IT之家 News on October 17: Anthropic announced in a blog post yesterday (October 16) that its internal research using the Claude model took less than 30 minutes totrace the origins of the “seeds” of five National Institute of Standards and Technology (NIST) standard elliptic curves, providing a reproducible answer to a cryptographic mystery that has lasted about 26 years.
Note from IT之家: the seed here can be understood as “a piece of starting data used when generating elliptic curve parameters”; the generation rules are like a machine running a fixed program, and the seed is the raw material fed into the machine. The same material, processed by the same rules, yields the same result. Once the seed is made public, others can recompute it and check whether the curve parameters were indeed generated according to the published steps.
The puzzle stems from a set of elliptic curves incorporated into the U.S. Digital Signature Standard in 2000. The related seeds were provided by the National Security Agency (NSA), but without explanation of the generation process, long fueling speculation about whether backdoors were hidden. These curves are used in the Elliptic Curve Digital Signature Algorithm (ECDSA), helping verify the authenticity of digital information.
According to Anthropic, Claude instead investigated common software tools of the 90s and found that the seeds actually came from the pseudo-random number generator lrand48 in the C library, with Unix timestamps as the initialization input.
By identifying bit patterns, recovering the generator state, and working backward, the model traced the relevant generation time to 1997 to 1998. Among them, the standard seed of P-256 corresponds to the 1,842th candidate value in a run. The team has published the reproduction code.
The results show that the seeds of P-192, P-224, P-256, P-384 and P-521 can all be generated with initialization from Unix timestamps of 1997 to 1998. Among them, P-256 corresponds to August 16, 1997, producing the seed in the standard after 1,842 rounds of candidate generation.
Anthropic emphasized that this is not a break of ECDSA and no new attack method was found; the result reduces concerns that the parameters had deliberately planted backdoors, and users need not take any action as a result. However, the research has not yet explained all the details, including the origin of the B-163 seed, how the base points of some curves were generated, and why certain available candidate curves were skipped.
