- Trending
- Comments
- Latest
The controversy dates to the late 1990s, when cryptographers developed elliptic curve cryptography, a mathematical technique used to secure digital communications. Five curves—P-192, P-224, P-256, P-384 and P-521, were incorporated into standards published by the National Institute of Standards and Technology (NIST).
These curves became important components of cryptographic systems used to protect websites, financial transactions and government communications. Their construction involved 160-bit seed values that helped determine the mathematical parameters of each curve.
Although the procedure for generating the curves could be examined publicly, the origins of the original seeds remained unclear. That gap became the central issue in the NSA cryptography mystery, as researchers questioned whether the agency had selected the numbers through a transparent process or possessed undisclosed knowledge that could undermine their security.
Cryptographers Neal Koblitz and Alfred Menezes examined the controversy in their 2015 paper, A Riddle Wrapped in an Enigma. The paper explored the uncertainty surrounding the seed values and the broader concerns about trust in cryptographic standards.
One longstanding theory suggested that NSA mathematician Jerry Solinas had generated the seeds by hashing humorous English phrases. Hashing transforms input data into a fixed-length output, which can then be used as a seed. However, the precise phrases reportedly could not be recovered, and attempts to reconstruct the original procedure proved unsuccessful.
The lack of a definitive explanation kept the debate alive, even though researchers had not established that the curves contained an exploitable backdoor.
Anthropic’s investigation approached the NSA cryptography mystery by examining the numerical patterns in the published seeds rather than relying on the earlier theory about secret phrases.
According to the company’s research, an employee tasked an internal Claude model with investigating the seeds without disclosing the established secret-phrase hypothesis. The model noticed that several values contained groups of numbers with consistently zero-valued high bits, a pattern estimated to have approximately a one-in-5,810 probability of occurring randomly.
That observation pointed towards lrand48, a pseudorandom number generator commonly available in Unix-era computing environments.
Pseudorandom number generators produce sequences that appear random but can be reproduced when their initial conditions are known. Claude used the numerical patterns to work backwards, recover the generator’s internal states and reproduce the published seed values.
The reconstructed starting values corresponded to Unix timestamps from 1997 and 1998. Unix timestamps represent dates and times as numerical values, providing a plausible explanation for how the original seeds could have been generated without a collection of carefully selected secret phrases.
The model’s recorded reasoning reflected its surprise at the result: “This is astonishing: it solves the 25-year-old mystery.”
Anthropic reported that the process took less than 30 minutes. The finding provided a potential answer to the NSA cryptography mystery by identifying an ordinary computing procedure that could reproduce the otherwise puzzling values.
The recovered values linked the five NIST prime-field curves to specific dates between May 1997 and April 1998.
P-192 was associated with a timestamp corresponding to May 18, 1997, while P-521 traced to August 8 of that year. P-256 followed on August 16, and P-384 on August 30. The final curve, P-224, was linked to April 3, 1998.
The proposed process involved initializing the pseudorandom number generator with a timestamp, producing candidate seeds and testing them against the mathematical requirements for an acceptable curve. The procedure could then be repeated until a suitable candidate emerged.
For P-256, the accepted seed appeared at candidate 1,842. For P-224, the process reached the matching value at candidate 7,026.
Crucially, the results reproduced all 160 bits of the published seed values. They were not merely approximate matches or numerical patterns that looked similar.
Valsorda independently reproduced the findings using the Go programming language, while Anthropic released code intended to help other researchers verify the results.
These checks provide strong mathematical support for the proposed generation method. However, they do not conclusively establish who ran the original program, the exact circumstances in which it was used or why certain mathematically acceptable candidates were rejected.
The results therefore offer a compelling explanation for the NSA cryptography mystery, while leaving some historical details open to further investigation.
The findings could help resolve a longstanding concern about the trustworthiness of cryptographic standards.
One theoretical concern was that an organisation selecting cryptographic parameters might deliberately choose values that made a system vulnerable to an attack known only to that organisation. If the seed-selection process offered enough freedom, a designer could potentially search for values that created a hidden advantage.
Anthropic’s analysis suggested that the reconstructed method provided substantially less selection freedom than some proposed backdoor scenarios would require. Under generous assumptions, the researchers estimated approximately 30 bits of selection freedom, compared with roughly 70 bits contemplated in one proposed weakness-selection scenario.
That difference makes the particular backdoor theory less plausible. Nevertheless, the findings should not be interpreted as proof that every possible weakness in elliptic curve cryptography has been ruled out.
The discovery also does not mean that Claude broke the encryption protecting internet communications. Rather, the model reconstructed a process that appears to explain how particular cryptographic parameters were generated.
Nor does the result directly affect Bitcoin or Ethereum, which use a different elliptic curve known as secp256k1. The finding concerns the origins of the five NIST curves, not a demonstrated vulnerability in those cryptocurrency networks.
The broader significance of the NSA cryptography mystery lies in showing how AI-assisted mathematical investigation can help researchers revisit longstanding technical questions and identify patterns that may be difficult to recognise through conventional investigation alone.
Despite the reported breakthrough, the discovery also prompted criticism from Bitcoin developer Gregory Maxwell, who questioned the circumstances surrounding the model’s performance.
In a discussion on Hacker News, Maxwell said he had suggested investigating the same cryptographic problem to a friend on September 20. According to his account, the friend’s AI agent spent several hours attempting to solve it without success.
Maxwell, who has been critical of aspects of Anthropic’s AI approach, raised the possibility that the difference in results could reflect how the model was prompted or the capabilities available to it. He did not provide evidence that Anthropic had deliberately altered the model’s performance, and his comments did not establish that he had independently solved the problem.
He wrote: “I’m not saying this to suggest that misanthropic hijacked someone elses work yet again– this is an obvious question that many people have surely posed and success presumably depended on expert use (which was absolutely not applied in my friends example),”
He added: “But it does make me wonder if the company invisibly degraded the model performance.”
The comments highlight a broader question about evaluating AI research claims: a model’s performance can depend on the instructions it receives, the tools available to it and the expertise guiding the investigation. A failed attempt by one AI agent does not, by itself, disprove another model’s reported results.
The central technical question remains whether the reconstructed method accurately explains the original seeds. Anthropic’s published research and Valsorda’s independent reproduction provide evidence supporting that explanation, although the historical record is not yet complete.
The resolution of the NSA cryptography mystery also settled a public challenge that had remained unanswered for three years.
In October 2023, cryptographer Filippo Valsorda offered a $12,288 bounty for an explanation of the seeds’ origins. A matching arrangement increased the potential award to $36,864.
Following the reported discovery, Anthropic directed the full bounty to the Internet Security Research Group (ISRG), the nonprofit organisation that operates Let’s Encrypt, which provides widely used digital certificates for encrypted web connections.
Valsorda described the significance of the result by saying it “helps fill out a page of cryptographic history, and reinforces our confidence in these critical cryptographic primitives.”
Some questions remain unanswered. Researchers have not fully explained why certain mathematically acceptable candidate values were discarded during the original construction process. The origin of the seed associated with the B-163 curve also remains unresolved.
Even with those outstanding issues, the findings offer a substantial advance in understanding the five NIST curves. A question that once encouraged theories about hidden weaknesses now has a plausible explanation involving an ordinary pseudorandom number generator and timestamps from the late 1990s.
For cryptographers, the episode illustrates the value of independently reproducible evidence when assessing the security of widely used standards. For AI researchers, it provides an example of a model contributing to a difficult mathematical investigation.
The NSA cryptography mystery may therefore be largely resolved for the five prime-field curves examined by Anthropic, although the remaining historical questions will require further verification. The result does not establish that every cryptographic concern has disappeared, but it offers a more conventional explanation for numbers that had fuelled decades of suspicion.
Copyright © 2025 - The Bit Gazette.
