NIST curve origins gain a reproducible check after Claude’s reconstruction
Cryptographer Filippo Valsorda has independently reproduced the process behind NIST elliptic-curve seeds in Go after Anthropic’s reconstruction. Timestamp-seeded pseudorandom generation replaces the old suggestion of forgotten English phrases. His technical account identifies an additional rejection condition while leaving some skipped candidates unexplained, adding a reproducible check to a long-running question about how cryptographic parameters were chosen.
Artificial Intelligence··Night
A timestamp initializes the curve-seed generator
The origins of starting values used in NIST cryptographic curves have been reconstructed through a timestamp-seeded pseudorandom process. Cryptographer Filippo Valsorda published his independent Go implementation on October 16, following work by Anthropic’s Claude team. NIST, the US National Institute of Standards and Technology, standardized the curves in 2000; the unexplained selection of their starting values had prompted concern about possible hidden weaknesses.[1], [2]
Independent code finds another rejection condition
Valsorda’s reconstruction starts a standard pseudorandom generator with a timestamp and tests successive groups of 20 bytes as candidates. Some timestamps yield several curves when the sequence continues after the first accepted candidate. An additional rule rejects a candidate when its curve order has a greater bit length than the base field. Even then, approximately twice as many valid candidates remain as were published.[1]
The remaining rejection mechanism is unresolved. Valsorda discusses use of the same generator during validation or a historical implementation bug as possible explanations. His independent implementation makes the reconstructed generation procedure reproducible while keeping that remaining question open.[1]
The bounty goes to the group behind Let’s Encrypt
Anthropic’s team claimed the bounty Valsorda had opened three years earlier on October 15 and chose to donate it to the ISRG, the organisation operating the certificate service Let’s Encrypt. That decision tripled the amount to 36,864 dollars. Valsorda argues that the reconstructed process leaves insufficient selection freedom to deliberately target a particular hypothetical class of weak curves.[1]
