The NIST Elliptic Curves Seeds Bounty Has Been Claimed
words.filippo.io
October 16, 2026
6 min read
43/100
Summary
A team from Anthropic has reconstructed how the seeds for NIST’s widely used P-192, P-224, P-256, P-384 and P-521 elliptic curves were generated. John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini and Steve Weis claimed a three-year-old bounty on October 15, 2026. The team donated the $36,864 prize to the Internet Security Research Group, which operates Let’s Encrypt. NIST published the curves in FIPS 186-2 in 2000 after deriving parameters from SHA-1 hashes of arbitrary seeds under the ANSI X9.62 procedure. The seeds were generated in 1997–98 by initializing the POSIX drand48 pseudorandom-number generator with UNIX timestamps, generating 20-byte candidate seeds, and accepting candidates that produced valid curves. A Go reimplementation verified the reconstruction. The process also rejected candidates whose group-order bit length exceeded the base field’s bit length, but an additional unexplained filter appears to have excluded roughly half of otherwise valid seeds. The reconstructed timestamp-based process substantially limits the freedom available to choose curve parameters. The source estimates that selecting any 1997–98 timestamp and one of the first 16 prime-order candidates would provide fewer than 30 bits of choice, ruling out a previously proposed technique requiring 70 bits of seed-selection freedom to target a hypothetical class of weak curves.
Key Takeaways
- Anthropic researchers determined that NIST’s prime-field elliptic-curve seeds came from drand48 output initialized with UNIX timestamps in 1997–98, rather than hashes of English sentences.
- The NIST P-192, P-224, P-256, P-384 and P-521 curves were published in 2000, but the origin of their arbitrary ANSI X9.62 seeds had remained undocumented.
- The bounty was claimed on October 15, 2026, and the $36,864 prize was donated to the Internet Security Research Group, the nonprofit behind Let’s Encrypt.
- The reconstructed process leaves fewer than 30 bits of parameter-selection freedom under a generous assumption, versus 70 bits required by a previously described hypothetical curve-targeting technique.
- An undocumented rejection criterion still appears to have removed about half of the candidate seeds that otherwise met the known generation rules.
What the discussion said
The visible discussion is not really an AI/ML debate, despite a moderator pointing readers toward a separate thread whose title credits Claude with uncovering the curve history. None of the supplied comments evaluates Claude’s reasoning, reliability, prompting, access to evidence, or broader implications for AI-assisted technical investigation. The only AI-adjacent fact is that readers are redirected to that external discussion; the comments here provide no basis for judging whether the model made a meaningful contribution or merely helped surface existing evidence. Instead, commenters focus on the provenance of the random seeds used for NIST elliptic curves. The thread treats the reported use of a standard pseudorandom generator as important, but remains skeptical of the official recollection: one reader argues the account could still be deliberate misdirection rather than an innocent memory error. Another pushes back that concealment would be pointless now that the apparent source has been identified, while also arguing that transparent disclosure would have been the sensible course from the start. A final aside proposes another opaque seed-like artifact as a possible target for similar scrutiny, but it concerns software obfuscation rather than AI. Overall, the supplied material offers no clear sentiment about AI systems themselves.
