The secret origin of the ECDSA curves

“The Reality: It’s just timestamps.”

That is how the report Anthropic published on 16 October 2026 begins, and with that sentence a twenty-five-year argument closes. The seeds used to build the elliptic curves that protect almost all internet traffic were not a hash of a funny sentence, nor a secret algorithm: they were the output of lrand48 —the pseudorandom generator that shipped with the C library of any Unix box in the nineties— seeded with the clock.

A srand48(time), twenty bytes per candidate, and whichever one passed the filter became the standard seed.

The story is worth telling, because the value is not in the result but in how it was reached. And because the result is good news.

The envelope of seeds

In 2000, NIST adopted FIPS 186-2, the digital signature standard: P-192, P-224, P-256, P-384 and P-521. For each curve, the standard published a 160-bit seed whose SHA-1 hash defines the coefficient b, following the ANSI X9.62 procedure.

The seeds were supplied by the NSA. With no mathematical justification. No explanations. No word on where they came from.

The scheme is called nothing up my sleeve, and the idea is sound: if you cannot choose the parameters, you cannot hide a weakness inside them. But the promise has a hole: the seed is published, yes, but the seed itself can be anything. The hash proves the curve was derived from that number; it proves nothing about how the number was chosen.

Twenty-five years of suspicion

The official rumour was that they were the hash of an internal military joke. The most quoted version came from Jerry Solinas himself, a longtime NSA employee, in 2015:

“I believe there was a counter rather than multiple hashing, but I don’t know details. The message was along the lines of ‘Give Bob and Jerry a raise’ or ‘Bob and Jerry rule’ or something like that. It was Bob Reiter who actually wrote the code, and he doesn’t remember the details either. Nor were we able to find archives from so long ago. If they exist, they are no doubt sitting on a hard drive near the Ark of the Covenant.”

— Jerry Solinas, former NSA employee, 2015

Solinas died in 2023 without being able to clear it up. Koblitz and Menezes published A Riddle Wrapped in an Enigma (2015), arguing it was implausible to hide a weakness that survived fifteen years of cryptanalysis —while also recording the opposite objection: Bernstein and Lange described to them a technique that could have used 70 bits of freedom in the choice of the seed to target a hypothetical class of weak curves. Bernstein is the author of Curve25519, the competing curve.

In 2023, Filippo Valsorda put money on it: a bounty for anyone who could find the origin. Three years later, nobody had claimed it.

Half an hour

In October 2026, a curious Anthropic employee asked an internal research model whether it could figure out how those seeds had been generated, on one condition: without giving it the hint about the humorous phrase. Several employees had already chased that hint with no luck, and it was false.

In under half an hour, the model found the origin of the five NIST seeds. It was no hash at all.

The transcript kept a lovely detail: the moment the model grows suspicious of what it is looking at.

“Hmm wait. Let me be skeptical: am I in some sort of simulated environment? … 160-bit match from a 32-bit seed + small index: no chance coincidences (10 × 160 bits). It’s real.”

How to solve a mystery from 1997

Think like the nineties

Instead of looking for what message had been hashed, the model tried to anticipate how the software must have worked. The code was written in the late nineties, in C: odds are they used a standard pseudorandom generator from the libraries of the time. And those generators are so weak that their output can be recognised.

The method was a scanner that crawled along each published seed, bit by bit, testing whether adjacent chunks behaved like consecutive outputs of a nineties generator: 34 combinations of generator and output slice.

The top bit is always zero

In four of the ten seeds, the top bit of every word was zero. Every time. The odds of that happening by chance are 1 in 5,810, and it is not chance: it is the exact signature of lrand48, a linear congruential generator that only returns the top 31 bits of a 48-bit state.

For the prime curves, which exposed fewer bits of each output (they were truncated), recovering the internal state is a textbook lattice problem, solved with the LLL algorithm. The proof that the trick was right: every recovered 48-bit state regenerates all 160 bits of its seed, and that does not happen by accident.

Rewind the clock

A linear congruential generator runs backwards just as easily as forwards. For each seed, the model stepped the state back to the shape srand48 would have left when initialising it: the low 16 bits equal to 0x330E. That state comes up once every 65,536 steps, so reaching one proves nothing on its own.

What proves everything is the next step: for the ten prime-curve seeds, every initialisation was a Unix timestamp between May 1997 and April 1998. Nobody had chosen anything. Someone had run a program, and the program read the clock.

The NSA’s big secret

No hidden hashes. No passwords. Everything came out of a computer’s clock, and it can be reproduced today in six lines of Python:

Curve	srand48(t) (UTC)	Accepted candidate
prime239v1	1997-05-15 15:49:03	2185
prime239v2	1997-05-15 15:49:03	2320
prime239v3	1997-05-15 15:49:03	3048
P-192 (prime192v1)	1997-05-18 14:45:34	139
prime192v3	1997-05-18 14:45:34	5228
prime192v2	1997-05-18 14:45:34	6013
P-521	1997-08-08 01:12:04	1136
P-256 (prime256v1)	1997-08-16 01:52:34	1842
P-384	1997-08-30 14:50:08	2688
P-224	1998-04-03 12:52:07	7026

Look at the dates: three example curves came out of a single run on 15 May; P-192 and two others out of a run on the 18th. P-224, the last curve to reach the standard, is also the last seed. These are the working hours of a group of people, not those of a cover operation.

And the kicker: the four binary-curve seeds, read as timestamps, came out as February 1984. Doubled, they landed on 17 April 1998, two weeks after P-224. The program was probably halving the clock.

As a bonus, the base points (G) of six curves came from another standard library: FreeLIP, Arjen Lenstra’s long-integer package. You seed it with a small number (20000 for P-192), throw away seven outputs, and try 26-bit coordinates until one lands on the curve.

Expectation vs. reality

The whole theory rested on a reasonable instinct: if someone hands you cryptographic parameters without explaining their origin, the healthy response is to distrust them.

But reality turned out far duller than the myth, and that is exactly the proof: nobody builds a backdoor that clumsy.

What about my cryptocurrency?

This story is about the ecosystem, not the chains. It is worth separating two worlds that get confused all the time.

Bitcoin is not affected. It does not use NIST curves: it uses secp256k1. And that is the fundamental difference. Satoshi chose a curve with simple, public parameters precisely so he would not have to trust anyone: a = 0, b = 7, a prime p with a clear and justifiable mathematical shape, no secret seed and no opaque process behind it. Anyone can verify that those numbers produce a secure curve of prime order. Ethereum took the same road: secp256k1, not P-256.

Monero neither. It uses neither secp256k1 nor P-256: it uses Ed25519, another family, with no seeds.

P-256 (secp256r1) is the one that really is everywhere, and the one that carried the suspicion for twenty-five years:

Domain	Concrete use
Internet / Web	TLS/HTTPS, most secure connections, digital certificates
Modern authentication	Passkeys / WebAuthn / FIDO2
Apple	Secure Enclave (iPhone, Mac, Apple Pay, Face ID / Touch ID)
Android	StrongBox / Keystore, hardware-protected keys
Government and enterprise	FIPS 140, HSMs, smart cards, official digital signatures
Browsers and operating systems	Chrome, Firefox, Windows, macOS, iOS (native support)
Other protocols	JWT, OAuth, DNSSEC, identity systems

So: every time you looked at the padlock in your browser, this seed was there. That is why it matters that it is boring.

Is this proof there are no backdoors?

Not quite, and it is worth saying so before stamping the case closed.

This is not an absolute mathematical proof that the curves have no backdoors. What it shows is more specific and more useful: that the seeds were generated in a banal, reproducible way with very little room for choice. It makes a deliberate backdoor enormously less plausible, and it settles the main suspicion that hung over these curves for more than twenty-five years.

The core argument is one of counting. Even being generous —assuming the NSA could have picked any timestamp from 1997–98 and any of the first 16 candidates, which more than covers the skipped ones— they would have had barely 30 bits of freedom. That is not enough to aim at a hypothetical class of weak curves, nor to embed a NOBUS backdoor (nobody but us: only we can open it). The 70-bit technique from Bernstein and Lange is ruled out.

And some loose ends remain, which the report lists:

• Skipped candidates. For P-256 the published seed is candidate 1842, but candidate 876 of the same run also produced a valid prime-order curve. There are candidates to spare: roughly twice as many valid seeds as were published. It could have been an undocumented criterion, or a bug that returned the wrong result half the time. In 1997 these calculations were state of the art; today they take minutes.
• A lost seed. B-163 fits no pattern anyone has tried.
• Missing base points. The base points of P-224, P-256, P-384 and P-521 do not follow the FreeLIP recipe.

None of the three is an alarm. They are, literally, the questions left open once the big one was answered.

Case closed

The $36,864 were donated in full to the Internet Security Research Group, the non-profit behind Let’s Encrypt. Valsorda had tripled the value of the bounty; the Anthropic team (John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini and Steve Weis) claimed it on 15 October 2026 at 01:07:51 UTC.

The symmetry explains itself: the money put up to find out where P-256 came from ended up funding the infrastructure that issues certificates with P-256. Valsorda summed it up with a perfect irony: the rehabilitation of the NIST curves arrives “just in time for them to be retired in favour of post-quantum signatures”. Today he recommends them over Curve25519 —a curious reversal for the side that spent a decade accusing them.

And to close, what interests me about this story. For twenty-five years, the P-256 seed was right there, published in the standard, verifiable by anyone. Nobody verified it, because nobody knew what to look for, and because the hash proved the derivation but not the choice. Trust was verifiable in theory, and for that very reason nobody verified it.

It took someone —or something— with the patience to ask how a program is written, instead of which sentence a man forgot. Verification is not a signed document you file away: it is work that can be redone. And sometimes it has to be redone, twenty-five years later, for the answer to be worth what it would have been worth on the first day.