IT之家 · 智能时代 · 10/17/2026, 06:53:05
Claude Solves 26-Year Mystery of NSA Elliptic Curve Parameters
Anthropic's team used Claude to reverse-engineer the generation process of NSA-provided ECDSA elliptic curve seeds in under 30 minutes. The analysis confirmed that parameters originated from the lrand48 PRNG initialized with Unix timestamps between 1997 and 1998, alleviating long-standing concerns about backdoors without revealing new attack vectors.
SOURCE COVERAGEFull Original Report
IT Home Note: The "seed" here can be understood as a starting data input used when generating elliptic curve parameters. The generation rule functions like a machine with fixed programming, where the seed serves as the raw material fed into it. Given the same raw material and processed according to the same rules, the result will always be identical. By publishing the seed, others can recompute the process to verify that the curve parameters were indeed generated following the disclosed steps.
The mystery stems from a set of elliptic curves incorporated into the U.S. Digital Signature Standard in 2000. The relevant seeds were provided by the National Security Agency (NSA), but the generation process was not explained, leading to long-standing speculation about potential hidden backdoors. These curves are used in the Elliptic Curve Digital Signature Algorithm (ECDSA) to help verify the authenticity of digital information.
According to Anthropic, Claude shifted its focus to investigating common software tools from the 1990s and discovered that these seeds actually originated from the lrand48 pseudo-random number generator in C language libraries, initialized using Unix timestamps.
By identifying bit patterns, restoring the generator's state, and performing reverse calculations, the model traced the relevant generation times back to 1997–1998. Specifically, the standard seed for P-256 corresponds to the 1,842nd candidate value in a single run. The team has published reproduction code.
The results show that the seeds for P-192, P-224, P-256, P-384, and P-521 can all be generated via initialization with Unix timestamps from 1997 to 1998. Among them, P-256 corresponds to August 16, 1997, yielding the standard seed after 1,842 rounds of candidate generation.
Anthropic emphasized that this does not constitute breaking ECDSA, nor did it reveal any new attack vectors. The findings reduce concerns about deliberately implanted backdoors in the parameters, and users do not need to take any action based on this. However, the research has not yet explained all details, including the origin of the B-163 seed, the generation method for base points on certain curves, and why some available candidate curves were skipped.
