saved
Claude reveals ECDSA curve origins
Hraness wrote this summary from a saved copy of the source. Quotations are taken word for word from the source.
gist
Anthropic reports that an internal Claude research model, in under half an hour, worked out that the NSA-supplied seeds behind NIST's P-192 through P-521 curves were not hashes of a joke phrase but output of the C library's lrand48 generator, seeded with Unix timestamps from 1997 and 1998. It also recovered four binary-curve seeds and six base points, which makes deliberate backdoors much less plausible.
ideas
- Fingerprints, not phrases. Instead of guessing the rumored passphrase, Claude asked which 1990s PRNG could have produced the seeds; four binary seeds have a zero top bit in all 20 words, the signature of lrand48's 31-bit output.
- Lattices for truncated output. The prime-curve seeds keep only the top 8 bits per call, so Claude recovered the 48-bit state with LLL, then ran the generator backwards to an srand48 start whose upper 32 bits are a timestamp.
- Base points too. Six May 1997 curves take their base points from FreeLIP's generator with small seeds such as 20000; the P-224, P-256, P-384 and P-521 base points remain unexplained.
- Loose ends. Viable candidates were skipped in several runs, such as P-256's candidate 876, and the B-163 seed fits nothing tried; the $36,864 bounty goes to the Internet Security Research Group.
quotes
“The seeds were generated in a very simple way: a common pseudorandom number generator initialized from the clock, which anyone can now reproduce.”
“This is not a cryptographic break, new attack, or weakness in the ECDSA curves.”
“As far as we know, no NIST base point has been explained before.”
“We do not know what criteria may have been used, or whether this was an unintentional artifact.”