Anthropic says Claude traced NIST's ECDSA curve seeds to a pseudorandom number generator, challenging decades-old suspicions of an NSA backdoor in the algorithm (Anthropic)

The decades-old mystery surrounding the origins of NIST's ECDSA curve seeds has been solved, putting to rest long-standing concerns about a potential National Security Agency (NSA) backdoor in the algorithm. ECDSA, an elliptic curve cryptography standard widely used across various systems, was adopted by NIST in 2000 as part of the FIPS 186-2 Digital Signature Standard.

The specifications provided a "seed" parameter for curves over prime and binary fields, but the source of these seeds remained a mystery as they were given by the NSA without explanation or justification.

It was widely suspected that the NSA had planted backdoors in the seeds to compromise the security of the cryptographic standard. However, recent findings by Anthropic's AI model Claude have revealed that the seeds are not the result of any hash algorithm or NSA intervention. Instead, the seeds are generated by a common pseudorandom number generator (PRNG) called lrand48, which is initialized using a Unix timestamp.

Claude discovered the truth by asking an internal research model to investigate the origins of the NIST curve seeds without any hints. The model quickly found that none of the seeds were generated through a hash algorithm. Instead, each seed was the output of the lrand48 PRNG, which was seeded with a Unix timestamp. For each curve, Claude ran the scanner through thousands of iterations, identifying a pattern in the top bits of the seeds that matched the output of the 1990s-vintage lrand48 PRNG.

This revelation makes the previously suspected NSA backdoors much less plausible, as the seeds can now be reproduced using a simple PRNG algorithm. Claude's findings provide confidence that the cryptographic parameters are secure and free from any intentional weaknesses or backdoors. The source of the seeds remains a mystery, but the new explanation concludes that the algorithms used to generate the seeds are sound and do not pose any risks to the security of the cryptographic systems that rely on them.