NIST Curve Seed Origins

The “verifiably at random” seeds behind the NIST elliptic curves were unexplained for 25 years; in October 2026 their generation was recovered — the C library’s lrand48 PRNG seeded with Unix timestamps from 1997–98. The five prime-field curves P-192, P-224, P-256, P-384, and P-521 (FIPS 186-2, 2000) each publish a 160-bit seed whose hash determines the curve coefficient b; the P-256 seed C49D3608 86E70493 6A6678E1 139D26B7 819F7E90 shipped in the standard with no account of where it came from. The seeds were provided by the NSA — Jerry Solinas delivered them to the ANSI X9.62 committee in fall 1997 — and after the Snowden revelations unexplained NSA-supplied parameters were treated as a possible backdoor until provenance could be established. The 2026 recovery shows the seeds were drawn from an ordinary weak PRNG running off the system clock, reproducible by anyone, which closes the selection question in the curves’ favor. ¹

Why unexplained seeds were a question

The curve-generation recipe was public: pick an arbitrary seed, hash it with SHA-1, derive the curve, retry until the group order is prime (IEEE 1363 A.12.4). Hashing makes the curve checkable against its seed and — assuming SHA-1 preimage resistance — prevents selecting a curve first and back-fitting a seed. The seed itself was allowed to be arbitrary, so nothing about the standard required it to be explained. ²

Two things turned that gap into a controversy:

1. Dual_EC_DRBG. NIST’s standardized elliptic-curve random bit generator shipped with unexplained points P and Q; a relation Q = kP would let whoever chose them read the generator’s output, and the Certicom patent application described exactly that shape as key escrow. Reuters reported in December 2013 that the RSA company had been paid $10M to make it the BSAFE default. After that, “the NSA supplied it and didn’t explain it” stopped being a satisfying answer about any standard parameter. ³
2. The lost-passphrase story. Solinas told Bernstein in 2014 that the seeds were built “via hashing (SHA-1, I think) from the ASCII representation of a humorous message” — something like “Give Bob and Jerry a raise” — with a counter, the code written by Bob Reiter, and the details lost to a replaced machine (“if they exist, they are no doubt sitting on a hard drive near the Ark of the Covenant”). Weis’s 2023 investigation collected corroborating second-hand versions of the anecdote, found that FOIA requests to NIST and NSA went nowhere (NIST claimed no documentation; NSA stopped responding), and noted a counter-signal: several binary-field X9.62 example seeds contain the repeated bytes 4D696E676875615175 — the ASCII string “MinghuaQu”, a Certicom cryptographer’s name — which argues for casual seed choices rather than careful adversarial selection. ⁴

In October 2023 Filippo Valsorda organized a bounty for the pre-seeds: $12,288, tripled to $36,864 if donated to charity, framed as “an historical password cracking challenge” for the bruteforcing community, with a ~12k-hash target list covering 99% of the counter space. ⁵ The passphrase theory was the consensus bet. It was wrong.

The 2026 recovery

In October 2026 an Anthropic employee asked an internal research model to work out how the seeds were generated, without the passphrase clue. The method that worked:

• Recognize the generator instead of guessing the phrase. 1990s C-library PRNGs are weak enough that their output is identifiable. A scanner slid along each published seed one bit at a time, testing adjacent 32-bit chunks for consecutiveness across 34 generator/slice combinations. ⁶
• The top-bit signature. Written as ten 32-bit words, four of the ten seeds have a zero top bit in every word — probability 1/5810 by chance. That is lrand48, which returns only the top 31 bits of a 48-bit state. Brute-forcing the 17 hidden bits of the first word and checking the next four words recovered the full state for all four seeds.
• Truncated states need lattices. The prime-curve seeds kept fewer bits per output (lrand48() >> 23); recovering a truncated linear congruential generator’s state is a textbook lattice problem, solved with LLL basis reduction run over every possible bit window. All five NIST prime-curve seeds and five ANSI X9.62 ones fit the same pattern, each recovered 48-bit state regenerating all 160 bits of its seed.
• Run the generator backwards to the clock. LCGs invert; stepping each state back to a srand48 initialization (low 16 bits 0x330E) landed on Unix timestamps between May 1997 and April 1998 for the ten prime-curve seeds. The four recovered binary-curve initializations read as February 1984 and map to 17 April 1998 when doubled — the generating program may have halved the clock.
• Candidate counts. Each timestamp-seeded run drew 20-byte candidate seeds back to back and hashed each into a curve, skipping ones that failed the prime-order test. The published P-256 seed is candidate 1842 of its run.

Some base points were explained too: P-192 and five ANSI example curves take G from the RNG in Arjen Lenstra’s FreeLIP big-integer package (seed with a small integer, drop seven outputs, take 26-bit outputs reduced mod p as candidate x-coordinates until one lands on the curve). The generator seeds are small integers — 20000 for P-192, 20420/20507/20509 for prime239v1–v3.

The bounty claim (October 2026)

On 15 October 2026 at 01:07:51 UTC — the day before the public announcement — ten Anthropic researchers (John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini, and Steve Weis) claimed Valsorda’s full bounty and donated the prize to ISRG, tripling its value to $36,864. Valsorda reimplemented the generation algorithm independently in Go before accepting the claim. ⁷

His reconstruction supplies the full run table: one srand48() initialization per timestamp, 20-byte candidate seeds drawn back to back and tried per ANSI X9.62 until one yields a curve, with some timestamps generating multiple curves by continuing past the first accepted seed. P-256 is candidate 1842 of the 1997-08-16 01:52:34 UTC run — the same run’s candidate 876 also yields a valid curve and was never published. P-384 is candidate 2688 of the 1997-08-30 run, P-224 candidate 7026 of the 1998-04-03 run, P-521 candidate 1136 of the 1997-08-08 run, and the three prime192v and three prime239v example curves came from two May 1997 runs. ⁸

Two selection criteria beyond ANSI X9.62’s also surfaced. One is clear: a candidate was rejected when the bit length of the group order n exceeded that of the base field p (not the stricter n < p, since prime239v2 has p < n < 2²³⁹). The other is still open: roughly twice as many valid seeds exist as were published, and the gaps between published seeds are irregular. Valsorda’s two candidate explanations are that the same generator also served validation, consuming output and skipping candidates, or that one of the 1997-era calculations — then still state-of-the-art, now minutes of off-the-shelf software — returned wrong results half the time. ⁹

He also notes the team recovered the generation of the binary-field B-curve seeds, though no deployed system uses those curves. ¹⁰

What it settles

This is not a break in anything; it changes what the curves’ provenance can support. The generation procedure is now known, dull, and rerunnable, and the search space it implies for adversarial selection is timestamps — the run’s iteration index is visible in the recovered state. Anthropic’s reading is that the findings make intentional weakness “much less plausible.” ¹¹ That adds empirical weight to the argument Koblitz and Menezes made in 2015: for seed-grinding to hide a weakness, the weak-curve class would have to be enormous (their estimate: selecting a curve the NSA could break at 2^-40 odds would leave ~2^209 such curves), and a class that large surviving 25 years of outside cryptanalysis is implausible. ¹²

Valsorda’s framing of what the recovery settles is sharper than “less plausible”: the strongest published selection-attack hypothesis is Bernstein and Lange’s technique — described to Koblitz and Menezes in 2017 and reported in a later version of their paper — which needed 70 bits of seed-selection freedom to target a hypothetical class of 2⁶¹ weak prime-order curves. With the generation procedure known, even the most generous adversarial model (free choice of any timestamp in 1997–98 and any of the first 16 prime-order candidates, which covers the unexplained rejections) leaves barely 30 bits of freedom: too little to target a small weak class and too little to embed a NOBUS backdoor. ¹³

The reputational arc closed with it. Valsorda lists deterministic and hedged ECDSA signing, formally verified field implementations, and the 2015 Renes–Costello–Batina complete addition formulas as the other turns of the NIST curves’ “rehabilitation arc,” says he would now personally recommend them over Curve25519/Ed25519/X25519, and closes: “Just in time for them to be retired in favor of post-quantum signatures.” ¹⁴

It also closes the folklore. The “hash of a humorous passphrase” story, corroborated from multiple directions and enshrined as the bounty’s premise, was a red herring; the mystery was never a password to crack but a program to reverse-engineer.

Open questions

• Not every skipped candidate is explained. P-256’s run passed over candidate 876, which also yields a correctly formed prime-order curve; P-224’s run skipped three such curves and the two ANSI runs seven more. The recovered bit-length criterion (bitlen n ≤ bitlen p) accounts for part of the skipping, and the surplus of valid-but-unpublished seeds is roughly twofold with irregular gaps — Valsorda’s candidate explanations are validation consuming RNG output or a 1997-era calculation returning wrong results half the time. The count is too small to suggest cherry-picking.
• The fifth binary seed, B-163, fits no recovered generator or window in Anthropic’s writeup. Valsorda reports the team recovered the B-curve seed generation in general; whether B-163’s specific run is accounted for is not stated in the available sources.
• The base points of P-224, P-256, P-384, and P-521 fit no known recipe.
• How many generation runs were performed in total is not recoverable from the numbers.

The weak-PRNG angle

lrand48 seeded from the clock is the same defect that sinks key generation — see weak-entropy-key-generation, where a timestamp-seeded Mersenne Twister collapsed wallet key spaces to 2^32 and the coldcard-entropy-incident-2026 sweep took 1,778+ BTC from it. For key material the defect is fatal; for standard parameters it was benign, and the same weakness made the seeds auditable. Non-cryptographic PRNG output is recognizable, invertible, and state-recoverable (by brute force here, by lattice reduction when truncated) — which turned a 25-year provenance question into a forensics problem with a definitive answer. Predictability that destroys a secret is what makes a process verifiable.

Related concepts

• nothing-up-my-sleeve-numbers — the “verifiably at random” construction the seeds were meant to exemplify, and the manipulation critiques that made provenance worth chasing
• weak-entropy-key-generation — the same defect class (weak PRNG, timestamp seed) with stakes reversed: fatal for secrets, instrumental for audit trails
• coldcard-entropy-incident-2026 — what timestamp-seeded entropy costs when the output is a key rather than a standard parameter
• model-backdoors — the same provenance question one layer up: could an unexplained artifact hide planted behavior, and what evidence answers it
• certificate-path-building — where P-256 and P-384 spend their working lives: the X.509 web PKI
• expert-level-ai-evals — frontier models crossing expert-level problem solving, including disputes with expert answer keys; the seed recovery is a sibling case in applied cryptanalysis

Sources

• Anthropic 2026 — Claude reveals ECDSA curve origins
• Neal Koblitz and Alfred J. Menezes 2015 — A Riddle Wrapped in an Enigma
• Steve Weis 2023 — How were the NIST ECDSA curve parameters generated?
• Filippo Valsorda 2023 — Announcing the $12k NIST Elliptic Curves Seeds Bounty
• Filippo Valsorda 2026 — The NIST Elliptic Curves Seeds Bounty Has Been Claimed

Footnotes

1. Anthropic 2026 — Claude reveals ECDSA curve origins ↩

2. Steve Weis 2023 — How were the NIST ECDSA curve parameters generated? ↩

3. Neal Koblitz and Alfred J. Menezes 2015 — A Riddle Wrapped in an Enigma ↩

4. Steve Weis 2023 — How were the NIST ECDSA curve parameters generated? ↩

5. Filippo Valsorda 2023 — Announcing the $12k NIST Elliptic Curves Seeds Bounty ↩

6. Anthropic 2026 — Claude reveals ECDSA curve origins ↩

7. Filippo Valsorda 2026 — The NIST Elliptic Curves Seeds Bounty Has Been Claimed ↩

8. Filippo Valsorda 2026 — The NIST Elliptic Curves Seeds Bounty Has Been Claimed ↩

9. Filippo Valsorda 2026 — The NIST Elliptic Curves Seeds Bounty Has Been Claimed ↩

10. Filippo Valsorda 2026 — The NIST Elliptic Curves Seeds Bounty Has Been Claimed ↩

11. Anthropic 2026 — Claude reveals ECDSA curve origins ↩

12. Neal Koblitz and Alfred J. Menezes 2015 — A Riddle Wrapped in an Enigma ↩

13. Filippo Valsorda 2026 — The NIST Elliptic Curves Seeds Bounty Has Been Claimed ↩

14. Filippo Valsorda 2026 — The NIST Elliptic Curves Seeds Bounty Has Been Claimed ↩