Claude traces NIST curve seeds to timestamps
An Anthropic research model found that the NSA-supplied seeds behind NIST's ECDSA curves came from a clock-seeded C random-number generator, which weakens long-running suspicions that the curves were backdoored.
An internal Anthropic research model has worked out where the NSA-supplied seeds for the NIST elliptic curves came from, according to a post from Anthropic's Frontier Red Team. NIST standardized the curves in FIPS 186-2 in 2000. Each seed is hashed to produce a curve's coefficient b, but the seeds were published with no explanation, and people have speculated for decades that they hid a backdoor.
The best-known theory came from the late NSA employee Jerry Solinas. He said the seeds were hashes of a joke phrase, something like "Bob and Jerry rule." Several Anthropic employees followed that lead and got nowhere. This month, an employee asked the model to figure out how the seeds were made, without mentioning the passphrase story.
In under half an hour, the model found that the P-192, P-224, P-256, P-384 and P-521 seeds were not hash outputs at all. They were bytes from the C library's lrand48 generator, seeded with a Unix timestamp. Each 20-byte draw was a candidate seed. The published P-256 seed was the 1,842nd draw.
The first clue was that four of the ten seeds had a zero top bit in every 32-bit word. That happens by chance with probability 1 in 5,810, and it is a signature of lrand48. The model then recovered the generator's state by brute force over 2¹⁷ hidden bits. The prime-curve seeds kept fewer bits of each output, so the model used LLL lattice reduction instead. It found the same lrand48() >> 23 pattern in five NIST seeds and five ANSI X9.62 seeds.
Anthropic says the finding is not an attack or a weakness. A clock-seeded generator that anyone can now reproduce leaves little room for tampering, and no one needs to change anything.