Anthropic traced how ten seed strings became parameters for the ECDSA digital signature scheme
Anthropic traced how ten seed strings became parameters for the ECDSA digital signature scheme
On October 16, the company published code that reproduces the P-256 seed string in a cryptographic standard and identifies it as the 1842nd candidate generated by a program started on August 16, 1997, at 01:52:34 Coordinated Universal Time (UTC).
The ECDSA digital signature scheme lets users verify who signed a message and detect changes made after signing. Its numerical parameters define the rules for this verification. FIPS 186-2 from the US National Institute of Standards and Technology includes a 160-bit seed string for the P-256 curve. The SHA-1 algorithm converts it into the coefficient b, one of the numbers used in signature calculations. The origin of the seed string itself remained a mystery for decades.
According to the Anthropic report, an internal Claude research model suggested looking for traces of an old pseudorandom number generator, lrand48. It maintains a 48-bit internal state and outputs the 31 most significant bits, leaving a recognizable pattern in the resulting sequence of numbers. The team tested 34 combinations of generators and methods for splitting their output into chunks, reconstructed the state of lrand48 from fragments of the published seed strings, and then calculated its initial value.
The initial value is linked to Unix time, a count of seconds since January 1, 1970. The candidate number indicates a string's position in the sequence produced by the generator after startup. For P-256, the code reproduces the FIPS value c49d3608 86e70493 6a6678e1 139d26b7 819f7e90 as the 1842nd string from a run started on August 16, 1997. The code connects the value recorded in the standard to a specific run of an old program and reproduces it through the same sequence of calculations.
Using the same code, the authors reproduce all 160 bits of the seed strings for five NIST curves and five curves from the ANSI X9.62 standard. A separate reconstruction links the FreeLIP generator to the base points of P-192 and five ANSI curves. The authors leave the origins of the base points of P-224, P-256, P-384, and P-521, along with the seed string for B-163, as open questions.