Anthropic traces NIST ECDSA seed origins

Anthropic says an internal research model traced the published seeds for five NIST prime-field elliptic curves to a timestamp-seeded random-number generator used in the late 1990s. The result answers a long-running question about how those public curve parameters were chosen. It does not break ECDSA or identify a weakness in the curves.

The distinction matters. A curve seed is a public input whose SHA-1 hash is used to derive a curve coefficient. It is not a signing key, a private key, or the per-signature nonce. Anthropic says the seeds for P-192, P-224, P-256, P-384 and P-521 match output from the C library's lrand48 generator, initialized with Unix timestamps from 1997 and 1998. The generator emitted 20-byte candidate blocks; for example, the published P-256 seed is candidate 1,842 in its run.

Anthropic's write-up describes recognizing the generator from patterns in its output, then recovering its state from full and truncated output bits. The prime-curve seeds share the same output slice, lrand48() >> 23. Filippo Valsorda, who organized the bounty, independently reimplemented the timestamp-seeded drand48 family in Go and confirmed the recovered sequence. The different function names refer to the related POSIX generator interfaces described in the two accounts.

What the reconstruction settles

The finding makes the old suspicion that the seed values concealed a deliberately weakened curve less plausible. Valsorda says the observed process rules out one previously described seed-selection technique. That is a specific result, not proof that every conceivable curve-selection backdoor is impossible. The work also shows that the seeds followed a reproducible process rather than a secret phrase hashed into parameters.

The historical record still has gaps. Anthropic reports that some candidates which met the published curve criteria were skipped, and says it does not know why. Its write-up says B-163, a binary-field seed, remained unexplained in that analysis. Valsorda's October 16 postscript says the Anthropic team also figured out the NIST B-curve seeds, but it gives no method or seed values. The postscript updates the status without publicly documenting how B-163 was recovered. Anthropic also leaves the base-point origins of P-224, P-256, P-384, P-521 and the NIST binary curves unexplained.

Neither account reports a new attack, a cryptographic break, or a need to change deployed systems. The result is useful as a piece of cryptographic history and as evidence about the provenance of these parameters. It should not be stretched into a claim that every selection decision is now understood.