By Lu Yu, from Aofeisi Temple
Quantum Bit | Official Account QbitAI
Early in the morning, and the AI world is blowing up again...
Nothing more to it—this wave of AI problem-solving has flipped back twenty-plus years into cryptography's old ledger.
A battle royale for everyone — this time it's the turn ofClaude——
Just now, according to Anthropic's disclosure, Claude usedIn less than half an hour, uncovering how the seeds of the five NIST standard elliptic curves were generated.
This string of digits, used by the industry for more than twenty years and once written into cryptographic standards, had always had an unexplained origin — until now, no one could say how it was originally chosen.
People even tracked down the people involved, and the clues pointed to a"give Bob and Jerry a raise"passphrase hashing operation.
Then came a dramatic twist: Claude said — completely wrong!
The real answer came fromTime, a computer clock from the 90s.
And this cold case has now been independently verified by the person who posted the bounty.
Cracking a Cryptographic Cold Case in Half an Hour
The story starts with a technology used to "verify identity."
ECDSA, short for the Elliptic Curve Digital Signature Algorithm.
It lets the recipient check whether a piece of data was actually signed by the claimed signer, and whether it was modified after signing. In 2000, it was adopted by the U.S. National Institute of Standards and Technology (NIST) into the FIPS 186-2 Digital Signature Standard.
Before using this algorithm, a set of public mathematical parameters must first be chosen, including the curves P-192, P-224, P-256, P-384, and P-521.
The controversy lies in theirseeds.
A seed can be understood as the starting material for generating the curve parameters: given the seed, you can follow the steps specified in the standard to check whether the subsequent parameters match.
ButWhy this seed of all things?—nobody had any idea at all.
Even Jerry Solinas, who had provided the seeds back then, had only a hazy memory, recalling roughly that they had converted a joking passphrase, possibly about a raise, into numbers and added a counter.
So for more than twenty years, everyone had been guessing in that direction, and cryptography engineer Filippo Valsorda even published abounty, openly inviting everyone to search for the predecessors of these five sets of seeds.
All attempts came to nothing, untilClaudestepped in.
According to Anthropic's description, when an employee handed the problem to an internal research model, they did not disclose the clue about the raise passphrase.
Claude then speculated on its own that these numbers might come from a pseudorandom number generator in a90s C language library.
Because the numbers produced by such programs look chaotic yet follow fixed rules underneath, once the pattern is recognized, there is a chance to work backward to the generation process.
Claude then wrote ascanning program, sliding bit by bit through the binary digits of the public seeds and testing 34 combinations of generators and output-extraction methods.
It found that when four sets of seeds were each split into five 32-bit integers, the highest bits of these 20 integerswere all 0。
Case solved: the suspect should be thelrand48 random number generator。
. The lrand48 function keeps a 48-bit integer internally; each time it is called, it multiplies this integer by a fixed constant, adds another constant, keeps only the low 48 bits of the result, and uses them as the next state.
But the output only contains the high 31 bits of it; if placed into 32 bits, the remaining bits can only be padded with 0.
After locating the machine, Claude then used theLLL lattice reduction algorithmto restore the truncated state of the seed.
The only remaining question is: how was it initialized in the first place?
The function responsible for initialization is called srand48; it places the input value into the high 32 bits of the 48-bit state, fixes the low 16 bits at 0x330E, and then works backward along the recurrence relation, pointing toUnix timestamps。
These initialization inputs were concentrated inFrom 5/1997 to 4/1998。
That is to say,turning a moment in time into an integer, handing it to the generator, and then extracting numbers in a fixed way, reproduces the seeds in the standard.
Taking P-256 as an example, the corresponding initialization moment is: August 16, 1997, 01:52:34 UTC.
Running the generator from this time and taking the 1842th candidate yields exactly that seed starting with C49D. The other four also match one by one.
Of course, Company A also stated that this result has not yet filled in all the historical gaps.
The researchers found that the original program skipped some candidate curves that also appeared to meet the criteria, for reasons that remain unclear; the seed of B-163, as well as the generation method of the base points of some curves, also remain unexplained.
However, the new result also means that these curves contain no potential security vulnerabilities and can be used with confidence.
Reference links:
[1]
https://www.anthropic.com/research/ecdsa-curve-origins
[2]
https://x.com/sweis/status/2111165738836717980
[3]
https://words.filippo.io/seeds-bounty/