Anthropic reconstructs the origins of NIST curve seeds
Anthropic says an unnamed internal research model recovered five NIST prime curve seed origins in under half an hour. Its October 16 report identifies timestamp initialized lrand48 output from 1997 and 1998 and explicitly reports no cryptographic break or new weakness. Read the research report.
What a curve seed actually tells you
A curve seed belongs to the public recipe for constructing mathematical parameters. It is different from a private signing key. Publishing or recovering that recipe does not hand someone a user’s secret. Filippo Valsorda made this distinction explicit when announcing his October 2023 seed bounty.
The historical puzzle concerned the input to an already documented process. Certain curve parameters could be derived from published seeds using a hash based procedure, but that still left a question about why those particular seeds had been selected. Reproducing a derivation and explaining its starting point are separate tasks.
Why researchers were searching for a phrase
Stephen Weis’s September 2023 investigation collected accounts suggesting that the seeds had come from humorous English messages. An August 2024 update added historical correspondence supporting that recollection. Those accounts gave researchers a lead, but they did not supply a working reconstruction.
Valsorda’s bounty reflected the same hypothesis. It offered $12,288 in cash or $36,864 to charity for recovering the five seeds, with the expectation that someone might identify a forgotten phrase and hashing procedure. The distinction matters when reading older coverage. A plausible memory of how code worked is not the same evidence as a procedure that reproduces its output.
What the new reconstruction covers
Anthropic reports reproducing ten prime curve seeds and four binary curve seeds. Its examples include the 256 bit prime curve seed as candidate 1842 from a generator initialized on August 16, 1997.
The published 256 bit prime curve parameters in RFC 4753 provide an independent reference for the resulting seed. That makes the output a concrete comparison target rather than a claim that depends entirely on a model’s explanation. Matching a published value can establish a reproducible relationship. It cannot, by itself, establish every historical decision that surrounded that value.
The unresolved parts matter
The report leaves the 163 bit binary curve seed unexplained, along with several base points and the reasons for skipping some viable candidates. It does not establish how many historical generator runs occurred. Anthropic says the charity bounty will go to the Internet Security Research Group.
How this fits into current standards
NIST’s February 2023 standards announcement separates its Digital Signature Standard from its companion recommendations for elliptic curve parameters. It includes ECDSA alongside RSA and EdDSA. The same announcement says binary field curves are deprecated and recommends prime curves instead. Historical reconstruction does not reverse that guidance.
For readers following AI and security research, the useful comparison is methodological. Our earlier coverage of cryptanalysis research concerned attacks under specified experimental conditions.
Illustrative security photograph by cottonbro studio on Pexels, used under the Pexels license.
