The NIST P-curves, from P-192 to P-521, are widely used to secure web connections and digital signatures. Their parameters were derived from “seed” values whose origin was never explained, a gap that has fuelled years of suspicion that the curves might hide a backdoor. Anthropic’s Frontier Red Team says one of its internal research models has now worked out where those seeds came from.
According to Anthropic, the seeds came from lrand48, a standard C library random number generator, seeded with a Unix timestamp; candidates were drawn until one produced a suitable curve. The timestamps fall between May 1997 and April 1998, and the P-256 seed was candidate 1,842. Anthropic says Claude got there in under half an hour by spotting a pattern in the bits, recovering the generator’s state and running it backwards.
Why it matters: Anthropic stresses this is not a break, a new attack or a weakness in the curves, and says the finding makes it more confident they were not backdoored. Some pieces remain unexplained, including several base points. The reproduction code is public, and the $36,864 bounty for the find will be donated to the Internet Security Research Group.
Read Anthropic’s write-up: Claude reveals ECDSA curve origins