For decades, experts questioned whether unexplained numbers in widely used security standards were concealed by a US National Security Agency (NSA) backdoor. Anthropic says its Claude AI traced them to a routine 1990s computer program and timestamps, without uncovering a security flaw. An Anthropic AI model has cracked one of cryptography’s longest-running mysteries, tracing numbers the NSA handed to the US government in the late 1990s - which were long suspected of hiding a backdoor - to an ordinary random-number program fed with timestamps from 1997 and 1998. The model took just half an hour to produce a solution cryptographers had chased for 25 years.[1]
For more than a quarter of a century, cybersecurity experts have wrestled with a troubling question: did the NSA secretly introduce a vulnerability into some of the internet's most widely used cryptographic standards, potentially giving American intelligence agencies a way to bypass security protections? Anthropic states an internal Claude AI research model traced the origins of five NSA-supplied elliptic curve seeds in under 30 minutes. These results explain how important public security parameters were chosen, rather than exposing secret keys or breaking encryption.
In a recently published report, researchers said the seeds behind NIST curves P-192, P-224, P-256, P-384, and P-521 came from lrand48, an older C library random-number generator initialized with Unix timestamps. The result challenges a long-running theory that the values were hashes of humorous phrases.
NIST adopted the Elliptic Curve Digital Signature Algorithm (ECDSA) in its FIPS 186-2 standard in 2000. Digital signatures help verify who signed data and whether it has changed. The standard published seeds used by a SHA-1-based process to derive curve parameters but did not explain where those seeds originated. That missing history left room for claims that the NSA might have selected curves with hidden weaknesses. Researchers had no demonstrated attack against these curves but lacked a clear account of how they chose them. Former NSA mathematician Jerry Solinas recalled phrases like “Give Bob and Jerry a raise,” which sent earlier searches toward possible hash inputs.
The stakes extend widely, as Apple’s PQ3 iMessage protocol uses ECDSA with P-256 for message authentication. Understanding the history of these shared parameters helps explain why trust in curve selection matters across widely used services. Instead of following the phrase theory, Claude examined generators common in 1990s software. It built a scanner covering 34 combinations of generators and output slices, looking for patterns inside the published seeds.
Some binary-curve seeds showed a clear clue. Their 32-bit words consistently had zero in the highest bit, matching lrand48, which returns 31 bits from a 48-bit internal state. Claude recovered candidate states by testing the 17 hidden bits and checking subsequent outputs.
The prime-curve seeds required another step because they retained only eight bits from each generator output. Claude used the Lenstra–Lenstra–Lovász lattice reduction algorithm, or LLL, to recover internal states from these partial values. Five NIST seeds and five ANSI X9.62 example seeds matched the same construction. Running the generator backward revealed initialization values corresponding to dates between May 1997 and April 1998. For P-256, the published seed was the 1,842nd candidate from a run initialized on August 16, 1997, at 01:52:34 UTC. Each candidate contained 20 bytes. Four binary-curve seeds also matched the generator. Their values suggest a clock value divided by two, although the researchers describe that interpretation as a possibility, not a confirmed fact.
Anthropic stressed that this is not a cryptographic break, new attack, or newly discovered ECDSA weakness. These are public curve-generation seeds, not private signing keys. Reconstructing them does not let an attacker forge signatures. The researchers say the simple, repeatable process makes deliberate manipulation less plausible.
Claude also traced base-point generation for P-192 and five ANSI example curves to FreeLIP, a long-integer arithmetic package. Base points are fixed starting points used to calculate public keys, and their origins are separate from the curve seeds. The account is not complete. B-163’s seed remains unexplained, as do several base points. Researchers also found skipped candidates that appeared suitable, including P-256 candidate 876, but they don't know why they were rejected. The findings therefore strengthen confidence, but do not prove every selection decision was harmless.
Anthropic published reproduction code so others can check the matches. The Internet Security Research Group will receive the $36,864 bounty. The report calls for no changes to deployed systems because of this discovery alone.
This article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments, or assistance, please contact the office directly at 1-844-492-7225 or feedback@redskyalliance.com
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929
[1] https://www.cybersecurityintelligence.com/blog/claude-ai-solves-longstanding-nsa-cryptography-mystery-9848.html
Comments