Claude reveals ECDSA curve origins

What it is

Anthropic's Frontier Red Team explains where the NIST/ANSI X9.62 prime-curve seeds came from. They are 20-byte slices of lrand48 output seeded with a Unix timestamp, not hashes of a passphrase. The page says this is not an attack and that no action is needed. It is useful as a reproducible provenance result, and the code can be checked independently.

How it works

The generator seeded srand48(t) and drew 20-byte candidate seeds consecutively. It stopped at candidate n, the first that gave an acceptable curve. For the prime curves, each output is lrand48() >> 23, giving one byte per call. The page's code uses x = (t<<16)|0x330E, x = 0x5DEECE66D*x + 0xB mod 2^48.

Recovered parameters (UTC, from the page's code):

The binary curves B-233, B-283, B-409 and B-571 decode as srand48(t/2), with 5 words per candidate. Their implied times are 1998-04-17, 15:24–15:32. The page flags this "halved clock" reading as conditional ("if that reading is right").

Discovery path: a scan for weak-PRNG signatures noticed that the top bit was zero in every word of some seeds, which points to lrand48's 31-bit output. Brute-forcing the 17 hidden bits recovered the state for those seeds. For the truncated prime seeds, LLL lattice reduction was run over every bit window. The state was then stepped back until the low 16 bits equalled 0x330E, the srand48 signature. Reaching that form is a 1-in-65,536 event, so the finding rests on every result also being a plausible 1997–98 timestamp.

Base points for six curves (P-192 and prime192v2/v3, prime239v1–v3) come from the FreeLIP/early NTL generator:

flowchart TD
    A[zrstarts seed] --> B[7 single-limb draws, discarded]
    B --> C[draw limbs of p plus 1, 26 bits each]
    C --> D[x mod p]
    D --> E{x^3-3x+b is a square mod p?}
    E -- no --> C
    E -- yes --> F[x is Gx]

State update is state*3^121 mod (2^107-1). The generator seeds are 20000 (P-192), 20420, 20507 and 20509 (prime239v1–v3), and 20512 and 20517 (prime192v2 and v3). The page's code reproduces each published Gx, after 1 to 5 tries.

What to do

Nothing operationally, per the authors. If you want to verify the claim, run the page's two CC0 Python scripts, which print the seeds and check Gx for the six FreeLIP-derived curves.

Caveats

• Still unexplained: the B-163 seed, and the base points of P-224, P-256, P-384 and P-521 and of the binary curves.
• Some viable candidates were skipped: P-256 candidate 876 also gives a prime-order curve, P-224's run passed over three, and the two ANSI example-curve runs passed over seven. The selection criteria are unknown, and it may be an artifact.
• The authors argue that few skipped curves makes deliberate weakening implausible. They concede that searching over timestamps for a chosen property remains conceivable, and that nothing shows how many runs there were.
• The "more confident there is no backdoor" conclusion is the authors' judgment, not a proof.