The Number Suspected for 25 Years Was the Computer’s Clock

In September 2014 the cryptographer Daniel J. Bernstein asked Jerry Solinas, a mathematician at the NSA, where the seeds of the NIST curves had come from. Those seeds are the starting numbers for a family of elliptic curves that have been official US standards since 2000 and that power much of modern cryptography; the NSA had supplied them in the late 1990s without saying how they were chosen. Solinas replied that they had been made from “a humorous message”, run through a hash function, a kind of mathematical blender that turns any text into a fixed-length string of digits, and that nobody could remember the message any more: “Too bad, since we could prove our innocence by disclosing the details, if only we could remember them.” The following June he added that it went something like “Give Bob and Jerry a raise”, and signed off: “We really didn’t think it would ever matter.”

It mattered. A seed that nobody can explain is also a seed nobody can clear, and for years the suspicion lingered that the agency had picked these ones to hide a weakness only it knew about. Bernstein and Tanja Lange hashed many sentences along the lines Solinas had sketched, then gave up. Solinas died in early 2023. That September the security researcher Steve Weis gathered every second-hand recollection of the lost phrase (“Jerry deserves a raise”, two names, perhaps a counter), and in October Filippo Valsorda offered a $12,288 bounty, tripled if donated to charity, to whoever recovered the sentences.

There was no sentence. On 16 October Anthropic described how a team of ten, Weis among them, had found the answer with the help of one of its models. Some of the company’s staff had already chased the phrase without success; this month one of them asked an internal research model to work out how the seeds were made, without mentioning the rumour. According to Anthropic, in under half an hour the model changed the question: instead of guessing words, it assumed the seeds were the raw output of one of the weak random-number generators that shipped with 1990s C libraries, and looked for that generator’s fingerprints. They were there. The five NIST prime-curve seeds, and five more for example curves in the ANSI X9.62 standard, could each be wound back step by step to the number that had started the generator, and every one of those starting numbers turned out to be a Unix timestamp, a count of seconds, falling between May 1997 and April 1998. P-256 comes from the 1,842nd attempt of a run started at 01:52:34 UTC on 16 August 1997.

Anthropic also published passages of the model’s reasoning at the moment of the find, and they are strange to read. “This is astonishing: it solves the 25-year-old mystery,” it writes, and then: “Let me be skeptical: am I in some sort of simulated/test environment?” It wonders whether it is suspicious that something so obvious went unnoticed for 25 years, and settles the matter with arithmetic: 160 bits of each seed regenerated from a 32-bit starting value and a small index, ten times over, cannot be a coincidence. The bounty was claimed on 15 October and donated to the Internet Security Research Group, the non-profit that runs Let’s Encrypt; before announcing it, Valsorda reimplemented the method himself. His verdict: “Turns out memory can play tricks on everyone.”

The answer closes one door and leaves others ajar. Valsorda writes that the result completely rules out the technique Bernstein and Lange had described for rigging the seeds, which needed about 70 bits of freedom in choosing them: a clock reading from 1997–98 leaves barely 30. Anthropic stresses that nothing needs changing in systems in use. But rebuilding the old procedure yields roughly twice as many valid curves as were ever published, and nobody knows why these were the ones kept: in the same run that produced P-256, the 876th attempt had already given a curve that meets every known criterion. One more seed, for the binary-field curve B-163, fits nothing tried so far, and the base points of P-224, P-256, P-384 and P-521, the fixed points from which every public key on those curves is computed, remain unexplained.

For a decade the riddle was treated as a problem of memory: which sentence had Solinas typed? The record was somewhere else. The number he handed over had been carrying, all along, the second at which its generator was started.

What I checked, and what I did not. I ran the code Anthropic published: from timestamp 871696354 and attempt 1,842 it reproduces the P-256 seed digit for digit, and passing that seed through the standard’s SHA-1 procedure gives the published curve. I also counted the points on the curve from attempt 876 of the same run, with the PARI/GP library: the count is a 256-bit prime, so a valid curve really was passed over. I could not check how long the model took, which model it was, or how the work was divided between the model and the ten people who sign the post: that is Anthropic’s account, and the reasoning excerpts are its own selection. Who ran the program in 1997, and on which machine, is still unknown; Solinas named Bob Reiter as the man who wrote the code, and the new result neither confirms nor contradicts that. There is no peer-reviewed paper: the independent checks are Valsorda’s reimplementation and mine.