P-256: Anthropic's AI cracks the secret behind the NSA's curves, a 1997 clock

On October 15 at 1:07:51 a.m. (UTC), a team claimed the bounty offered by cryptographer Filippo Valsorda. It supplied the answer to a 25-year-old puzzle: the origin of the "seeds" of the NIST elliptic curves, including the famous P-256, which still protects a large share of HTTPS connections and electronic signatures.

The team includes ten Anthropic researchers, among them Nicholas Carlini and Steve Weis. On October 16, the company published details of the discovery. According to Anthropic, most of the work was done by "an internal research model" of Claude, its AI, which is not named more precisely.

Numbers supplied without explanation

These curves were standardized in 2000 in the FIPS 186-2 signature standard. To prove they had not been chosen with a hidden weakness, each one was derived from a seed run through the SHA-1 hash function. But these seeds came from the NSA, with no explanation. Jerry Solinas, the former agency employee said to have produced them, thought he had hashed a joke phrase. He died in 2023 without anyone finding it.

That same year, Filippo Valsorda launched a $12,288 bounty, tripled if the winner donated it to a charity. Several Anthropic employees had already looked for the phrase, without success.

A clock rather than a phrase

According to Anthropic, an employee put the question to the model without hinting at the phrase theory. The model assumed that a weak pseudo-random number generator, common in 1990s C libraries, had been used. A sweep revealed the signature of the rand48 family. The model then reconstructed the generator's internal state and ran it backward to its starting point. Anthropic says the search took less than half an hour.

The result is prosaic. Each seed comes from a generator initialized with the computer's clock time. For P-256, that is August 16, 1997, at 1:52:34 a.m., and the 1,842^nd value produced. The other curves point to dates ranging from May 1997 to April 1998. Anthropic is publishing a program that reproduces the seeds. Filippo Valsorda writes that he reimplemented the algorithm to check the answer.

Does anything need to change?

No, according to Anthropic, which writes that this is not a "cryptographic break, a new attack or a weakness." The result even rules out a theoretical scenario. In 2017, cryptographers Bernstein and Lange had described how about 70 bits of freedom in choosing a seed could be used to target a hypothetical family of weak curves. With a clock, the NSA would have had, according to Filippo Valsorda, "barely 30 bits of freedom": too few for that.

Not everything is resolved. The process produces about twice as many valid candidates as were selected. For P-256, the 876^th value would also have worked, and no one knows why it was discarded. A rejection criterion remains unexplained. So do the seed of the B-163 curve and the base points of P-224, P-256, P-384 and P-521. Finally, Anthropic acknowledges that it remains conceivable in principle that these curves were chosen for a particular property: nothing in the numbers shows how many attempts were made.

As for the exact contribution of the AI, only Anthropic describes it: neither the model nor the exchanges are published. The $36,864 bounty will go to ISRG, the nonprofit that runs Let's Encrypt. Valsorda, for his part, enjoys the timing: the puzzle is solved "just in time" for these curves to be replaced by post-quantum signatures.