Anthropic says Claude traced NIST curve seeds to a 1990s random generator

On Oct 16, Anthropic published that an internal Claude found where the seeds for the NIST prime curves P-192, P-224, P-256, P-384, and P-521 came from. The research page says none of those seeds is the output of a hash. They are output from the C library generator lrand48, started with a Unix timestamp. For the ten prime-curve seeds Anthropic recovered, including five from the ANSI X9.62 examples, every initialization was a timestamp between May 1997 and April 1998.

Anthropic says this is not a cryptographic break, a new attack, or a weakness in the curves. The page says the finding makes an intentional backdoor less plausible, because the seeds come from a common generator started from the clock, and anyone can reproduce them. The page also says there is no action to take.

The old story, which Anthropic quotes from Jerry Solinas in 2015, was that the seeds hashed a humorous passphrase. Anthropic says that turned out to be wrong. One binary seed, B-163, still does not fit anything Claude tried. Anthropic also says it has not explained the base points for P-224, P-256, P-384, and P-521. The $36,864 bounty for finding the seeds will be donated to the Internet Security Research Group.

What it costs

No price, product, or certificate changes on the research page. The only dollar figure is the bounty, which Anthropic says will be donated.

Should you switch

Do not swap curves because of this note. Anthropic's own line is that nothing should be done differently, and that the parameters look more trustworthy, not less.