blog.6admin.io
guest@6admin.io:~$
crypto, ecdsa, nist, nsa, bitcoin, secp256k1, llm

Timestamps, not a backdoor: the NIST seeds and Satoshi's choice

On October 16, Anthropic published the solution to a riddle the cryptographic community had been dragging around for more than twenty-five years, and which very competent people had eventually filed away alongside the JFK assassination and the Coca-Cola recipe: the origin of the “seeds” supplied by the NSA to build the elliptic curves NIST standardized in 2000, including P-256, which your browser probably uses several hundred times a day without asking your opinion. Three days later, the crypto press seized on the story from the Bitcoin angle, wondering whether we finally had the explanation for Satoshi Nakamoto’s choice, who had carefully avoided those curves in favor of another one, secp256k1.

So I spent part of the evening digging into the question with an LLM, because pushing a model to its limits, cross-checking what it says against primary sources and watching it trip over its own feet remains, to my taste, infinitely more entertaining than yet another Netflix series. The exercise proved instructive on two counts: first on substance, then on the disconcerting ease with which a machine, like a human, starts manufacturing “clues” as soon as you hand it an appealing hypothesis.

The problem, for those without a math degree

A digital signature on an elliptic curve rests on a set of public parameters everyone shares, a bit like a lock model standardized for the entire planet. Nobody worries that the model is public, that is the point, but everyone has an interest in that model not having been chosen by someone keeping a master key in their pocket.

To reassure people, the method used at the time was not to choose the curve by hand, but to derive it from a sequence of random numbers, the famous seed, passed through SHA-1. The idea was to say “look, we chose nothing, chance spoke”, which would have been perfectly convincing if the seed itself had a known origin. But the NSA supplied those seeds without the slightest explanation, and a seed whose provenance is unknown proves strictly nothing: nothing prevents someone from trying millions of them until landing on a curve with a weakness only they know about, then publishing the winner with an innocent look. It is a bit like a lottery where the organizer swears the balls came out at random while refusing to show the sphere.

The story went that Jerry Solinas, a mathematician at the NSA, had obtained those seeds by hashing an office joke along the lines of “Give Bob and Jerry a raise”, which nobody remembered exactly anymore, the archives of the time being, in his own words, probably stored somewhere next to the Ark of the Covenant. Solinas died in 2023, taking with him what looked like the last lead, and the cryptographer Filippo Valsorda had put up a bounty for anyone who could recover the original seeds.

What was found: the clock, quite simply

There was no joke, no secret phrase, no hashing at all. The seeds come out of lrand48, the pseudorandom generator from the standard C library, in other words grandpa’s random number generator, seeded with the machine’s clock at the moment the program was launched. This generator is so weak that its outputs give themselves away, and the model, after spotting a suspicious pattern of bits that were systematically zero, was able to walk back to the generator’s initial state, and therefore to the exact time it was launched, using a bit of algebra taught in graduate school (lattice reduction, for those interested). All in under half an hour, after twenty-five years of human speculation, which is somewhat humiliating for the species.

For the ten curves in question (five NIST, five ANSI X9.62 examples), the dates fall between May 1997 and April 1998. The P-256 seed was generated on August 16, 1997 at 01:52:34 UTC, a Friday evening around 10 p.m. Fort Meade time, assuming the machine’s clock was right, which in 1997 was not a given. Someone at the NSA therefore ran a small program on a summer Friday evening and kept the 1,842nd result. The whole thing reproduces with about twenty lines of Python published by Anthropic, which, for a question that had until then been a matter of faith, changes everything: anyone can now verify instead of believe.

The lava lamp paradox

There is an irony in this story that deserves a moment. If the NSA had truly drawn its seeds at random, in the physical sense of the term, with thermal noise, radioactive decay or, for aesthetes, the wall of lava lamps Cloudflare films in the lobby of its San Francisco headquarters to feed entropy to its servers, the mystery would have remained whole for eternity. True randomness leaves no trace: there is no seed to find behind it, no internal state to reconstruct, and no one could ever prove that the draw was not restarted ten thousand times until the desired result came up. To prove its innocence, perfect randomness is therefore strictly useless.

What saved the day is precisely that the author of the program used a pseudorandom generator, that is, a perfectly deterministic machine that produces numbers that look random from a starting value, and that he chose one of the weakest available. lrand48 keeps only 48 bits of state, follows a linear formula known to everyone, and its outputs give themselves away to anyone who knows how to look, so that with a bit of algebra one walks back from the output to the seed, then from the seed to the clock time. With a cryptographically sound generator correctly seeded, that walk back would have been impossible in practice, and the result just as unverifiable as with lava lamps.

For those who conflate things a little, and that is quite normal given how many different realities the word “random” covers, three families must be distinguished. A true hardware generator, whether based on thermal noise, a quantum phenomenon or lava lamps, starts from no seed at all, so there is nothing to find behind its output. The risk lies elsewhere, in the trust placed in the hardware, which can be faulty, biased or tampered with, and that is the whole point of the debate that has agitated the Linux community since 2013 around RDRAND, Intel’s randomness instruction, which the kernel has always refused to use alone and mixes with other sources. Researchers showed that same year, at CHES, that a circuit could be backdoored simply by changing the doping of a few transistors, without adding a single component, and they demonstrated it on a design derived from Intel’s generator, which does not prove that Intel did it but is enough to kill the urge to take anyone’s word for it. The weak pseudorandom generator, like lrand48 or the old rand(), is on the contrary entirely determined by its seed, and such a small internal state can be recovered without much difficulty: that is the case for the NIST curves. What remains is the cryptographic pseudorandom generator, like the one behind /dev/urandom or ChaCha20, also deterministic, but designed so that recovering its seed from its outputs is impractical, provided it was seeded with enough entropy, which, as anyone who has seen duplicated SSH keys across cloned machine fleets knows, is not automatic.

The right method already existed, though, and cryptographers call it by the picturesque name “nothing up my sleeve numbers”: derive the constants from values nobody could have secretly chosen, like the digits of π or the square roots of the first prime numbers, and thus show the public your empty sleeve. As an extra irony, that is exactly what SHA-256, designed by the NSA, does: its constants come from the fractional parts of the square and cube roots of the first prime numbers. The other route, more radical, is to design curves where every parameter follows from an explicit constraint, to the point that nothing is left to choose, and that is the whole spirit of Curve25519 and, to a lesser extent, of secp256k1.

What remains open

Anthropic’s post is honest enough to list what it does not explain, and that is the part most rewrites skimmed. One binary-curve seed, B-163, matches nothing that was tried, and the origin of several base points remains unknown. Claude did recover the origin of six base points, those of P-192 and five ANSI example curves, generated by the FreeLIP generator by Arjen Lenstra. Those of P-224, P-256, P-384 and P-521 remain unexplained. More piquant, some perfectly usable results were discarded for no apparent reason: for P-256, candidate 876 of the same run yields a prime-order curve of the right size, and nobody knows why the program went on to the 1,842nd.

The authors estimate that such a small number of skipped candidates makes the deliberate selection of a weakened curve unlikely, since that would require weakened curves to be common and easy to find, which would be known. They acknowledge, however, that it remains conceivable in theory to have rerun the program at different times until the desired curve appeared, and that nothing says how many times it ran. The objection eats its own tail, though, since such a staging would only be worth it if someone planned one day to exhibit the timestamp as proof of innocence, which nobody bothered to do in a quarter of a century.

The backdoor hypothesis for these seeds therefore moves from “unverifiable” to “very unlikely”, which is enormous, without constituting proof of absence.

Why the distrust was not paranoia

It would be comfortable to conclude that the suspicions toward the NSA were forum conspiracy thinking. History, unfortunately, does not grant us that gift.

In 2006, NIST standardized, with the NSA’s blessing, a random number generator called Dual_EC_DRBG, based on two points of a curve whose relationship was not documented. As early as 2007, two Microsoft researchers, Dan Shumow and Niels Ferguson, showed that anyone who knew the secret link between those two points could, by observing a few outputs of the generator, predict all the following ones, that is, guess your encryption keys. There was no bug: the generator did exactly what the standard said. The trapdoor was in the math, and only the person who chose the points held the key. The Snowden documents then finished ruining the algorithm’s reputation, Reuters reported that RSA Security had received ten million dollars to make it the default generator in its BSAFE library, which the company disputed without ever really denying it, and NIST eventually withdrew it in 2014. A backdoor in kit form, standardized, delivered with a commercial contract: we are no longer talking about a hypothesis.

The DES case, in 1977, is more devious, since the NSA had its hands in it in both directions at once. On one side, it had the S-boxes, substitution tables at the heart of the algorithm, modified in a way that protected it against differential cryptanalysis, an attack technique IBM had discovered on its own as early as 1974 but that the NSA asked it to keep secret, and which the academic world would only rediscover in 1990 with Biham and Shamir. On the other, it pushed to reduce the key, first to 48 bits, before a compromise at 56, which left the algorithm within reach of anyone with a state budget to try every combination. Strengthening the lock against burglars while making sure you can still kick the door down yourself is a philosophy.

What these two stories have in common is parameters or design choices whose origin nobody explained, and the NIST seeds ticked exactly that box. It was perfectly rational to distrust them in 2008, whatever we know today.

A small bestiary of misplaced trust

And that is only the mathematical floor of the building, because when it comes to selling the world equipment you reserve the right to listen to, agencies have an imagination that would make any screenwriter look like an amateur.

Crypto AG, or Swiss neutrality as an option. For decades, the Swiss company Crypto AG was the reference supplier of encryption machines for more than a hundred states, from Iran to the Vatican, via India, Pakistan, Argentina and a few NATO allies who suspected nothing. In 2020, a joint investigation by the Washington Post, ZDF and SRF revealed that the company had secretly belonged since 1970 to the CIA and the German BND, then to the CIA alone from the 1990s, and that the machines sold to interesting clients were deliberately weakened. Governments were therefore paying through the nose so that Washington and Bonn could read their diplomatic telegrams, something an internal CIA report described with touching modesty as the intelligence coup of the century. A delicious detail: one of the company’s employees, Hans Bühler, had spent nine months in an Iranian prison in 1992, suspected of espionage, and the company had dismissed those suspicions as an absurd conspiracy theory.

The booby-trapped parcel, Cisco edition. Among the Snowden documents published in 2014 are photographs, taken from a 2010 internal NSA newsletter, showing agents of the TAO unit carefully opening an intercepted Cisco box in transit, installing an implant in the router on a “load station” set up for the purpose, then closing everything up and putting it back into the circuit as if nothing had happened. The document notes that these supply-chain interdiction operations were among TAO’s most productive, and Cisco eventually shipped equipment to addresses unrelated to certain customers to keep parcels from taking a detour through Maryland.

The backdoor’s backdoor. Juniper used Dual_EC_DRBG in ScreenOS, the system of its NetScreen firewalls, with its own Q point in place of the NSA’s, which already amounted to keeping a lock whose cylinder you simply swap out. In December 2015, the company announced it had discovered unauthorized code: someone, whose identity has never been officially established, had quietly replaced Juniper’s Q with their own in 2012, thereby gaining the ability to passively decrypt customers’ VPN traffic. The researcher Ralf-Philipp Weinmann called it a “backdoored backdoor”, and the story by itself sums up the problem with backdoors “reserved for the good guys”: a trapdoor knows no owner, only people who hold the key.

ANOM, the mobster phone built by the FBI. When the FBI took down Phantom Secure, a provider of encrypted phones highly prized by organized crime, it left a gap in the market and promptly filled it itself. Between 2018 and 2021, the agency distributed, through intermediaries who knew nothing, about 12,000 ANOM phones to more than 300 criminal organizations in around a hundred countries, with every message quietly duplicated to a server controlled by investigators. Customers came to ask for the devices themselves, which is probably the best product ever launched by a federal agency, and the end of the operation in June 2021 resulted in more than 800 arrests.

EncroChat, France takes its turn. France is not to be outdone. In 2020, the gendarmerie, from the C3N in Pontoise, breached EncroChat servers hosted at OVH in Roubaix and pushed an implant onto the network’s phones through its own update mechanism, intercepting more than 100 million messages in a few months and leading, according to Europol, to more than 6,500 arrests worldwide. The technique, covered by state secrecy, still fuels legal challenges in court, which usefully reminds us that a tool effective against traffickers is also effective against anyone else, depending on who decides the target.

Ledger, or the 4G snitch sold in retail packaging. For those who might think all this belongs to ancient history, the news this October 2026 is here to undeceive them. Since October 9, Ledger buyers in Indonesia, Malaysia and the Philippines have seen their wallets drained, and on-chain estimates exceed 90 million dollars across about 300 wallets. All confirmed cases involve devices sold by CryptoBilis, an officially authorized reseller in Southeast Asia, and Mark Karpelès, the former boss of Mt. Gox, was among the first to open a new Nano X and find, tucked in place of the foam padding under the screen, a small circuit with a microcontroller, an LTE modem and an eSIM. The principle is so simple it borders on insolence: the implant reads the screen when the device displays the 24 words of the recovery phrase during setup, then sends them to the attackers over the mobile network, without touching the Secure Element, the firmware or the signatures, which lets it sail through Ledger’s authenticity check. So nothing was broken, neither the crypto, nor the secure chip, nor the code. Someone simply looked over the device’s shoulder at the only moment the secret appears in clear text, something Adi Shamir, the S in RSA, elevated to the third law of security during his Turing Award lecture: “cryptography is typically bypassed, not penetrated”. To date, the investigation has not established who modified these devices or where in the distribution chain, and nothing allows the operation to be attributed to a state rather than well-equipped criminals, which does not stop it from illustrating perfectly the same problem as the NSA’s Cisco boxes: between the factory and your desk, the hardware passes through hands you do not know.

Clipper, the pioneer. Finally, for those who believe the question is new, recall that in 1993 the Clinton administration was already proposing to equip American phones with the Clipper chip, designed by the NSA, which encrypted communications while entrusting a copy of the keys to the government. The researcher Matt Blaze showed as early as 1994 that the escrow mechanism could be bypassed, and the project died a few years later, without the idea ever really disappearing from the discourse on “responsible encryption”.

One clarification is in order to preserve the honesty this post claims: in 2008, Satoshi could have known about Clipper, the rumors around Crypto AG and the Shumow and Ferguson demonstration on Dual_EC. He could not, however, know what was already being prepared and would remain secret for years: the NSA’s hardware interceptions, revealed in 2014, the parameter substitution at Juniper, revealed in 2015, or the Crypto AG operation, confirmed in 2020. The public context of the time was nevertheless more than enough to justify a cypherpunk distrusting any parameter whose origin nobody could explain.

Satoshi’s choice

secp256k1, the curve Bitcoin chose, fits in one line, y² = x³ + 7, and its parameters leave almost no room to hide anything: no seed, no hashing, no numbers pulled out of a hat. It also has the advantage of being fast to compute, which is not insignificant for a network where every node verifies millions of signatures, and it was available in OpenSSL, which matters even more for someone coding alone in a corner. In the interest of honesty, it must be said that its base point is no better documented than NIST’s, without this being considered a weakness, since the choice of that point is not a known weakening lever.

Satoshi never explained the choice. It is compatible with a distrust of opaque parameters supplied by the NSA, but it is just as compatible with performance considerations or simple convenience. Anthropic’s discovery tells us nothing about what Satoshi knew or thought in 2008. It only confirms that at that date, the question of the seeds’ origin had no answer, and that a prudent developer could legitimately prefer a curve that did not raise it.

How an LLM manufactures clues

Let us come to the part I find most delicious. Before even talking about curves, I had asked the model for an “unbiased” summary of the hypothesis that Bitcoin might have been an intelligence operation, which is obviously a trick request, since you are not asking it to be neutral but to stop defending the official version. It complied with suspicious enthusiasm.

Within a few exchanges, Satoshi’s anonymity had become “too clean to be an amateur’s work”, and therefore the likely signature of an intelligence professional. Then, carried away, the model explained to me that the choice of the pseudonym “Satoshi” was “almost too symbolic”, since the satoshi is the smallest unit of bitcoin, a metaphor for the invisible but fundamental man. Except that the unit is named after its inventor, not the other way around. It is roughly like suspecting Alessandro Volta of having chosen his surname as a tribute to the volt. Once caught red-handed, it gracefully admitted having built an appealing explanation after the fact and then dressed it up as evidence, which, let us agree, is more self-criticism than most YouTube channels devoted to the subject produce.

This flaw is not specific to machines, and it deserves attention because it structures almost every debate about Bitcoin’s origins. A clue is only worth something if it is significantly more likely under one hypothesis than the other: if you are investigating a theft and the suspect wears shoes, you have learned nothing, since the innocent party wears them too. Flawless OPSEC, a Japanese pseudonym, British English in his exchanges or the choice of a transparent curve are exactly of that order, as expected from a disciplined cypherpunk raised for fifteen years on mailing lists where people held forth on the NSA and anonymity, as from an intelligence cell. Statisticians would say their likelihood ratio is close to 1. You can stack as many as you like, the hypothesis will not become any stronger, and that is precisely what the NIST seeds affair illustrates in reverse: it took one discriminating, reproducible, anyone-verifiable element to move a question that twenty-five years of suspicion, rumor and Bob and Jerry jokes had not budged an inch.

Moral: the NSA did build backdoors, Satoshi had good reasons to be wary, and the investigator’s worst enemy remains, as always, the beautiful story they want to believe, whether it comes from a human brain or a model with a few hundred billion parameters.

Sources

The NIST seeds and their discovery

Randomness, constants and curves

Dual_EC_DRBG and DES

The bestiary