Claude cracks the origin of the ECDSA curves: it was just timestamps

For twenty-five years cryptographers wondered where the parameters of NIST's standard elliptic curves came from. ECDSA is the most widely used elliptic-curve standard; NIST adopted it in 2000 as part of FIPS 186-2. Each curve shipped with a "seed" whose hash defines the curve's coefficient. The seeds were handed over by the NSA with no explanation — which bred suspicion: were the parameters chosen to hide a backdoor?

A charming legend held that NSA veteran Jerry Solinas had produced the seeds by hashing a jokey passphrase, something like "Give Bob and Jerry a raise." In 2015 Solinas himself admitted he couldn't recall the details, and any surviving archives were "no doubt sitting on a hard drive near the Ark of the Covenant." Solinas died in 2023, and the riddle endured.

An answer in half an hour

In October 2026 a curious Anthropic employee asked an internal research model to work out the seeds' origins — without feeding it the passphrase theory. In under thirty minutes Claude found the origins of the P-192, P-224, P-256, P-384 and P-521 seeds. There was no hash at all: the seeds were the output of the C library's lrand48 generator, initialized with a Unix timestamp.

The weakness of those 1990s generators was what gave it away. Claude noticed that the top bits of some seeds were all zero — a telltale signature of lrand48, which returns only 31 of its 48 state bits. Recovering the state of a truncated linear congruential generator is a textbook lattice problem, solved with the LLL basis-reduction algorithm. Running the generator backwards, Claude found that every initialization mapped to a date between May 1997 and April 1998.

Not a break

The authors stress this is no vulnerability or attack. If anything it bolsters trust in the curves. Because the seeds came from a simple, publicly reproducible generator fed by the clock, there is little room left for covert subversion.

Along the way Claude also explained the provenance of several base points — for six curves they trace back to the generator in Arjen Lenstra's FreeLIP package. Open questions remain: the base points of P-224, P-256, P-384 and P-521 are still unexplained, and one binary seed, B-163, resisted every method tried.

The $36,864 bounty for the seeds will be donated to the Internet Security Research Group. The authors paid posthumous tribute to Jerry Solinas, who wore the labels "evil Internet meme" and NSA bogeyman with good humor.

Source: Hacker News