Anthropic team solves NIST curve seed mystery, claims bounty

Overview

Updated 2 hours ago

After 26 years, the mystery of how the NIST elliptic curve parameters were chosen is solved. The seeds were not hashes of secret phrases, as colleagues believed the late NSA mathematician Jerry Solinas had used; they came from a standard Unix random number generator seeded with timestamps from 1997-98.

A ten-person Anthropic team claimed the bounty Filippo Valsorda posted in 2023, donating the prize and tripling it to $36,864 for ISRG, the nonprofit that runs Let's Encrypt. The finding erases the strongest surviving backdoor theory against the curves that protect most of the internet's encrypted traffic.

Why it matters

The last credible backdoor theory against the NIST curves, which protect most internet encryption, is now ruled out by arithmetic, just before they yield to post-quantum signatures.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

$36,864

Bounty claimed and donated to ISRG

The $12,288 prize was tripled by the Anthropic team before donation.

NIST prime-field curve seeds recovered

P-192 through P-521 seeds traced to drand48 output seeded by Unix timestamps.

~30

Bits of freedom available to seed selection

Too small to target a hypothetical class of weak curves, ruling out the Bernstein-Lange technique.

1842

Candidate seeds tried before P-256 emerged

Each 20-byte candidate was tested against ANSI X9.62 requirements until a valid curve appeared.

Residual unexplained seed

The binary curve seed B-163 fits nothing the researchers have tried so far.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

People Involved

Filippo Valsorda

Independent cryptographer who posted the seeds bounty in 2023

Verified the Anthropic team's solution and announced the claim

Jerry Solinas

NSA mathematician who generated the NIST curve seeds (1997-98)

Deceased; died early 2023 without disclosing the method

Organizations Involved

National Institute of Standards and Technology

US federal agency

Publisher of FIPS 186-2, which standardized the curves

The US agency that standardized the five P-curves in FIPS 186-2 in 2000.

Anthropic

AI research company

Ten-person team solved the seed mystery using Claude

AI lab whose research team traced the seed generation method in under half an hour.

Internet Security Research Group

Nonprofit

Recipient of the bounty donation

Nonprofit that operates Let's Encrypt, the free certificate authority used by hundreds of millions of websites.

National Security Agency

US signals intelligence agency

Employer of Jerry Solinas; central to backdoor speculation

The US agency where Solinas generated the NIST curve seeds.

Timeline

1997 October 2026

8 events Latest: Yesterday

Tap a bar to jump to that date

October 2026
Discovery announced publicly
Latest Announcement

Valsorda publishes full details on his blog, confirming the drand48 method with a Go reimplementation. The five prime seeds are traced; B-163 and the P-curve base points remain unknown.
Yesterday
Anthropic team claims the bounty
Discovery

Ten Anthropic researchers use Claude to trace the seeds to drand48 and claim the bounty, tripling the donation to $36,864 for ISRG.
2 days ago
2023
Jerry Solinas dies
Obituary

The only person known to have known the seeds' origin dies without disclosing it.
2023
Valsorda posts the seeds bounty
Announcement

Cryptographer Filippo Valsorda offers a $12,288 bounty for anyone who can determine how the NIST seeds were generated.
2023
2017
Bernstein and Lange outline a 70-bit freedom technique
Analysis

They describe how seed-selection freedom could have targeted a hypothetical class of 2^61 weak curves, keeping the backdoor question alive.
2017
2015
Paper argues NSA backdoor is implausible
Analysis

Koblitz and Menezes publish 'A riddle wrapped in an enigma,' arguing the NSA could not have selected a weak seed that escaped 15 years of cryptanalysis.
2015
2000
NIST publishes the P-curves in FIPS 186-2
Publication

The five prime-field curves P-192 through P-521 become a federal standard. The seeds and their generation method are not disclosed.
2000
1997
Solinas generates the NIST curve seeds
Origin

NSA mathematician Jerry Solinas generates seeds using the drand48 random number generator seeded with Unix timestamps, between May 1997 and April 1998.
1997

Scenarios

B-163 seed and P-curve base points recovered

Possible Resolves by End of 2028

Discussed by: Filippo Valsorda, Anthropic research team

Two loose ends remain: the binary curve seed B-163, which fits nothing Claude tried, and the undocumented base points for P-224, P-256, P-384, and P-521. A follow-up effort could post a new bounty for these. The base points likely came from a similar script; the B-163 seed may trace to an older system or a different initializer.

Community accepts the finding; no challenge emerges

Likely Resolves by End of 2027

Discussed by: Cryptographic research community

No peer-reviewed paper disputes the timestamp derivation. Valsorda's verification in Go stands, and the NIST curves are treated as unbackdoored as the community shifts attention to post-quantum signatures. This matches the pattern of the 2015 Koblitz-Menezes analysis, which also concluded backdoors were implausible.

Skipped candidates spark a fresh audit

Unlikely Resolves by End of 2028

Discussed by: Cryptographic research community

The discovery found at least 16 viable prime-order candidates that were skipped before the published seeds. If a researcher finds a deliberate pattern in the skipping, questions could reopen. The likely explanation is an artifact of the generation script, but the Anthropic team said the reason for the skips is unknown.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

2006-2014

Dual_EC_DRBG (2006-2014)

NIST standardized a random number generator, Dual_EC_DRBG, in 2006 whose parameters were widely suspected to hide an NSA backdoor. The 2013 Snowden leaks suggested NSA influence, and the algorithm's output was potentially predictable to anyone knowing a secret relationship between the constants.

Then

NIST recommended against using Dual_EC_DRBG in September 2013 and withdrew it from the SP 800-90A standard in 2014.

Now

The episode deeply damaged trust in NIST cryptographic standards and fed suspicion of other parameter sets, including the elliptic curves.

Why this matters now

The same suspicion that sank Dual_EC_DRBG attached to the P-curves' undisclosed seeds. This resolution removes the equivalent doubt for the curves.

June 2013

Snowden leaks reveal NSA cryptography programs (2013)

Edward Snowden leaked documents describing the NSA's Bullrun program, a $250 million annual effort to weaken encryption standards, influence standards bodies, and insert backdoors into products.

Then

Widespread distrust of US cryptographic standards followed, and several companies accelerated encryption improvements.

Now

The leaks cemented a public narrative that the NSA could not be trusted with parameter selection, keeping the NIST seed question alive for over a decade.

Why this matters now

The leaks are the root cause of the conspiracy theories the bounty was designed to end. The timestamp finding directly contradicts the strongest version of those theories.

1993

Blowfish 'nothing up my sleeve' numbers (1993)

Bruce Schneier generated the S-boxes for the Blowfish cipher using the digits of pi, a transparent method anyone could verify. This established the 'nothing up my sleeve' tradition of choosing cryptographic constants from publicly known values.

Then

Blowfish was adopted widely, with no credible backdoor concern about its constants.

Now

The tradition became the norm for cipher design, making opaque parameter generation like the NIST seeds the exception and a red flag.

Why this matters now

The NIST curves were generated behind closed doors, the opposite of the Blowfish approach. The discovery shows the seeds were simple timestamps all along, not concealed weaknesses.