The NIST Elliptic Curves Seeds Bounty Has Been Claimed

The seeds of the NIST elliptic curves have been discovered and claimed by Anthropic. The seeds were not from hashing sentences, but rather generated using the POSIX-standard drand48 random number generator with the current UNIX timestamp. The algorithm involves passing the timestamp to srand48() and generating one byte at a time with drand48.

Each sequence of 20 bytes is tested as a seed following ANSI X9.62, and invalid curves are rejected. The discovered seed generation method has confirmed the security of the NIST elliptic curves, which were previously published by NIST in FIPS 186-2 in 2000. No exploit was found for the hypothetical class of 2^61 weak prime-order curves, ruling out the technique described by Bernstein and Lange.

The findings completely rule out any malicious intent, and the NIST curves are now considered secure. Anthropic also discovered the seeds for the NIST B-curves, but they are not commonly used.