> ## Content Index > Fetch the complete content index at: https://www.dailyferment.com/llms.txt > Use this file to discover other available public pages before exploring further. # NIST's curve seeds were timestamps. No record said so. - URL: https://www.dailyferment.com/nist-ecdsa-curve-seeds-timestamps-no-record/ - Published: 2026-10-18T04:00:00.000Z - Updated: 2026-10-18T03:59:59.000Z - Description: The NIST curve seeds that fed 25 years of backdoor theories came from a 1990s random number generator started from the clock. The answer was always in the numbers. No record of it ever turned up. - Author: Rana Bilal Zafar - Tags: Engineering, #reframe The seed behind P-256, one of the NIST elliptic curves used for digital signatures, was the 1842nd output of an old C library random number generator, `lrand48`, started from the computer's clock. Anthropic published that on 16 October, along with the same answer for P-192, P-224, P-384 and P-521\. The timestamps point to dates between May 1997 and April 1998\. A Claude research model found the method in under half an hour. It is, in the post's words, "not a cryptographic break, new attack, or weakness in the ECDSA curves." Nobody needs to change anything. What I keep thinking about is the other date in the story. In September 2019, answering a freedom of information request from Steve Weis about where those seeds came from, NIST wrote that it had "no documents that are responsive." Weis is one of the people credited on this week's post. The answer took seven more years and was read out of the numbers themselves, because no record of how they were made had ever turned up. So the question: how do you show a random number wasn't chosen, and why did this one take more than 25 years? **1842**iterations of lrand48 to reach the P-256 seed **1997 to 1998**dates the timestamps point to **2019**NIST FOIA answer: "no documents that are responsive" **$36,864**bounty, donated to the Internet Security Research Group Sources: Anthropic research post, 16 Oct 2026; MuckRock FOIA request to NIST, 2019. ## What exactly was found? NIST adopted ECDSA in 2000, with curve seeds supplied by the NSA and no explanation. The best story for years, according to Anthropic, was that Jerry Solinas at the NSA had hashed a humorous passphrase. "That turned out to be wrong." Solinas died in 2023, so there was nobody left to ask. The method Claude found was plainer: a loop drawing 20-byte candidates from `lrand48`, seeded with a Unix timestamp. P-256's seed came out on iteration 1842\. Oddly, a few valid candidates along the way, such as number 876, were skipped, and the post says nobody knows why. It also explained six base points. It did not explain the base points for P-224, P-256, P-384 or P-521, or the seed for the binary curve B-163\. The team published code under CC0 that regenerates the seeds, and the $36,864 bounty for finding them goes to the Internet Security Research Group. ![Timeline: seeds drawn from lrand48 started from the clock between May 1997 and April 1998; NIST adopts ECDSA in 2000 with seeds unexplained; September 2019 FOIA answer of no responsive documents; 16 October 2026 the method is rebuilt from the numbers alone. Still unknown: how many runs there were](https://storage.ghost.io/c/d7/b7/d7b77195-48c5-45ab-8688-51750879d1d6/content/images/2026/10/df55-timeline.png) From draw to explanation. Sources: Anthropic, 16 Oct 2026; MuckRock FOIA request to NIST, 2019. ## My first reaction, and the check My first reaction was relief, followed by a slightly smug thought: all those backdoor theories, and it was the clock. That doesn't hold up. Unexplained constants from the NSA had form. The DES S-boxes were supplied with no explanation and, as the Wikipedia history puts it, "turned out to be far from random", chosen to make the cipher resist differential cryptanalysis. That time the hidden choice made the cipher stronger. Dual\_EC\_DRBG went the other way: its constants drew criticism in 2007, and later leaks suggested a backdoor. Treating the P-curve seeds with suspicion wasn't paranoia. It was a reasonable reading of the record. And the reconstruction has one gap the post states plainly: "Nothing in the numbers shows how many runs there were." You can now see the program. You can't see whether it was run once or many times with different start times until someone liked the result. The post says the findings make a backdoor "much less plausible." Less plausible is the most the numbers alone can give. Guess first: how long did it take Claude's research model to work out how the NIST seeds were made, once it was asked? **Under half an hour**, by Anthropic's account. The method had been sitting in the numbers for more than 25 years. ## Who already does this well? ![Three white dice stacked against a dark background](https://storage.ghost.io/c/d7/b7/d7b77195-48c5-45ab-8688-51750879d1d6/content/images/2026/10/df55-dice.jpg) Photo by [Callum Mullin](https://unsplash.com/@cmbgraphicdesign?ref=dailyferment.com) on [Unsplash](https://unsplash.com/photos/three-white-dice-stacked-against-a-dark-background-Uyq11l%5FFH-0?ref=dailyferment.com) California puts candidates on the ballot in a random alphabet order. On 12 March 2026, under Elections Code section 13112, staff in the Secretary of State's Elections Division drew the letters for the June primary "in a lottery-style drawing, with witnesses from the press observing virtually." A recording went up on YouTube. The order started Q, T, P, W, Z. Nobody will ever need to reverse-engineer that alphabet. Q, T, P is no more random than a hash output. What the drawing adds is a record of the one thing the letters themselves can't show: that it happened once, at a stated time, in front of people with no stake in the result. In both cases the number is cheap. The expensive, trust-making part is the record of the draw. California spends one short drawing and a video upload on it. NIST's process left nothing anyone has found, and the bill came as decades of doubt. Two random draws #### California ballot alphabet, 2026 - *The output*Q, T, P, W, Z... - *Record of the draw*Held in public, press watching, video online - *How many runs*Once, at a stated time - *Cost of doubt*None needed #### NIST curve seeds, 1997 to 1998 - *The output*20-byte seeds - *Record of the draw*None found; NIST had no responsive documents in 2019 - *How many runs*Unknown: "Nothing in the numbers shows how many runs there were" - *Cost of doubt*More than 25 years of suspicion Sources: California Secretary of State, 12 Mar 2026; Anthropic, 16 Oct 2026; MuckRock. ## What does this mean beyond cryptography? Plenty of systems run on numbers someone generated once: random audit samples, seeds in simulations, the order of a lottery for school places, the shuffle in a clinical trial's allocation. In each, "it's random" is a claim about a process, and the process is gone the moment it ends unless someone records it. I wrote on 8 October about [hijacked registries minting real Google certificates](https://www.dailyferment.com/cctld-registry-hijack-google-certificates/), another case where a valid-looking output told you nothing about how it came to exist. Same shape, different layer. ## How sure am I? Established The method and its limits as Anthropic published them, NIST's 2019 answer, and California's procedure as the Secretary of State describes it. Inferred That a simple record made in 1997, the program and the start time, would have ended this long ago. Guess That the missing count of runs is what will keep a small amount of suspicion alive among people who were already suspicious. The claim, in one sentence A random number earns trust from a record of how it was drawn and how many times, not from looking random, and the NIST seeds came with no such record, so the price was more than 25 years of suspicion. What I can't tell from here is whether that record ever existed and was lost, or was never kept. The FOIA appeal has no decision in the file I read. ## Sources - Anthropic, [Claude explains the origins of the NIST ECDSA curve seeds](https://www.anthropic.com/research/ecdsa-curve-origins?ref=dailyferment.com), 16 October 2026. - MuckRock, [Origin of FIPS 186-4 elliptic curves over prime field seed parameters (NIST)](https://www.muckrock.com/foi/united-states-of-america-10/origin-of-fips-186-4-elliptic-curves-over-prime-field-seed-parameters-national-institute-of-standards-and-technology-78756/?ref=dailyferment.com), request by Steve Weis, 2019. - Wikipedia, [Nothing-up-my-sleeve number](https://en.wikipedia.org/wiki/Nothing-up-my-sleeve%5Fnumber?ref=dailyferment.com). - California Secretary of State, [Results of the randomized alphabet drawing for the June 2, 2026, Primary Election](https://www.sos.ca.gov/administration/news-releases-and-advisories/2026-news-releases-and-advisories/california-secretary-state-shirley-n-weber-phd-announces-results-randomized-alphabet-drawing-june-2-2026-primary-election?ref=dailyferment.com), 12 March 2026.