THE NSA’S MYSTERY CURVE SEEDS WERE A 1997 CLOCK — AN ANTHROPIC TEAM AND CLAUDE TRACED ALL FIVE — BITCOIN’S CURVE NEVER HAD A SEED TO EXPLAIN

For almost three decades, five numbers sat under some of the most-used encryption on the internet. The NSA supplied them in the late 1990s as the “seeds” for NIST’s P-192, P-224, P-256, P-384 and P-521 curves, and nobody could say where they came from. Cryptographers wondered if they hid a back door. In 2023 Filippo Valsorda put up a bounty for anyone who could explain them.

A team at Anthropic claimed it on October 15. Per Anthropic’s write-up, an internal Claude research model worked it out “in under half an hour.” The seeds came from lrand48, an old C random-number generator, started from Unix clock times in 1997 and 1998. P-256’s came from August 16, 1997. Valsorda wrote that the findings “completely rule out the technique described by Bernstein and Lange,” the main back-door theory, and that the NSA had “barely 30 bits of freedom.” The $36,864 bounty went to the nonprofit that runs Let’s Encrypt.

Anthropic is careful about what it isn’t: “This is not a cryptographic break, new attack, or weakness in the ECDSA curves.” Some of it is still open, like why some good candidate seeds were skipped and how the curves’ base points were made.

Bitcoin never had to wait for the answer. Its curve, secp256k1, isn’t one of the five, and it has no seed at all. It’s y² = x³ + 7 over a fixed prime, numbers anyone can check. Satoshi never said why he picked it. The NIST seeds turned out to be a clock. Bitcoin’s curve never asked anyone to trust one. At the time of this writing, bitcoin was $81,382.