Anthropic says Claude solved a 25-year-old cryptography mystery in under half an hour
IA en un minuto newsroom · Editor: Jon Elgezabal
In 30 seconds
Anthropic says an internal Claude model worked out, in under half an hour, how the seeds for five NIST curves, which the NSA had handed over without justifying them, were created. The seeds came from lrand48, a 1990s C generator started with the computer's clock, with dates between May 1997 and April 1998. The company stresses that ECDSA is not broken and that the Internet Security Research Group will receive the bounty.
Anthropic has said that Claude worked out how the "seeds" of the elliptic curves in the ECDSA standard were generated, a question the cryptography community had left open for decades.
ECDSA, the most widely used digital signature standard based on elliptic curves, was adopted in 2000 by NIST, the US standards body, as part of the FIPS 186-2 standard. Each curve comes with a number, the seed, from which one of its coefficients is derived, and the NSA supplied it without saying where it came from. For years that fed suspicion that the curves might hide a backdoor, and there was even a bounty, set up by cryptographer Filippo Valsorda, for whoever found the origin.
The lead going around came from Jerry Solinas, of the NSA: as he told it in 2015, the seeds came from the hash of a joke phrase, something like "Give Bob and Jerry a raise", although he did not remember the details. Solinas died in 2023, and several Anthropic employees had followed that lead with no success.
This month, an Anthropic employee asked an internal research model whether it could figure it out, without giving it the lead. In under half an hour, Claude found the origin of the seeds of five NIST curves: P-521, P-384, P-256, P-224 and P-192. They did not come from any phrase or any hash, but from lrand48, a random number generator in 1990s C libraries that was started with the time on the computer's clock. According to Anthropic, Claude spotted a fingerprint of that generator (in four of the seeds, the highest bit of every 32-bit block was always zero) and from there rebuilt its internal state. The recovered dates for the curves over prime numbers run from May 1997 to April 1998.
Anthropic insists that this is neither a flaw in nor an attack on ECDSA, and that nobody needs to do anything differently. On the contrary, it says it makes it far less credible that the curves were picked with a backdoor, because anyone can now regenerate the seeds, and it is publishing the code to do so. Claude also explained where the base points (the fixed point that public keys start from) of six curves come from, P-192 and five example curves from the ANSI X9.62 standard: they were computed with the random generator in FreeLIP, Arjen Lenstra's arithmetic library.
Some questions remain open: the seed of the B-163 curve; the base points of P-521, P-384, P-256 and P-224, and those of the NIST binary curves; and why some valid candidates were skipped. For P-256, for instance, the published seed is candidate 1842, although candidate 876 would also have worked. Anthropic considers it unlikely, given how few there are, that weakened curves were chosen.
The $36,864 bounty will be donated to the Internet Security Research Group.
Why it matters · analysis and opinion
For years, distrust of these curves rested on a gap: nobody could show where their parameters came from. A model closing that question with a method anyone can repeat moves the debate from suspicion to verification, and that matters more than the speed record. It also says something about the role of these models in research: it did not follow the wrong lead that had already wasted other people's time, but asked itself how the software of the period must have worked and checked it with computation. For anyone using digital signatures in their business there is nothing to change, as Anthropic itself stresses. What it does leave is a practical lesson: parameters that nobody can explain end up breeding distrust, even when they are innocent.
Official source: Anthropic · Written with the help of AI: how we make the news
