Claude cracks the 25-year riddle of NIST’s curve seeds

The US standards body NIST published five of them in 2000. Nobody could say where the starting numbers behind them, called seeds, came from. The NSA had supplied them, and that gap fed a long suspicion that the agency had chosen them to hide a weakness.

The answer is mundane. The seeds came from lrand48, an ordinary random-number generator that ships with the C programming language. Each run was started from the computer clock (a Unix timestamp) at a moment between May 1997 and April 1998. That retires a long-told story, recalled by a veteran NSA employee, that the seeds were a scrambled version of a joke phrase.

The finding has an outside check. Filippo Valsorda, a cryptographer who ran a public bounty for the answer, rebuilt the method himself. The Anthropic researchers collected the reward on 15 October and gave it to ISRG, the charity that runs Let’s Encrypt, which made it three times larger, at $36,864. Valsorda writes that the result rules out a known theoretical way to rig the seeds.

The signatures and secure connections built on these curves now rest on seeds anyone can trace to a clock.