Anthropic says Claude traced the seeds of NIST curves

For anyone who uses encrypted connections or cryptocurrencies, nothing changes today: Anthropic says its finding opens no new weakness in the elliptic curves. They are the curves that NIST, the U.S. standards agency (the National Institute of Standards and Technology), set as a standard in the late nineties. What matters is where their "seeds" came from, and the company published its answer on Oct. 16 in a report from its security team.

Digital signatures such as ECDSA rest on these curves. A seed is the starting value NIST published with each curve without explaining its origin; for years it was assumed to come from a hash function. Anthropic says it did not: for the prime curves P-192, P-224, P-256, P-384 and P-521, it matches what lrand48 produces, a C standard-library function that generates pseudorandom numbers, started from a Unix-format date between May 1997 and April 1998.

The company says Claude reached the prime-curve seeds in "under half an hour," after a question from an employee, and that it collected the $36 864 bounty the cryptographer Filippo Valsorda offered in 2023. The money was donated to the Internet Security Research Group. The report is clear about what it did not find:

"This is not a cryptographic break, new attack, or weakness in the ECDSA curves."

For decades there were suspicions that NIST picked the seeds to hide a weakness the NSA knew about. The cryptographers Neal Koblitz and Alfred Menezes took up the question in 2015 in "A Riddle Wrapped in an Enigma," a paper the report cites. Anthropic concludes that its finding makes it more plausible that there are no backdoors. It admits one limit: nothing in the numbers shows how many runs there were, that is, how many candidates NIST tried before settling on one.

This is a claim by Anthropic about its own work. This newsroom did not run the reproduction code the company published, and found no reaction from Valsorda or NIST, nor a review by cryptographers outside the company.