An internal research model developed by Anthropic has traced the origins of the five seeds supplied by the NSA that generated the NIST elliptic curves P-192, P-224, P-256, P-384, and P-521. The reconstruction was completed in less than 30 minutes and closes a question that had remained open for roughly 25 years.
The curves entered widespread use after the adoption of ECDSA in FIPS 186-2 in 2000. Because the published seeds lacked any documented provenance, the cryptographic community long suspected that the curves might contain deliberately introduced weaknesses. Earlier attempts to recover the seeds focused on the hypothesis that they were hashes of short English phrases, including expressions recalled by NSA mathematician Jerry Solinas, but these searches produced no matches.
The Anthropic model took a different approach. It examined common random-number generators found in 1990s software, built a scanner covering 34 generator-and-output combinations, tested 17 hidden bits on binary curves, and applied LLL lattice reduction to the prime curves. The results point to the lrand48 generator from the old C library, seeded with Unix timestamps between May 1997 and April 1998. The seed for P-256 matches the 1842nd candidate produced by a run that began on 16 August 1997; five example seeds from ANSI X9.62 follow the identical construction.
Anthropic stresses that the research does not constitute a cryptographic break, does not reveal any weakness in ECDSA, and does not enable signature forgery. The company has published the code that reproduces the findings and does not recommend any changes to systems currently in production. The NSA has not yet commented on the result.
Portions of the original puzzle remain unsolved. The seed for curve B-163 is still unexplained, several base points lack documented origins, and researchers could not determine why the apparently valid 876th candidate for P-256 was rejected at the time.
