'Wow, this is a real breakthrough': Claude breaks a 25-year-old NSA number mystery

Numbers handed over by the spy agency in the 1990s, long suspected of hiding a backdoor, turned out to come from a primitive computer program. Bitcoin was never on that list and its quantum problem has not gone anywhere.

An Anthropic AI model has cracked one of the longest-running cryptographic units, numbers handed over to the US government by the NSA in the late 1990s, long suspected of hiding a backdoor to a regular random number program fed with the timestamps 1997 and 1999.

The model took only half an hour to arrive at a solution – one that cryptographers had been searching for 25 years to answer.

Much of the Internet relies on elliptic curve cryptography, a family of mathematics that is also used to protect Bitcoin wallets. This allows someone to prove that they have a secret key without revealing their key details.

Think of the curve as a lock design that anyone can check. Each person using it has their own secret key, but all rely on the difficulty of cracking the scheme.

But who chose the mathematics that everyone trusts?

In 2000, the US National Institute of Standards and Technology, or NIST, adopted a set of curves provided by the National Security Agency. The NSA provided the plans without explaining where some of the numbers used to generate them came from.

After Snowden's revelations linked the NSA to efforts to undermine encryption standards, the secrecy became even harder to deny. NIST later removed that tool, the Dual EC random number generator, from its recommendations.

Those initial numbers, called seeds, were public. But the NSA never explained how it chose them, leading to speculation for years that it tested many. Until it found a curve with a weak point, it just knew how to use it. Foyle's theory was that the NSA had a backdoor to every system it used.

Cryptographers Neil Kublitz and Alfred Menezes explored this controversy in their 2015 paper, "A Complex Puzzle Within a Puzzle." Menezes had helped write the original standard and recalled receiving the seeds from NSA mathematician Jerry Solinas in 1997.

Security researcher Steve Weiss spent years seeking an explanation, including filing public records requests in 2018. NIST said it had no documents, while the NSA declined to respond. One promising clue suggests that the numbers came from a humorous phrase that Salinas had forgotten, sending researchers scrambling for possible combinations of words.

In 2023, crypto engineer Filippo Valsorda and other contributors offered a $12,288 reward for the answer, which would increase to more than $36,000 if the winner donated it to charity. Salinas had died earlier that year, forcing researchers to work on old memories and the numbers themselves, to no avail.

Until Claude entered the picture. This month, an Entropic employee asked an internal research model to check it out, not sharing the old theory that the seeds came from a forgotten term.

The model took less than half an hour to trace five NIST curves to lrand48, a random number generator found in older C software libraries.

Claude reproduced the backscatter of P-256, a widely used curve, and an exact match for its published seed in the 1842nd candidate.

"This is amazing: it solves a 25-year-old mystery," the model wrote in his recorded argument after briefly discussing whether it would work in a simulated experiment. "Hmm, is that acceptable in reality? To the best of my knowledge... grace was not resolved. ... all key bits are clear - 20 bits, 1e-6 chance. So indeed in the real world."

Now anyone can run the app again and get the numbers the NSA provided. Anthropic says that makes a hidden weakness much less likely, though the team still can't explain why the program skipped over some usable candidates or how other parts of the curve were selected.

This predictability is what allows the cloud to reconstruct the numbers, and it would be a disaster in the wallet. A secret key generated with lrand48 can be recreated by anyone who worked around the time it was created, giving them everything they need to flush the funds.

The NSA seeds were public from day one, so there was never any secret to stealing.

Bitcoin was never part of this guessing game. Its wallets work on secp256k1, a curve built from a simpler equation.

The Bitcoin version is defined by two small, fixed numbers that leave almost nothing to configure, while the P-256 version has a 77-digit number that emerged from an inexplicable NSA seed.

With only a handful to go around, there's little room for someone to quietly create a downside in Bitcoin's curve, and cryptographers have long pointed this out in Bitcoin's favor.

Creator Satoshi Nakamoto never publicly explained why he chose it, and the curve was rarely used before Bitcoin became popular. Ethereum later adopted it, and Bitcoin retained it when the 2021 Taproot upgrade introduced a new signature style.

As CoinDesk explored earlier this year, a powerful quantum computer would pose a different risk. It can work backwards from a visible public key on the blockchain to the secret key behind it, regardless of how the curve is chosen.

Advances in hardware are closing the gap between this theory and a working attack. Google announced this week that in one of the most expensive steps such a machine would require, cutting errors on the Willow chip had increased by about 40 times.

However, no one has yet built a quantum computer big enough or reliable enough to crack a Bitcoin key, and there's no concrete timeline for when it might arrive.

Meanwhile, Anthropic said on its blog that people using the NIST curves don't need to change anything. After decades of questioning where the seeds came from, anyone can now run the program and trace it back to the published numbers.

The search also had a reward. Its $36,864 prize will go to the Internet Security Research Group, the nonprofit behind Let's Encrypt, which gives websites free security certificates.

Diversified RWA stablecoins maintain a 5-7% return on real credit as crypto capital drops to 4%. GENIUS increases performance off-chain. TAM increases to $4 billion in 3 years.