Under 30 minutes for a 26-year-old riddle: what the NSA curve finding says about AI in your business

TL;DR. Since 2000, many encrypted connections have relied on curves whose starting values the NSA never explained. On October 16, Anthropic revealed where they came from. An AI model found in under 30 minutes what experts had failed to find for 26 years, and the answer is mundane: a simple random number generator, started with the clock time of 1997. We re-ran the numbers: 14 of 14 values match bit for bit, in 59 milliseconds. Nothing changes for your encryption. A lot changes for the question of where AI can find something new in your business.

What was found

The curves P-192 to P-521 have been part of the US standards body NIST’s signature standard FIPS 186-2 since 2000. Many encrypted connections and digital signatures still rely on them today. Each curve is derived from a 20-byte starting value, the seed. The NSA supplied these seeds without saying where they came from. For years that fed the suspicion that someone had deliberately picked weak curves. The NSA staffer in charge later recalled a joke sentence that had been run through a hash function. Nobody ever found the sentence. In 2023, a well-known cryptographer put up a bounty for the solution.

In October, an Anthropic employee asked an internal research model whether it could work out the origin without giving it the hint about the joke sentence. Several colleagues had followed that trail before without success. The model took a different approach. It thought about how software in the 1990s generated random numbers and searched the seeds for traces of such generators. After under 30 minutes it was clear: the seeds come from lrand48, the simple random number generator of the C programming language, started with the clock time. The timestamps fall between May 1997 and April 1998. The seed of the most widely used curve, P-256, is candidate 1,842 of a run that started on August 16, 1997, at 1:52 a.m. UTC.

We re-ran the numbers

Anthropic published the solution as a short program, free to use. We ran it on a laptop. We did not compare against Anthropic’s own list but against the values that ship with the widely used encryption library OpenSSL. The result: 14 of 14 seeds match bit for bit, and the run took 59 milliseconds. As a cross-check, we used the standardized procedure to compute the curves themselves from the seeds of the five NIST prime curves. They match too. So do the six base points whose origin the model explained along the way.

Independently, the cryptographer who had offered the bounty rebuilt the method and confirmed it in another programming language. The $36,864 goes to the non-profit behind Let’s Encrypt, which issues free certificates for websites.

The fine print

• Not a model you can buy. The work was done by an internal Anthropic research model. The report does not say whether today’s available models can do the same.
• A human asked the question. A curious employee provided the impetus. The result was published by a team of ten people.
• Not everything is explained. The seed of curve B-163 fits no pattern. For nine base points, including that of P-256, the origin is still missing.
• An open selection. In the P-256 run, candidate 876 would already have produced a curve with the same properties. It was skipped, and nobody knows by what rule. The cryptographer counts roughly twice as many usable seeds as were published. Even so, he and Anthropic consider a backdoor implausible, because the room to manoeuvre was far too small.

The pattern behind it

On the same day, Anthropic published a second result. Claude designed circuits for quantum computers, and an automated checker verified and scored every design. In one case the new circuit needs 17 times fewer gates, in other words computing steps, than the best previously published one. Anthropic itself notes that this only works for tasks whose result can be checked quickly.

The curve riddle was no different. Whether a recovered state reproduces all 160 bits of a seed can be checked in milliseconds. Chance is ruled out. That leads to a simple rule: AI becomes a discoverer where there is a checker. Where an answer only sounds plausible, it remains a guess. The story of the joke sentence sounded plausible too, and it even came from the person responsible. It was wrong.

What this means for a mid-sized company

Every company that has grown over the years has seeds like these: values whose origin nobody knows any more. A factor in the pricing formula. A limit in the control program of a machine from 2004. A macro in the costing sheet. The file format of a legacy system for which no description exists. Anyone who wants such a thing explained usually asks the colleague who built it back then. Often that person has left, or their memory is wrong. This is where AI can help today: forming hypotheses, testing them systematically and, in the end, delivering a small program that reproduces the known values exactly. Only that program is the finding.

What you should do now

1. Change nothing about your encryption. The finding is not an attack. Anthropic says explicitly that there is nothing to do, and a backdoor in the curves becomes even less likely. It does not affect the planned move to quantum-safe methods.
2. Make a list of unexplained values. Three to five constants, formulas or formats that affect your operations every day and that nobody can justify any more.
3. Define the checker first. For each case, decide how you will recognise a correct explanation: by known inputs and outputs, by historical data, by a simulation.
4. Ask for a re-run, not a rationale. Have the AI deliver a program that produces the known values, and run it yourself. Just as we did with Anthropic’s 14 seeds.
5. Leave gaps open. Whatever cannot be reproduced stays marked as open, like B-163. An honest gap is worth more than an invented explanation.

The NSA curve finding is not a security problem but a lesson. The model did not guess better than the experts, it checked faster. If there is a value in your company that nobody can explain any more, we would be glad to hear from you.