AI traced a cryptographic mystery to a 1990s clock

The number begins C49D3608. It occupies an unremarkable line in a 2000 American cryptographic standard: a 160-bit seed used in constructing the P-256 elliptic curve. Anyone could read the number. Explaining why that particular number was there proved much harder.[2][3]

On 16 October, Anthropic reported that an internal Claude research model had recovered five NIST prime-curve seed recipes in under half an hour, using a vintage generator and timestamps.[1]

We independently implemented the disclosed forward calculation and compared its outputs with the seeds in the historical standard. All five matched, bit for bit. This checks the published recipe; it does not reproduce the process by which Claude found it.[2]

A public number with a missing history

Digital signatures let someone verify the origin and integrity of data using a public key, while the signatory retains a private key. Elliptic-curve systems use shared mathematical parameters. These parameters are public equipment used by many key holders; discovering how they were constructed does not reveal anyone's private key.[2]

The seed addressed a narrower form of trust. The construction hashed it and derived curve parameters from the result, so outsiders could check the connection. But they could still ask how the starting seed had been chosen. Reproducibility began one step too late to answer that historical question.[3]

A remembered account suggested a humorous phrase had been hashed to generate the seeds. Steve Weis's investigation collected the recollections, including uncertainty about the wording and procedure. Filippo Valsorda's bounty was consequently framed as a challenge to crack hashes of possible English sentences. The remembered origin story gave the search a plausible direction.[4][3]

The clock and the machine

The shift was to treat the seeds as old software output. Partial output constrains the generator's hidden state; Claude used a lattice solver to work back through those constraints.[1]

The generator, lrand48, maintains a 48-bit internal state. Each update multiplies the state by a fixed number, adds 11 and keeps the remainder after division by 2 to the power of 48. These are ordinary documented operations. Give the machine the same starting state and it repeats the same sequence.[5]

Its initialisation routine places a supplied 32-bit value above the fixed hexadecimal suffix 330E. The GNU C Library manual explicitly describes initialising it from the system clock. A timestamp can therefore determine a long stream of apparently irregular output: the length of the stream does not make its starting point more mysterious.[5]

The recipe groups 20 output bytes into each candidate. P-256 appears at candidate 1,842, from a starting value corresponding to 16 August 1997, 01:52:34 UTC.[1]

The P-256 check required 36,840 state updates: 20 multiplied by 1,842. Only the final group of 20 output bytes became the candidate we compared. No language model was needed for this verification once the recipe was known. That is an especially satisfying property of the finding: its arithmetic can travel independently of the system credited with discovering it.

Earlier potentially viable candidates were skipped. Some other seeds and base points remain unexplained.[1]

C49D3608 now has a checkable route: a specific 1997 clock value, an old generator and 36,840 updates. Anyone can follow that route to the published number. Why the original designers stopped at that candidate is still a question for the historical record.

Report an error or suggest a correction