--- title: The NSA curve backdoor theory just lost its best evidence description: A long-standing suspicion that the NSA secretly backdoored NIST's elliptic curves (via unexplained seed values) appears to have a mundane explanation. A team... canonical: https://daily.dev/posts/the-nsa-curve-backdoor-theory-just-lost-its-best-evidence-vhomzoyci twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The NSA curve backdoor theory just lost its best evidence | daily.dev og:description: A long-standing suspicion that the NSA secretly backdoored NIST's elliptic curves (via unexplained seed values) appears to have a mundane explanation. A team... og:url: https://daily.dev/posts/the-nsa-curve-backdoor-theory-just-lost-its-best-evidence-vhomzoyci og:image: https://api.daily.dev/og/posts/VHOMzOyCI.png og:image:alt: The NSA curve backdoor theory just lost its best evidence og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The NSA curve backdoor theory just lost its best evidence **[Trends](https://daily.dev/sources/trends)** · 3 min read · 0 upvotes · 0 comments ## Summary A long-standing suspicion that the NSA secretly backdoored NIST's elliptic curves (via unexplained seed values) appears to have a mundane explanation. A team at Anthropic, using an internal Claude model to spot statistical patterns and recover PRNG state via lattice reduction, traced the curve seeds to the POSIX drand48() generator seeded with 1997-98 Unix timestamps rather than a crafted hash. This means the NSA had only about 30 bits of freedom when generating seeds, not enough room to engineer a weak curve, undercutting the classic Bernstein/Lange backdoor concern. The team claimed a $36,864 bounty and donated it to ISRG (Let's Encrypt's nonprofit). Some mysteries remain unsolved, including the B-163 seed, several base points for P-224/256/384/521, and an unexplained extra rejection criterion in the seed-generation algorithm. ## Content The NIST elliptic curve seeds were never a forgotten English sentence. They came from a boring random number generator seeded with a timestamp, and the people who figured it out say a Claude model got there in under 30 minutes. @Hesamation put the vibe in a greentext: a 25-year-old NSA cryptography mystery, a $36,864 bounty, solved in under half an hour. The best detail is the model's own inner monologue: "is it suspicious that such an obvious thing wasn't discovered in 25 years?" followed by "let me be skeptical: am I in a simulated?" and finally "wow, it's a real discovery." ## What actually happened The bounty, announced three years earlier, was claimed by a team at Anthropic. It had been tripled, and the prize went to ISRG, the nonprofit behind Let's Encrypt. The seeds for P-192 through P-521 came from the POSIX drand48() family (lrand48), seeded with 1997-98 Unix timestamps. Claude spotted zeroed top bits, recovered the internal generator state with lattice reduction (LLL), and rebuilt the process. A Go reimplementation confirmed it. @dylan0915 has the precise detail. P-256's seed was candidate #1,842 from a run at 01:52:34 UTC on Aug 16, 1997. @matthew_d_green retweeted @sweis's version: "P-256 was born Friday, August 15th, 1997 at 9:52PM Fort Meade time." Claude also traced several ANSI X9.62 and P-192 base points to Arjen Lenstra's FreeLIP library. ## The backdoor question This is the part that matters for crypto people. The finding rules out the seed-selection attack Bernstein and Lange described: the NSA would have had only about 30 bits of freedom, not enough to plant a backdoor. Anthropic is careful, though. This is not a break of P-256, and it makes a deliberate backdoor far less plausible rather than proving it impossible. Bitcoin's secp256k1 was never part of this. Loose ends remain. The candidate-rejection rule includes an undocumented criterion nobody can fully explain. The B-163 seed and the base points for P-224, P-256, P-384 and P-521 are still unsolved. ## The takeaway being passed around @dylan0915's read is the one I'd steal: AI wins first where checking is cheap. A candidate seed either regenerates the curve or it doesn't. He points to the same week's quantum circuit results (17x fewer gates on one elliptic-curve addition circuit, at about 12% more qubits) as the same pattern: generate, verify, repeat. His advice: "build the checker before you buy the agent." I'd add one thing. A 25-year conspiracy theory dying to a timestamp is oddly satisfying. ## Questions this post answers ### were the NIST elliptic curve seeds like P-256 actually generated using a hidden NSA backdoor hash? No, research found the seeds came from the POSIX drand48() pseudorandom number generator seeded with Unix timestamps from 1997-98, not a crafted hash. This means the NSA had only about 30 bits of freedom when choosing seeds, which is not enough room to secretly engineer a weak curve, undercutting the long-standing backdoor suspicion raised by Bernstein and Lange. _Developers evaluating curve security can follow deep dives like this on daily.dev to stay current on cryptography trust debates._ ### how was the NIST P-256 curve seed generation algorithm reverse engineered? An internal Claude model noticed statistical patterns, specifically zeroed top bits, pointing to an lrand48-style generator, then recovered the internal PRNG state using lattice reduction (LLL) and reconstructed the process in under 30 minutes. A Go reimplementation later confirmed the algorithm, which rejects candidate seeds using ANSI X9.62 rules plus one extra unexplained criterion. _Anyone tracking AI-assisted cryptanalysis can find write-ups like this through daily.dev._ ### is the NIST elliptic curve seed mystery fully solved now? Not entirely. While the general seed-generation method (drand48 with Unix timestamps) was confirmed, the B-163 seed remains unsolved, as do the base points for P-224, P-256, P-384, and P-521, and the extra rejection criterion used alongside ANSI X9.62 rules is still unexplained. _Readers weighing confidence in standardized curves can keep up with unresolved cryptography questions via daily.dev._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 166 comments across hackernews, lobsters (as of 2026-10-17). **TL;DR:** Claude reveals ECDSA curve origins: Most commenters accept that the lrand48/timestamp explanation convincingly puts the long-running NSA backdoor conspiracy to rest, but the discussion is dominated by a separate, heated tangent about AI labs gatekeeping cybersecurity and biology capabilities behind restrictive filters available only to insiders. The NIST Elliptic Curves Seeds Bounty Has Been Claimed: Most see this as welcome closure that lays decades-old backdoor conspiracy theories to rest, though several commenters question why such a weak, undocumented generator (and lack of disclosure) was used in the first place and whether that itself reflects poorly on the process. **Sentiment:** 31% positive · 27% mixed · 42% skeptical **The case for** - Many see this as a decisive, independently verifiable rebuttal to 25 years of backdoor conspiracy theories about the NIST curves. - Finally resolving a long-unexplained cryptographic mystery restores some confidence in NIST curves. - Some find it impressive that the model reconstructed a decades-old PRNG and lattice-reduction process in under 30 minutes. - Some argue P-256 remains practically preferable to Curve25519/Ed25519 due to ubiquity and hardware support. - A few note the finding is practically useful, e.g. justifying confidence to ship ECDSA P-256 verification in blockchain contexts. **The pushback** - Many argue there's a double standard: Anthropic can do advanced cyber/crypto work with Claude while ordinary users get blocked by overly aggressive safety filters for even basic requests. - Some find it odd/concerning that cryptographers would use a weak LCG (drand48) rather than a CSPRNG to generate seeds, questioning what else may have been mishandled. - Several say this points to a widening moat between model providers/governments and the public, concentrating access to powerful capabilities. - Skeptics argue the explanation doesn't fully rule out deliberate obfuscation \u2014 a weak generator could still have been reverse-engineered or chosen seeds disguised as timestamps. - Some remain unconvinced the origin story fully rules out a deliberately selected weak seed, since discarded candidate seeds aren't visible. **By community** - hackernews (heated): While many are satisfied the mystery is solved and conspiracy theories debunked, a large share of the thread diverts into heated complaints about AI companies restricting cyber/bio capabilities for ordinary users while using them internally. - lobsters (mixed): Generally relieved and technical, with some probing whether a weak seed generator undermines confidence and debate over NIST vs other curves going forward. **Hottest debate:** Claude reveals ECDSA curve origins: Whether this result actually proves the curve seeds are free of any backdoor, versus whether AI labs' own restrictive access policies represent a bigger, unresolved problem. **Open questions** - What is the significance (if any) of the specific 1997-1998 timestamps used, given they weren't simple 'now()' calls? - Would the curves have been any more or less secure if the seeds had simply been small sequential numbers? - Could the unexplained B-163 seed be due to a transcription error rather than a different generation method? - Why wasn't the seed-generation method documented or disclosed at the time if there was nothing to hide? - Are there classes of elliptic curve seeds that could be weaker or stronger, making some seeds preferable to attackers? **Highlights** > I have a list I should publish at some point of mild advantages of one over the other but really what dominates is that P-256 is everywhere, including in hardware, and once the benefits are so marginal and mixed and context-specific I would rather write one very good implementation of one curve than split my energy across two. Anyway, it's all moot now: the right choice between ECDSA P-256 and Ed25519 is ML-DSA-44. > — [FiloSottile on lobsters · 6 points](https://lobste.rs/s/ddtqtn/nist_elliptic_curves_seeds_bounty_has#c_fluxdm) > Those conspiracy theories go back to 1975 when the NSA modified the S-boxes in DES that had been provided by IBM[1]. NIST should have known better. [1] In that case[2] there was nothing nefarious; a decade later non-NSA cryptographers were able to discover the attack that NSA's modifications had protected against. [2] In other cases NSA's magic numbers _were_ nefarious: it's all but proven that Dual-EC DRBG has a kleptographic weakness and that the NSA was working to break TLS with it. > — [syncsynchalt on lobsters · 4 points](https://lobste.rs/s/ddtqtn/nist_elliptic_curves_seeds_bounty_has#c_qrdcnh) > I don't know whether this is good news that the curves were not backdoored, or bad news that such a simple linear congruential generator was used to create the seed. Surely as cryptographers they would've known to use a CSPRNG to generate the seed? If they used something so weak for the seed, what else did they get wrong with the curves? > — [edwintorok on lobsters · 1 points, 3 comments](https://lobste.rs/s/ddtqtn/nist_elliptic_curves_seeds_bounty_has#c_y4f01j) > > This is not a cryptographic break, new attack, or weakness in the ECDSA curves. In fact, this makes us more confident the curves were chosen without any backdoors or intentional weaknesses. Uh… did you talk to any cryptographers? This is EXACTLY what a weak curve would look like. Imagine that 1 in a thousand, or one in a million keys, selected at random, are vulnerable to some withheld attack. This approach lets you vary the timestamp or number of iterations until a weak key is found, then have plausible deniability afterward. This is why modern systems choose constants in a way with no free choice of parameters (e.g. sqrt of 2 for first constant, cube root for second constant, etc.). > — [adastra22 on hackernews · 3 comments](https://news.ycombinator.com/item?id=50123184) > Anthropic gets zero of my money because their favorite word is no. I cannot figure out how to as an individual or a small startup request elevated permissions for the purposes of anything that they think might potentially be dangerous for someone who is not me to access. I have a background in cybersecurity. I have a background in life sciences. Can I put those skills to use to benefit humanity? Who knows. > — [novia on hackernews · 2 comments](https://news.ycombinator.com/item?id=50123396) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50122800) · 290 points · 140 comments - [hackernews](https://news.ycombinator.com/item?id=50122920) · 39 points · 16 comments - [lobsters](https://lobste.rs/s/ddtqtn/nist_elliptic_curves_seeds_bounty_has) · 72 points · 10 comments ## Similar posts on daily.dev - [quantumslop/URANDOM\_DEMO.md at 25ad2e76ae58baa96f6219742459407db9dd17f5 · yuvadm/quantumslop](https://daily.dev/posts/quantumslop-urandom-demo-md-at-25ad2e76ae58baa96f6219742459407db9dd17f5-yuvadm-quantumslop-cxypfkazc) · Hacker News · 0 upvotes · 0 comments --- Tags: [#claude](https://daily.dev/tags/claude), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/the-nsa-curve-backdoor-theory-just-lost-its-best-evidence-vhomzoyci) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The NSA curve backdoor theory just lost its best evidence","url":"https://daily.dev/posts/the-nsa-curve-backdoor-theory-just-lost-its-best-evidence-vhomzoyci","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-nsa-curve-backdoor-theory-just-lost-its-best-evidence-vhomzoyci"},"datePublished":"2026-10-16T20:00:46.835Z","dateModified":"2026-10-17T14:49:14.122Z","description":"A long-standing suspicion that the NSA secretly backdoored NIST's elliptic curves (via unexplained seed values) appears to have a mundane explanation. A team...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ed3a3cde1056f908153017e73a719268?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ed3a3cde1056f908153017e73a719268?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Trends","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Trends","logo":"https://media.daily.dev/image/upload/s--ZfSp3asX--/f_auto,q_auto/v1780996004/logos/trends?_a=BAMAMiWQ0","url":"https://daily.dev/sources/trends"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-nsa-curve-backdoor-theory-just-lost-its-best-evidence-vhomzoyci","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"claude,cryptography","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Trends","item":"https://daily.dev/sources/trends"},{"@type":"ListItem","position":3,"name":"The NSA curve backdoor theory just lost its best evidence"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-nsa-curve-backdoor-theory-just-lost-its-best-evidence-vhomzoyci#faq","mainEntity":[{"@type":"Question","name":"were the NIST elliptic curve seeds like P-256 actually generated using a hidden NSA backdoor hash?","acceptedAnswer":{"@type":"Answer","text":"No, research found the seeds came from the POSIX drand48() pseudorandom number generator seeded with Unix timestamps from 1997-98, not a crafted hash. This means the NSA had only about 30 bits of freedom when choosing seeds, which is not enough room to secretly engineer a weak curve, undercutting the long-standing backdoor suspicion raised by Bernstein and Lange. Developers evaluating curve security can follow deep dives like this on daily.dev to stay current on cryptography trust debates."}},{"@type":"Question","name":"how was the NIST P-256 curve seed generation algorithm reverse engineered?","acceptedAnswer":{"@type":"Answer","text":"An internal Claude model noticed statistical patterns, specifically zeroed top bits, pointing to an lrand48-style generator, then recovered the internal PRNG state using lattice reduction (LLL) and reconstructed the process in under 30 minutes. A Go reimplementation later confirmed the algorithm, which rejects candidate seeds using ANSI X9.62 rules plus one extra unexplained criterion. Anyone tracking AI-assisted cryptanalysis can find write-ups like this through daily.dev."}},{"@type":"Question","name":"is the NIST elliptic curve seed mystery fully solved now?","acceptedAnswer":{"@type":"Answer","text":"Not entirely. While the general seed-generation method (drand48 with Unix timestamps) was confirmed, the B-163 seed remains unsolved, as do the base points for P-224, P-256, P-384, and P-521, and the extra rejection criterion used alongside ANSI X9.62 rules is still unexplained. Readers weighing confidence in standardized curves can keep up with unresolved cryptography questions via daily.dev."}}]} ```