News.Ycombinator Anthropic's Claude Solves 25-Year-Old ECDSA Seed Mystery
Article Content
- •Claude identified the seeds for NIST elliptic curves as originating from a Unix timestamp-based RNG.
- •The discovery alleviates fears of backdoors in widely used cryptographic standards.
- •The results were independently verified, confirming the integrity of the ECDSA standard.
On October 16, 2026, Anthropic announced that its AI model, Claude, traced the origins of seeds used in five NIST-standard elliptic curves to a pseudorandom number generator called lrand48, initialized with Unix timestamps. This discovery resolves a long-standing mystery about whether the NSA deliberately introduced backdoors into the ECDSA standard, which has been in use since 2000. The seeds were generated between May 1997 and April 1998, and Claude's findings suggest that the generation process can be publicly reproduced, reducing concerns about covert manipulation. The research has been corroborated by independent verification from cryptographer Filippo Valsorda, who confirmed the results and the associated bounty payout of $36,864 to a charitable organization. The findings do not introduce new vulnerabilities or attack vectors, strengthening confidence in the integrity of the ECDSA curves.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (6)
Common questions
What are the implications of Claude's findings?
How were the seeds generated?
Is there any immediate action required?
Continue Reading
Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…
CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. These vulnerabilities are being by Chinese actors for cyber espionage, targeting…