Anthropic: Claude Traced the Origin of a Digital Signature Standard's Seed Values

Anthropic announced on October 16 (local time) that Claude had traced the origin of the seed values behind the main curves used in ECDSA, the digital signature standard. ECDSA is a widely used standard for creating and verifying digital signatures across the internet. According to the company, an internal research version of Claude took less than 30 minutes to work out how the seeds for five of the US National Institute of Standards and Technology (NIST) curves, P-192, P-224, P-256, P-384 and P-521, had been generated.

Why the seeds drew suspicion

How the curves used in cryptographic computation were chosen in the first place had long been an open question. NIST adopted ECDSA into its digital signature standard in 2000. The specification included “seeds,” the values that determine the curves. According to Anthropic, those values were handed over by the US National Security Agency (NSA) with no explanation of how they were produced. That is why suspicions persisted that someone might have picked the values in order to quietly plant a security backdoor.

In earlier investigations, the most plausible explanation had been a former official’s recollection that a joking phrase had been converted into a fixed-length value. Anthropic staff followed that lead too, but came up empty. This time, one employee asked the internal research version of Claude to find the generation method without sharing that clue. The company said the recollection about the phrase did not match how the values were actually generated.

Numbers made by a computer clock

The starting point Claude found was not a sentence but a timestamp. Anthropic said the seeds were generated by feeding a numerical timestamp from a computer clock into the random number generator software in use at the time. The program produced numbers in sequence, and fixed-length chunks of them were used as seed candidates. The standard seed for P-256 was the 1,842nd candidate to come out of that process.

Image: anthropic.com

Claude worked backward through the behavior of the old software. It first looked for traces of a particular generator in the digit patterns of the published seeds. It then reconstructed the program’s internal state and ran the computation in reverse to recover the starting value. According to Anthropic, the starting values recovered from 10 curve seeds in the NIST and ANSI X9.62 standards all corresponded to times between May 1997 and April 1998. Running the computation forward again from the recovered state reproduced each seed in full, the company said.

The analysis extended beyond the seeds to other values. Claude also traced the origin of some of the “base points” that serve as the reference for public key computation. Anthropic said the base points for P-192 and five ANSI X9.62 example curves came from FreeLIP, a mathematical computation software package. It added, however, that it had not worked out how the base points for P-224, P-256, P-384 and P-521 were generated.

Do we need to change how we use digital signatures today?

Anthropic said the findings do not amount to an attack that breaks ECDSA or the discovery of a new vulnerability. The fact that an old random number generator was used does not imply a security flaw in the curves themselves, the company explained. Anthropic assessed that, with a simple generation method now revealed that anyone can reproduce, the suspicion that a backdoor was secretly planted becomes less persuasive. Its position is that users do not need to take any action or change how they use the standard.

Image: anthropic.com

Some points remain unexplained. For P-256, candidate 876 met the criteria but was passed over in favor of candidate 1,842. Other curves also showed cases where seemingly qualifying candidates were skipped. Anthropic said it does not know what criteria drove the skipping, or whether it was an unintended outcome. Still, given that the number of skipped candidates was small, it considers it unlikely that deliberately weak curves were chosen. The origin of the B-163 curve seed also remains an open question.

What to watch next is the verification of the recovered results and how the remaining seeds and base points were generated. Anthropic said it plans to donate the $36,864 prize attached to the seed discovery to the Internet Security Research Group (ISRG).