AI cracks a 25-year NSA curve mystery: what it means for bitcoin

An Anthropic AI model has worked out where the National Security Agency's unexplained "seeds" for the NIST elliptic curves came from — a puzzle cryptographers had been chasing for about 25 years. According to Anthropic's write-up published on 16 October, the numbers behind the P-192, P-224, P-256, P-384 and P-521 curves were not hashes of a secret phrase at all, but the output of an ordinary 1990s random-number generator started from a computer's clock.

What was the mystery?

• In 2000 the U.S. National Institute of Standards and Technology adopted a set of elliptic curves in its FIPS 186-2 signature standard (ECDSA). P-256 in particular sits underneath a large share of today's encrypted web traffic and digital signatures.
• Each curve was derived from a published 20-byte seed, which was hashed to set one of the curve's parameters. The NSA supplied those seeds in 1997 without explaining how they were chosen.
• After the Snowden disclosures and the Dual EC random-number-generator affair, some cryptographers suspected the agency could have tried many seeds until it found a curve with a weakness only it knew about.
• The best-known explanation, from NSA mathematician Jerry Solinas, was that the seeds were hashes of a humorous phrase. Solinas died in 2023, and in the same year cryptography engineer Filippo Valsorda and others put up a bounty for the answer.

What Claude found

• An Anthropic employee asked an internal research model to investigate without passing on the passphrase rumour. Anthropic says the model had the answer in under half an hour.
• Claude noticed that in four of ten seeds the top bit of every 32-bit word was zero — something Anthropic puts at a 1-in-5,810 chance — which is a fingerprint of lrand48, a random-number function from old C libraries.
• After recovering the generator's internal state and running it backwards, every prime-curve seed traced to a Unix timestamp between May 1997 and April 1998. P-256's seed is the 1,842nd 20-byte candidate from a run started at 01:52:34 UTC on 16 August 1997.
• Valsorda says he re-implemented the method independently and confirmed it. The team donated the prize to the Internet Security Research Group, the nonprofit behind Let's Encrypt, which tripled it to $36,864.

Is anything broken?

No. Anthropic calls this "not a cryptographic break, new attack, or weakness" and says there is nothing users need to do differently. A seed produced by a clock-started generator that anyone can now rerun leaves far less room for deliberate tampering. Some questions remain open: a few usable candidates were skipped (P-256's run also produced a valid curve at candidate 876), the seed of one binary curve, B-163, is still unexplained, and so is the choice of base points for P-224, P-256, P-384 and P-521.

Why bitcoin was never on the list

Bitcoin — and later Ethereum — use a different curve, secp256k1, defined by two small fixed constants, which leaves almost nothing to tweak and little room to hide a weakness, as CoinDesk points out. The same predictable generator would be a disaster inside a wallet, though: a private key made with lrand48 could be rebuilt by anyone who guessed roughly when it was created. That is why wallets rely on cryptographically secure randomness — see our explainer on what a hardware wallet does.

Bitcoin's real long-term threat is quantum computing, which could derive a private key from an exposed public key whatever curve is used. Google this week reported a big error-reduction step on its Willow chip (our report), and a new Quantum Alliance is tracking coins with exposed keys. Still, no existing machine comes close to breaking a bitcoin key.