The NIST Elliptic Curves Seeds Bounty Has Been Claimed
Source Entity
Hacker News
A team from Anthropic has solved a long-standing cryptographic mystery regarding the origin of NIST elliptic curve seeds. The researchers discovered the seeds were generated using drand48 seeded with timestamps from 1997-98, confirming the integrity of the widely used ECDSA standard.
The Resolution of a Cryptographic Mystery
For decades, the cryptographic community has harbored lingering questions regarding the origins of the seeds used in NIST elliptic curves, a fundamental component of the widely utilized ECDSA (Elliptic Curve Digital Signature Algorithm) standard. These curves, adopted by NIST in 2000 as part of the FIPS 186-2 Digital Signature Standard, have been central to securing global communications, financial transactions, and digital identities. The lack of transparency regarding how these specific seeds were generated led to years of speculation and academic curiosity about potential hidden vulnerabilities.
Unveiling the Source: A Mathematical Reveal
On October 15, 2026, a collaborative team from Anthropic—including researchers John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini, and Steve Weis—officially claimed a three-year-old bounty by solving the riddle. Their analysis confirmed that the seeds were not derived from complex or potentially malicious sources, but rather from the output of drand48 seeded with timestamps originating from 1997–98. This discovery effectively demystifies the generation process, replacing conjecture with verifiable historical fact.
Implications for Global Cryptography
ECDSA is arguably the most pervasive elliptic curve cryptography standard in existence. By confirming that the seeds were created through a standard, albeit dated, pseudo-random number generation process, the researchers have bolstered confidence in the integrity of these curves. The conclusion of this investigation serves as a "fun closing chapter" for the cryptographic community, signaling that the concerns which fueled years of scrutiny have been addressed. There is no call to action for developers or security professionals; the findings suggest that the existing trust placed in these curves by the global research community was well-founded.
The Collaborative Effort and Philanthropic Impact
The successful resolution of this mystery was not a solo endeavor but the result of a collective effort involving numerous contributors, including Chris Palmer, Colm MacCárthaigh, David Adrian, and others. The bounty, which was originally established three years ago to incentivize this research, was claimed and subsequently donated to the Internet Security Research Group (ISRG), the non-profit organization behind Let’s Encrypt. By donating the prize, the team effectively tripled its value to $36,864, demonstrating a commitment to the broader open-source security ecosystem.
Looking Toward the Future of Standards
While this specific mystery is now resolved, the episode highlights the importance of transparency in cryptographic standards. In the future, the lessons learned from this investigation will likely influence how organizations like NIST approach the public documentation of parameter generation. As cryptography evolves to meet the challenges of the post-quantum era, maintaining this level of rigorous, community-verified transparency will remain essential to ensuring the long-term security of the digital infrastructure that relies on these foundational algorithms.