Anthropic announced the successful determination of the origin of the initial seed parameters that define the shape of elliptic curves ECDSA P-192, P-224, P-256, P-384 and P-521, standardized by the US National Institute of Standards and Technology (NIST). The algorithm for generating seed parameters recreated by the Claude AI model refutes the popular conspiracy theory that the initial parameters for standardized elliptic curves were specially selected to leave weaknesses that compromise the ECDSA digital signature algorithms.
The emergence of such a conspiracy theory was facilitated by the opacity of the process of selecting seed parameters against the backdrop of the identification of a potential backdoor in the pseudo-random number generator Dual_EC_DRBG, which was part of the NIST standard. Information on how the parameters to initialize NIST-standardized elliptic curves were generated was not disclosed. It was assumed that the parameters were created based on hashes of joke phrases that one of the developers came up with on the spur of the moment, but then forgotten.
In research conducted at Anthropic, the AI model Claude determined that the seed parameters were created using pseudo-random numbers obtained using the standard C library function lrand48, initialized with the values of the current epochal time. A clue to the possibility of using random numbers obtained through the drand48 function were patterns characteristic of its use, such as returning only the highest 31 bits from the 48-bit internal state of the generator.
To restore the state of the pseudo-random number generator, the AI model used the basis reduction algorithm, after which it brute-force compared the numbers issued by lrand48 with the existing seed parameters, repeating attempts for points in time in 1997-1998, in which the development of ECDSA took place. It turned out that not all values suitable for reliable elliptic curves were accepted by the creators of ECDSA; some values were skipped, but such omissions are interpreted not as malicious actions, but as a lack of accurate information about the selection criteria.
For six variants of elliptic curves, ECDSA was also able to determine the origin of the base points, which were generated using the pseudo-random number generator from the FreeLIP library using simple initialization values such as 20000 for the P-192 and 20420 for prime239v1.