NIST Elliptic Curve Seeds Found to Be drand48-Derived; Bounty Claimed

A long-standing question has been settled: how the “seeds” for NIST-standardized elliptic curves were generated. According to a report from words.filippo.io by FiloSottile, posted on Lobsters, John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini, and Steve Weis, all affiliated with Anthropic, derived the solution. At 01:07:51 UTC on October 15, 2026, the full bounty announced three years earlier was claimed.

The bounty was offered by Filippo Valsorda, who runs filippo.io. The result was published on his blog. The core is captured in the following sentence:

The seed was not a hash of some provocative text, but the output of drand48 initialized with a timestamp.

NIST Elliptic Curve Seeds Are Solved

The issue concerned the seeds for the elliptic curves that NIST published in 2000 in FIPS 186-2. The targets are five curves: P-192, P-224, P-256, P-384, and P-521. They were described as generated according to ANSI X9.62 by hashing an arbitrary seed with SHA-1 and deriving the parameters from its output. However, how that arbitrary seed was chosen had not been made public.

Long told was the theory that Jerry Solinas, who died in early 2023, generated it in 1997 by hashing an English sentence and later forgot the sentence. Steve Weis’s article and the original bounty announcement also describe this background. But memory can fail anyone. The actual seeds had been generated with the POSIX-standard drand48 random number generator.

How Seeds Were Generated with drand48

The algorithm is simple. First, the UNIX timestamp of the time is passed to srand48(). Then bytes are generated one at a time with drand48. The resulting 20-byte sequence is tried as a seed in accordance with ANSI X9.62, and if the generated curve is not valid, it is rejected. Some timestamps were used to generate multiple curves by continuing trials after adopting the first seed.

Because it is a time-dependent random number, each curve’s seed can be reproduced from the timestamp at the time of generation. The 1997–1998 timeframe is also consistent with this method.

Reimplementation in Go and Actual Verification

Valsorda reimplemented this algorithm in Go and verified the claim. Reproducing the computation confirmed that the published seeds match drand48’s output. The details are compiled in an Anthropic explanatory article.

Verification through reimplementation supports the conclusion as a reproducible fact, not mere speculation. In discussions about the provenance of cryptographic parameters, this reproducibility is decisive.

The Second Criterion Left Unexplained

However, not everything has been solved. In addition to the ANSI X9.62 criteria, two undocumented selection conditions exist. One is relatively clear: reject the seed if the bit length of the generated curve’s order n exceeds the bit length of the underlying field p. It is important that this is not the stricter condition n < p. This is because prime239v2 satisfies p < n < 2^239.

This condition leaves roughly twice as many valid seeds as the published curves. For this last part, multiple explanations were considered, but none matched. The same random number generator may have also been used to validate seeds, consuming random output and skipping some candidates, but those “gaps” are not regular. Alternatively, a bug in either algorithm may have caused an incorrect result to be returned half the time. What once required enormous computation can now be run in minutes with commercial software.

Bounty Claimed and Donated to ISRG

The team that derived the solution chose to donate the bounty to ISRG. ISRG is the nonprofit organization that operates Let’s Encrypt. Thanks to donations, the prize grew threefold, to $36,864 (36 Ki$).

The bounty was funded by Amir Omidi, Chris Palmer, Colm MacCárthaigh, David Adrian, David Anderson, Jeff Hodges, Matt Green, Matthew McPherrin, Paul Kehrer, Ryan Sleevi, and Soatok. It represents broad support from the cryptography community.

Trust in Cryptographic Primitives and Its Impact

This discovery can be regarded as filling in a page in the history of cryptography. NIST elliptic curves are used in a wide range of applications including TLS and digital signatures, and the fact that their generation process has become verifiable reinforces trust in foundational technology. The fact that the seeds were generated not from an arbitrary sentence but from time-based random numbers does not constitute a direct refutation of the so-called backdoor suspicions. Even so, it provides material for increasing the transparency of parameter derivation.

On the other hand, the fact that one undocumented selection criterion remains shows that it cannot be said to be fully explained. Since the details of the implementation at the time have been lost, this kind of verification will continue to leave parts that must rely on speculation.

The trend of valuing open specifications and implementation provenance is not limited to cryptography. In the semiconductor field as well, there are moves to disclose implementation details, such as Tenstorrent’s release of GCC patches for the RISC-V core “Ascalon XG”. The stance of not leaving unexplainable constants affects the credibility of standardization across fields.

Editorial Opinion

In the short term, we expect stronger moves to demand records of generation processes in audits of cryptographic libraries and reviews of standardization documents. This is because standards that leave unexplainable constants create ongoing verification costs even if there is no actual harm. The longer a standard continues to be used, the greater the impact.

In the long term, how to record and publish the provenance of cryptographic primitives will emerge as a design issue for the standardization process. There may be a need for mechanisms to preserve them in a form traceable to the random numbers and timestamps used for generation. This will also affect the document management practices of standards organizations.

As a question from the editorial team, we want to consider together with readers how many other constants standardized in the past remain without documented rationale. Should ensuring verifiable provenance not be a principle that applies broadly, not only to cryptography? The right of developers to know the origin of the constants they depend on should become even more important going forward.

References

• “The NIST Elliptic Curves Seeds Bounty Has Been Claimed”, by words.filippo.io by FiloSottile — Lobsters, 2026-10-16T20:18:36.000Z (ARR)
• Source URL: https://words.filippo.io/seeds-solved/