AI Model Reconstructs Origin of NIST Curve Seeds, Reducing Security Concerns

An artificial intelligence model developed by Anthropic has successfully reverse-engineered the method used to generate seed values for NIST’s widely adopted prime curves. This discovery significantly reduces concerns that these critical cryptographic parameters might have been intentionally designed with backdoors, according to available disclosures.

The AI, named Claude, determined that the seed values for NIST curves P-192, P-224, P-256, P-384, and P-521 were generated using a weak pseudo-random number generator (PRNG) called lrand48() from the POSIX/C library. This function was seeded with Unix timestamps from 1997 to 1998. The finding was independently verified by cryptographer Filippo Valsorda, who had previously offered a bounty for identifying the seed sources.

This revelation addresses a long-standing question within the cryptography community, particularly in the wake of distrust surrounding NSA-influenced cryptographic standards like DualECDRBG. The limited ‘choice’ available to designers using the lrand48() method, seeded by timestamps, suggests that inserting a specific, exploitable weakness would have been difficult, if not impossible, within the constraints of the process.

According to Anthropic, the AI model was able to perform this complex, multi-stage research task autonomously in less than half an hour. The process reportedly involved hypothesis generation, coding, statistical testing, and the application of mathematical algorithms. This capability demonstrates a significant advancement in AI’s ability to conduct open-ended research and reconstruct historical technical processes.

The security of existing private keys generated using NIST prime curves is not affected by this discovery. Furthermore, the finding does not impact the secp256k1 curve used by Bitcoin, which is distinct from the NIST curves. The discovery does not mean that elliptic curve cryptography has been broken, nor does it alter the long-term threat posed by quantum computers to current cryptographic standards.

While the origin of the seed values has been clarified, some uncertainties remain. The exact reason why certain seemingly valid candidates were skipped during the generation process for some curves is still unknown. Additionally, the method used to select the base points (G) for several NIST curves (P-224, P-256, P-384, and P-521) has not been recovered. The seed source for the B-163 binary field curve also remains unrecovered.

This event signals a potential shift in how cryptographic standards are audited and trusted. The ability of AI to investigate historical code and protocols at a low cost could accelerate the discovery of vulnerabilities in older or less-audited systems. It moves the paradigm from relying on authority for trust in cryptographic parameters towards machine-auditable verification. The discovery changes the narrative from ‘Please trust the NSA didn’t tamper’ to ‘You can reproduce how it was likely generated,’ thereby shortening the shelf life of ‘black boxes’ in cryptography maintained by history, authority, or lack of inquiry.

Why This Matters

The materials describe a narrow update: An Anthropic AI model, Claude, identified the method used to generate the seed values for NIST’s prime curves (P-192, P-224, P-256, P-384, P-521). The exact reason why certain seemingly valid candidates were skipped during the generation process for some curves.

Broader Context

Source materials place the factual news in this context: NSA’s involvement in promoting the DualECDRBG random number generator, which was widely believed to have a backdoor.