Claude reveals ECDSA curve origins

What it claims

All ten NIST/ANSI X9.62 prime-curve seeds and four of the five NIST binary-curve seeds (B-233, B-283, B-409, B-571) are reproducible from srand48/lrand48 output. Each recovered 48-bit state regenerates its full 160-bit seed, which the authors say cannot happen by chance. The prime-curve clock values fall between May 1997 and April 1998. The binary-curve values read as February 1984. Doubled, they give April 17, 1998, two weeks after the P-224 run, which suggests the program may have halved the clock. Six base points come from the FreeLIP zrandom generator with small integer seeds:

• P-192: 20000
• prime239v1–v3: 20420, 20507, 20509
• prime192v2, prime192v2: 20512, 20517

The authors say no NIST base point had been explained before. The work took Claude under half an hour, prompted without the "humorous passphrase" clue.

How it works

1. Signature scan. A scanner slid bit by bit along each seed, testing 34 generator/output-slice combinations for consecutive outputs of a 1990s C-library PRNG.
2. Binary seeds. Four of the ten seeds had the top bit clear in all 20 of their 32-bit words, which has a 1/5810 chance. That matches lrand48, which returns the top 31 bits of a 48-bit state. Brute-forcing the 2¹⁷ hidden bits of the first word and checking the next four recovered the state.
3. Prime seeds. These keep fewer bits per output (lrand48() >> 23). Recovering the state is a truncated-LCG lattice problem solved with LLL, run over every bit window.
4. Back to the seed time. The LCG was stepped backwards to a state with low 16 bits 0x330E, the form srand48 sets. That form recurs every 65,536 steps, so it proves nothing alone. The evidence is that every hit decodes to a plausible 1997–98 timestamp.
5. Candidate order. Each 20-byte draw is one candidate seed. P-256 is candidate 1842 of the run seeded 1997-08-16 01:52:34. P-224 is candidate 7026 of the run seeded 1998-04-03 12:52:07.
6. FreeLIP base points. The recipe: - state ← state·3¹²¹ mod (2¹⁰⁷−1); - discard seven 26-bit draws; - build x from (limbs of p + 1) 26-bit limbs, reduce mod p; - accept x when x³−3x+b is a quadratic residue.

How to use it

The page publishes two self-contained Python scripts under CC0 1.0:

• Seed script: prints all 14 recovered seeds from a timestamp/index table.
• Base-point script: checks the six FreeLIP base points. Each matches the published Gx within 1–5 tries.

The authors state there is "no action to be taken": this is not an attack or weakness, and they say it makes backdoor claims less plausible. The $36,864 bounty organised by Filippo Valsorda is being donated to ISRG.

Limits

• Skipped viable curves. Some candidates that also yield valid curves were passed over, and the criteria are unknown:
• P-256: candidate 876 also yields a prime-order curve of the right size, built the same way.
• P-224's run skipped three such curves.
• The ANSI X9.62 runs skipped seven more.

The authors argue the small count makes selecting weak curves implausible. They concede that searching over timestamps for a specific property is conceivable in principle, and that nothing in the numbers shows how many runs there were.

• Binary timestamps are tentative. The halved-clock reading is flagged "if that reading is right."
• Still unexplained:
• the B-163 seed;
• the base points of P-224, P-256, P-384 and P-521;
• all NIST binary-curve base points.