The NIST elliptic-curve “backdoor seeds” that people argued about for 25 years finally got an answer from Anthropic on October 16: the seeds for curves P-192 through P-521 weren’t hashes of some secret passphrase. They were generated by the lrand48 random number generator in a 1990s C library, using the Unix timestamp at the time as the initial value. The seed for P-256 corresponds to the 1,842nd candidate generated by a generator started at 9:52:34 a.m. Beijing time on August 16, 1997. Anthropic’s internal Claude model found it in under half an hour, and the original author’s publicly released script reproduces it exactly. The team donated the $36,864 bounty to the nonprofit behind Let’s Encrypt.
The answer to the conspiracy theory, in the end, is that someone glanced at a clock. That fits my understanding of engineers.
A few engineering takeaways:
1. Bitcoin and Ethereum use secp256k1, whose parameters are simply a=0 and b=7. There are no seeds involved, so this has nothing to do with your crypto in the first place. P-256 is used for passkeys and secure chips in phones, so smart wallets that sign with passkeys can breathe a little easier.
2. The story isn’t complete, and that should be said too: the source of another seed and the base points for four curves remain unexplained, and the process at the time also skipped some candidates that appeared to meet the criteria. There’s currently no evidence of deliberate weakening.
3. The real lesson for retail investors is the opposite case. Using a timestamp as a source of randomness for public parameters is fine, since those parameters are public anyway; the only requirement is that the process can be explained afterward. Using a timestamp as a source of randomness for private keys is a disaster. The 2023 Milk Sad incident involved an open-source command-line wallet tool using the system time to seed the random number generator that created recovery phrases. Attackers tried every timestamp from those years, and roughly $900,000 was reportedly stolen.
What I do: I only let a hardware wallet or a reputable wallet generate recovery phrases locally. I don’t use online “recovery phrase generators,” and I don’t make up “meaningful” word combinations myself. If you generated a wallet a few years ago using an obscure tool or an old version, check whether that version had any reported random-number vulnerabilities. If it did, create a new wallet and move your assets.
The answer to the conspiracy theory, in the end, is that someone glanced at a clock. That fits my understanding of engineers.
A few engineering takeaways:
1. Bitcoin and Ethereum use secp256k1, whose parameters are simply a=0 and b=7. There are no seeds involved, so this has nothing to do with your crypto in the first place. P-256 is used for passkeys and secure chips in phones, so smart wallets that sign with passkeys can breathe a little easier.
2. The story isn’t complete, and that should be said too: the source of another seed and the base points for four curves remain unexplained, and the process at the time also skipped some candidates that appeared to meet the criteria. There’s currently no evidence of deliberate weakening.
3. The real lesson for retail investors is the opposite case. Using a timestamp as a source of randomness for public parameters is fine, since those parameters are public anyway; the only requirement is that the process can be explained afterward. Using a timestamp as a source of randomness for private keys is a disaster. The 2023 Milk Sad incident involved an open-source command-line wallet tool using the system time to seed the random number generator that created recovery phrases. Attackers tried every timestamp from those years, and roughly $900,000 was reportedly stolen.
What I do: I only let a hardware wallet or a reputable wallet generate recovery phrases locally. I don’t use online “recovery phrase generators,” and I don’t make up “meaningful” word combinations myself. If you generated a wallet a few years ago using an obscure tool or an old version, check whether that version had any reported random-number vulnerabilities. If it did, create a new wallet and move your assets.