AI Solves 25-Year-Old NIST Cryptographic Puzzle

AI Solves a 25-Year-Old Cryptographic Puzzle: What Really Happened with the NIST Curves?

In the world of information security, few things raise as much suspicion as a "black box." For a quarter of a century, the encryption curves of NIST (the U.S. National Institute of Standards and Technology), and particularly the popular P-256 curve, have been the subject of speculation. The NSA provided the parameters for these curves without explaining their origin, which led many experts to wonder: Was a deliberate "backdoor" planted here?

Recently, an internal research model from Anthropic, based on Claude, managed to crack this mystery in less than half an hour of work [1, 2]. The findings not only close a historical chapter but also provide significant relief to the global cyber community.

How was the puzzle decoded?

The central suspicion concerned the "seeds" used to generate the curve parameters. For years, researchers assumed these were hash values of specific phrases, but all attempts to decode them failed. The Anthropic research team fed the data into the Claude model, which identified completely different patterns [1, 5].

It turned out that the seeds were not created using a complex or malicious algorithm, but rather using a simple and standard random number generator (PRNG) of the

lrand48

type, which was common in the C libraries of Unix systems in the 1990s [7, 9]. The model discovered that the generator was seeded simply by the system's Unix Timestamp at the time of execution.

For example, the seed for the P-256 curve was discovered to be the 1,842nd result of the generator run, which was performed in August 1997 [7, 9]. The findings repeated for five different curves (P-192, P-224, P-256, P-384, and P-521), all of which followed a pattern of timestamps between the years 1997 and 1998 [3, 7].

Is there any reason for concern?

The short answer is no. In fact, these findings strengthen trust in these curves [1, 2].

•No breach: This is not a security vulnerability or a new exploit. The encryption remains as secure as it ever was [1, 3].
•Removing suspicions: The fact that the parameters were created using a standard and simple tool of that era makes the possibility of a deliberate "backdoor" planting much less likely [2, 9].
•Continuity: ECDSA users are not required to take any action or make any changes to their systems [1, 2].

Summary and Conclusions

This story is a fascinating example of the power of artificial intelligence as an aid for scientific and technological research. What required decades of human effort without success was decoded by a language model in just a few minutes thanks to its ability to identify mathematical and programming patterns that eluded researchers [5, 6].

It is worth noting that the $36,864 cash prize offered for solving the puzzle will be donated to the ISRG organization, which operates Let's Encrypt, in recognition of their contribution to Internet security [9].

Although some parameters still remain without a full explanation (such as the B-163 curve), the cryptographic community can now sleep soundly. The mystery surrounding the NIST curves has come to an end, and it is much less "exciting" than what conspiracy theories tried to paint.

Additional sources for review: