Anthropic says one of its Claude AI models has answered a question that cryptographers, the experts who design the math that keeps data secure, had puzzled over for decades. In a post on Oct. 16, the company says an internal research model found, in under half an hour, how the starting numbers were made for five standard elliptic curves, the mathematical shapes a U.S. government signature standard is built on, known as P-192, P-224, P-256, P-384 and P-521.
Those curves belong to ECDSA, a method for making digital signatures that Anthropic calls the most widely used standard built on elliptic curves. Digital signatures are used to detect unauthorized changes to data and to confirm who signed it. NIST, the U.S. standards agency, adopted ECDSA in 2000 as part of its Digital Signature Standard. Part of each curve was built from a published starting number, called a seed, that the National Security Agency supplied with no explanation. Because nobody could say where the seeds came from, some people wondered whether they had been picked to hide a deliberate weakness. Most researchers already trusted the curves, Anthropic says.
The old story was that an NSA employee, the late Jerry Solinas, made the seeds from a joke phrase, and several Anthropic employees had chased that lead without success. Asked to work it out without that clue, Claude found that the seeds were simply the output of a basic random number generator that came with 1990s programming libraries, Anthropic says. Such a routine turns one starting value into a stream of numbers that look random, and here the starting value was the computer's clock at moments between May 1997 and April 1998, so anyone can now reproduce the seeds. Anthropic says this is not a break or a new attack on the curves, and that it makes the company more confident they were chosen without hidden weaknesses.
Filippo Valsorda, who organized a bounty for the answer three years ago, says he rebuilt the method in his own code to verify the claim. Valsorda says Anthropic's team chose to give the prize to the Internet Security Research Group, the nonprofit that runs Let's Encrypt, a choice that tripled its value to $36,864.
Anthropic says Claude also worked out the seeds for four of five related curves of a second type, but the fifth, B-163, fits nothing it tried. It also doesn't know how the fixed starting point on each curve, which every key is built from, was picked for P-224, P-256, P-384 and P-521, or for the curves of the second type. The generator produced some other possible seeds that would have made working curves but were passed over, and neither Anthropic nor Valsorda can say why; Valsorda suggests it may have been a bug in software that was cutting-edge in 1997. Anthropic says so few were skipped that it is not plausible weakened curves were chosen on purpose, though it says picking curves by trying many clock times is still possible in principle. Valsorda writes that even if the NSA had been free to pick any moment in 1997 and 1998 and any of the first 16 working candidates, it would have had too little room to steer the curves toward a small, hypothetical kind of weak curve, or to plant a backdoor, a secret way in that only its makers could use.