CoinDesk
An Anthropic research model traced five unexplained seeds used in NIST elliptic curves to lrand48, an ordinary random-number generator fed with timestamps from 1997 and 1998. Claude found the sequence in less than 30 minutes, including an exact match for the published P-256 seed at the 1,842nd candidate.
Why it matters
The seeds were supplied by the National Security Agency in the late 1990s and became the focus of a 25-year cryptographic mystery. Researchers suspected the NSA had tested many alternatives and selected a curve with a weakness only it could exploit, especially after disclosures linked the agency to efforts to weaken cryptographic standards.
The new reconstruction makes that hidden-backdoor theory less likely because anyone can now reproduce the numbers. It does not explain why some usable candidates were skipped or how other curve elements were selected, so parts of the design history remain unresolved. Users of the NIST curves do not need to take action based on the finding.
Market impact
Bitcoin was not part of the mystery. Bitcoin uses secp256k1, a simpler curve with two small fixed parameters and little room to conceal a weakness. Ethereum also adopted secp256k1. The public NIST seeds were never secret, so the predictable generation process did not expose existing wallet keys.
Bitcoin still faces a separate long-term risk from sufficiently powerful quantum computers. A machine capable of working backward from a public key could recover the private key behind it, regardless of how the curve was chosen. Google’s Willow chip has reduced errors in a key quantum-computing step, but no machine is yet close to reliably cracking a Bitcoin key and there is no clear timeline for such an attack.
A $36,864 bounty tied to the investigation will go to the Internet Security Research Group, the nonprofit behind Let’s Encrypt.
Frequently asked questions
-
What did Claude discover about the NSA’s unexplained curve seeds?
Claude traced five NIST elliptic-curve seeds to lrand48, an older random-number generator fed with timestamps from 1997 and 1998.
-
Does the finding prove the NSA did not place a backdoor in the curves?
No. The reconstruction makes a hidden backdoor less likely, but researchers still cannot explain why some candidates were skipped or how other curve elements were selected.
-
Do users of the NIST curves need to change anything?
No. The finding does not require users of the NIST curves to take action.
-
Why was Bitcoin not affected by the NSA curve mystery?
Bitcoin uses secp256k1, a simpler curve with two small fixed parameters and little room to conceal a weakness. Its public keys were not exposed by the discovery.
-
What separate quantum threat does Bitcoin face?
A sufficiently powerful quantum computer could work backward from a public Bitcoin key to recover its private key. No machine is currently close to carrying out that attack reliably.
WuBlockchain
Benjamin Cowen
WatcherGuru
CryptoSlate
TheBlock