Curve Origins

A signature can be verified exactly while the origin of its curve parameters remains unclear. The equation tells us how to calculate; it does not explain why its designer chose those constants.

Anthropic reported that the seeds for five NIST prime curves can be reproduced by a timestamp-initialized lrand48 generator. Its investigation concerns public parameter provenance, not recovery of ECDSA private keys. Research report, October 16, 2026.

Where the seed fits

Start with the curve parameters ⁠: the field modulus $p$, coefficients $a,b$, base point $G$, order $n$ and cofactor $h$. None is a user's private key.

For P-256, the historical procedure fixes $a=-3$ and uses a public 160-bit seed in a SHA-1-based calculation. It constructs an integer $c$ and checks

$b^2c\equiv-27\pmod p.$

That is more specific than “hash the seed to get $b$.” The published seed lets anyone verify the coefficient's relation to the hash calculation. It does not, by itself, explain how that seed was selected. FIPS 186-2, Appendices 6.4–6.5.

The first step was the provenance question. Recovering it does not reverse SHA-1. The base point $G$ has a separate selection process; it is not an output of this coefficient check.

Replay a candidate

The reported P-256 initializer is a Unix timestamp for 1997-08-16 01:52:34 UTC. Each candidate consumes 20 successive bytes; candidate 1,842 matches the published seed. Reproduction code.

The figure computes those bytes locally with exact integers. Select a candidate, then a byte to inspect the state that produced it. The coefficient check compares the selected seed with the fixed published $b$; it does not search for a new curve or test its order.

The state update

The reproduction starts from $X_0=(t\ll16)\;\vert\;\mathtt{0x330E}$, where $t$ is the Unix timestamp. For each output byte:

$$X_{i+1}=(\mathtt{0x5DEECE66D}\,X_i+\mathtt{0xB})\bmod2^{48},$$

$\text{byte}_i=X_{i+1}\gg40.$

lrand48 returns the upper 31 bits of its 48-bit state. Shifting that result by another 23 bits retains its top byte. These are two descriptions of the same extraction, not two generator updates.

The article's public-domain reproduction code supplies the recurrence and replay inputs. Our implementation uses BigInt so intermediate products are exact.

Recover the hidden state

A truncated output reveals only some state bits, but adjacent outputs still follow a shared recurrence. The Entropy ⁠ example makes that dependency visible with eight-bit states.

In the eight-bit teaching model, each square below is a possible initial state. Select how many consecutive outputs are known; only states producing the whole prefix remain dark. This enumerates 256 candidates, rather than running lattice reduction on the historical generator.

The report used lattice reduction to recover truncated generator states, then ran the recurrence backwards to find plausible initializers. LLL reduces a lattice basis; here the constraints come from generator outputs, not ECDSA signatures. Discovery method.

The demo above replays a known initializer. It does not perform that recovery. Reproduction and discovery are different computations.

Where the constraints come from

If the visible byte is $B_i$, write the state as $X_i=2^{40}B_i+e_i$, with $0\le e_i<2^{40}$. Write the multiplier and increment as $A$ and $C$. Each missing suffix $e_i$ must satisfy the same recurrence as its neighbors:

$$A(2^{40}B_i+e_i)+C-(2^{40}B_{i+1}+e_{i+1})=q_i2^{48}.$$

The wrap count $q_i$ is an integer. Many consecutive bytes create linked integer equations with bounded unknown suffixes. This is the structure a lattice method can exploit; it is not a guarantee that any truncated generator is easy to recover.

What remains uncertain

B-163’s seed and several base points, including P-256’s, remain unexplained. P-256 candidate 876 also yields a prime-order curve. Why it was skipped, and how many runs were attempted, remain unknown. Open questions.

A matching byte sequence is reproducible evidence. The date's historical interpretation and the designer's complete selection process need additional evidence. A public recipe narrows the mystery; it does not prove that nobody searched over inputs, or that a curve is secure against every attack.

Keep the secrets separate

Entropy ⁠ asks whether a value must be unpredictable. ECDSA ⁠ distinguishes three uses: a public curve seed, a private scalar and a signing nonce.

Replaying the first reveals shared constants that were already public. It neither reveals a user's private scalar nor supplies the secret nonce needed to rearrange a signature into that key. That distinction is what makes weak historical parameter-generation randomness compatible with a discovery about provenance rather than a break of the signature scheme.