running rumor held. They came from the C library’s lrand48 random number generator, started from a Unix timestamp, Anthropic said. For the 10 prime-curve seeds it examined, including five from the ANSI X9.62 standard, those timestamps fell between May 1997 and April 1998.

What it means: Anthropic says this is not a cryptographic break, new attack or weakness in the curves. It says the simple, reproducible method makes deliberate backdoors “much less plausible,” and that there is no action for anyone to take.

Still open: Anthropic said it could not explain how the base points for P-224, P-256, P-384 and P-521 were chosen, though Claude traced the base points of six curves generated in May 1997. The post also notes that some viable candidate seeds were skipped.

The bounty: The $36,864 bounty for finding the seeds will be donated to the Internet Security Research Group, Anthropic said. It published code to reproduce the seeds.