Claude reveals ECDSA curve origins

Original Article ↗ Hacker News Discussion ↗

Anthropic reports that its Claude model traced the mysterious seeds behind widely used NIST elliptic-curve cryptography parameters to `lrand48` outputs seeded with late-1990s Unix timestamps, undermining long‑standing suspicions of an NSA backdoor. Commenters note this doesn’t mathematically rule out all hidden weaknesses but argue it greatly reduces the plausible “free choice” the seed generators had, making a deliberate trap extremely unlikely. The thread then broadens into concerns about AI labs using powerful but access‑gated models to probe sensitive cryptographic and scientific problems, with many calling for stronger open‑model alternatives and fewer safety guardrails that impede legitimate research.

Origin of the NIST ECDSA Seeds

  • Thread centers on the finding that the P-192, P-224, P-256, P-384, P-521 “seeds” match outputs of lrand48 seeded with Unix timestamps from 1997–1998, rather than hashes of phrases.
  • Some participants find this both amusing and depressing: a supposedly “mysterious” cryptographic choice traces back to a basic C library RNG seeded with the clock.
  • One binary-curve seed (B‑163) and some base point choices remain unexplained; a transcription error or different method is suggested but unproven.

Backdoors, Trust, and NSA/NIST

  • Many argue this greatly weakens long-running theories that the seeds hid NSA backdoors, since the method is now simple and reproducible.
  • Others counter that it only constrains the type of possible backdoor: NSA could have searched over timestamps/iterations and silently selected curves with unknown weaknesses.
  • Debate over how many “bits of freedom” the selection process had, and whether a weakness dense enough to be found with ~2³⁰–2³⁵ trials would imply ECC itself is fundamentally broken.
  • Historical context (export controls, Clipper, DES key length, Dual_EC_DRBG) is cited both to justify skepticism and to argue that these particular curves were probably fine anyway.

Cryptography Practice and Impact

  • Several say the result mostly confirms what specialists already believed: NIST curves are likely safe, though non-rigid parameter choices remain aesthetically and procedurally unsatisfying.
  • Some see this as removing one objection to using P‑256 in systems like Bitcoin/Ethereum, though others note ecosystem inertia, performance advantages, and modern alternatives (e.g., EdDSA curves) still matter more.
  • Suggestions appear to systematically analyze curves from adjacent timestamps and discarded candidates for hidden selection bias.

AI, Guardrails, and Research Culture

  • Strong side-thread on Anthropic’s models: praise for the “relentless” search behavior, but heavy criticism of capability gating, cyber-safety programs, and model downgrades blocking cryptography/biology work.
  • Tension between safety/liability arguments and fears of a widening moat where labs and governments get powerful internal models while the public gets constrained ones; open-weight models are proposed as a counterbalance.
  • Some express unease that LLMs are now solving “fun” open problems, potentially displacing human discovery and muddying credit for prior researchers whose work trained the models.

Skepticism and Evidence

  • A minority suspects coincidence or hidden selection, questioning the choice of weak RNG, sparse dates, and iteration counts.
  • Others respond that matching full 20-byte seeds via lrand48+timestamp is overwhelmingly strong evidence, making alternative explanations extremely unlikely, even if absolute disproof of any backdoor remains impossible.