ECDSA Curve Origins
Anthropic researchers reveal the origins of ECDSA curve seeds, traced back to a Unix timestamp and a common pseudorandom number generator.
Intelligence analysis by Qwen 2.5 (3B)
Anthropic researchers uncover the origins of ECDSA curve seeds, which were generated using a Unix timestamp and a common pseudorandom number generator, not through a hash algorithm as previously believed.
The seeds for a popular cryptographic standard were generated by a simple algorithm that used a Unix timestamp and a common random number generator. The pattern in the top bits of the seeds helped researchers find out how they were generated.
Analysis
The Mystery of the Seeds
Neal Koblitz and Alfred Menezes wrote an excellent summary on this controversy, discussing the history and concerns around the seed values. The seeds were provided by the NSA without any explanation or justification, leading to years of speculation.
The Discovery
Several Anthropic employees had unsuccessfully chased the seeds following the tip about it being a hash of a humorous phrase. In October 2026, a curious Anthropic employee asked an internal research model to find out how the seeds were generated without pointing at the clue. In under half an hour, Claude discovered the origins of the NIST P-192, P-224, P-256, P-384 and P-521 seeds. None of them were the results of any hash algorithm at all, but rather the output of the C library's lrand48 random-number generator, seeded with a Unix timestamp.
The Algorithm
The algorithm used would sample bytes from the random number generator (RNG) initialized by a Unix timestamp (t) for some number of iterations (n). Each iteration would draw 20 bytes as a candidate seed. So, the first 20 bytes are candidate 1, the next 20 bytes are candidate 2, and so on. For example, P-256 required 1842 iterations to output the standardized seed.
The Pattern
Claude noticed a pattern in the top bits for some seeds: they were all zero. Written as five 32-bit words, four of the ten seeds have a 0 in the top bit for all 20 words. That would happen by chance with probability 1/5810. That was a signature of the linear congruential generator lrand48, which only returns the top 31 bits of a 48-bit state.
The Recovery
To recover the state, Claude took the first word, tried all 2¹⁷ values of the 17 hidden bits, and checked that the next four words followed. That worked for all four seeds under discussion. The prime-curve seeds came from the same lrand48 generator but kept fewer bits of each output. Claude had to recover the internal state of the PRNG from those bits. It turns out recovering the state of a truncated linear congruential generator is a textbook lattice problem, solved with the Lenstra–Lenstra–Lovász (LLL) basis reduction algorithm.
Key points
- The seeds for ECDSA curves were generated using a Unix timestamp and a common pseudorandom number generator.
- The pattern in the top bits of the seeds helped researchers find out how they were generated.
- The discovery makes us more confident that the ECDSA curves were chosen without any backdoors or intentional weaknesses.
- Recovering the state of a truncated linear congruential generator is a textbook lattice problem, solved with the Lenstra–Lenstra–Lovász (LLL) basis reduction algorithm.
- The prime-curve seeds came from the same lrand48 generator but kept fewer bits of each output.
This discovery makes us more confident that the ECDSA curves were chosen without any backdoors or intentional weaknesses, leaving less room for subversion and ensuring the parameters are secure.
While the seeds were generated in a simple way, the discovery could lead to a need for more rigorous testing and validation of cryptographic standards to prevent similar issues in the future.
