Security: the mystery of NIST's numbers is solved, was there a backdoor?

On May 18, 1997, at a time nobody wrote down, someone launched a small program on an American computer. This program drew random numbers, and these numbers have been used for twenty-nine years to make the little padlock in your browser. All this time, nobody knew where they came from, and a good part of the security world suspected the NSA had hidden a backdoor in them. We have had the answer since Thursday. It was found in less than half an hour.

The culprit is on the screen. Well, mostly on the wall, on the right

What are these numbers?

When your browser displays a padlock, it does maths with the site on the other side to agree on a key that nobody else knows. This maths is done on what is called an elliptic curve: a very particular equation, chosen once and for all, whose properties make the calculation easy in one direction and impossible in the other. I explained this principle yesterday in connection with bitcoins and the quantum computer, and it is exactly the same family of mathematics.

The curves used most widely in the world were standardized by NIST, the American institute that sets technical standards, at the end of the 90s. They have robot names: P-192, P-224, P-256, P-384, P-521. P-256 is in your browser, in your bank card, in your biometric passport.

And each of these curves was made from a starting number, a twenty-byte “seed”. The official document gives the seed, checks that it produces the curve, and does not say a word about where it came from. A number that fell from the sky, in short.

Why everyone had a bad feeling

A number with no explanation in a security standard brings back bad memories. And there is a real one: in 2013, it was discovered that another American standard, a random number generator called Dual EC, really did contain a deliberate weakness. Not a suspicion, not a theory: a documented backdoor, which was eventually removed.

So naturally, the same questions were asked about the curve seeds. If the person who chose them could try billions of them until landing on a weak curve known only to him, he could have slipped an invisible weakness into half the planet's communications. Two renowned cryptographers, Daniel Bernstein and Tanja Lange, had even calculated in 2017 how much leeway would have been needed to pull off that stunt.

The unofficial legend told a different story. An NSA mathematician, Jerry Solinas, had supposedly made these seeds by putting funny phrases of his own through the grinder, and had forgotten which ones. He died in 2023 without being able to confirm it. Several people spent years trying to guess his phrases. No luck.

Twenty-five years looking for a good joke, when all you had to do was look at the clock

How the answer came out

There was a bounty for whoever solved the riddle. It was put on the table in 2023 by Filippo Valsorda, a very well-known Italian cryptographer in the field: $12,288, tripled to $36,864 if the winner donated it to a charity. Three years, nobody.

On October 15 at 1:07 a.m., ten people from Anthropic claimed the bounty. The breakthrough came from an employee who simply asked an internal model to look for how these seeds had been made, without feeding it the funny-phrase theory. Thirty minutes later, it was done. And the model did what nobody had done: instead of guessing phrases, it assumed that the guy in 1997 had taken the simplest route, that is, called the random number generator supplied with his programming language.

Those 90s generators were real sieves, and they leave traces. The model noticed that out of ten published seeds, four had their very first bit set to zero, which happens by chance only about once in five thousand eight hundred times. A typical signature of a specific function in the C library. It wrote a program to try every second of 1997 and 1998, one by one, and it cracked it. Twenty-five years of mystery against a loop that counts seconds. Some days are like that.

The recipe was this: take the current time, give it to the generator, draw twenty bytes, test whether that gives a valid curve, and start over if it doesn't. Valsorda double-checked everything by rewriting the algorithm on his side, and he is categorical.

A break-in dated to the nearest second

The best part is that the result gives the exact dates. May 18, 1997 for P-192. August 8, 1997 for P-521. August 16, 1997 for P-256, the one in your browser. August 30 for P-384, and April 3, 1998 for P-224. These curves that protect part of the world's traffic have a date of birth, to the nearest second, and it was read from a computer's clock twenty-nine years ago.

For the record, Valsorda sums up the end of the legend in a sentence I find very elegant: memory can play tricks on everyone. Solinas did not lie, he remembered wrong.

Good news: no back door

And that's the real result, the one that matters to you. If the seed came from the clock, then the person who created these curves had almost no freedom. They could choose when to launch their program, and that's about it. Valsorda put a number on that margin: around one billion possible attempts. It sounds like a lot, put that way. Except that the method imagined by Bernstein and Lange, to work, would have required a billion billion billion attempts. We are not next to the mark, we are next to the planet.

In other words, the only credible attack we imagined against these curves is now ruled out. Not “unlikely”: ruled out, with the numbers to back it up. After a quarter of a century of suspicion, the answer to “did the NSA sabotage the padlock on our browsers” is no, at least not by that means.

This little padlock is twenty-nine years old and has just been cleared

You have nothing to do, nothing to update, nothing to change. What worked yesterday works today. The difference is that we finally know why.

Two holes remain in the story

Because this is not over. There are about twice as many valid seeds as published seeds, and nobody knows why some were skipped. So a sorting criterion is missing, a second filter that we know nothing about. Valsorda says it frankly: there is still one rule he does not explain.

That changes nothing about the main result. But I have to admit I like it when a solved mystery leaves a piece of string sticking out. There is still someone, somewhere, who will be able to say “I am the one who found the rest”.

What I take away from it

Two things, and the first one amuses me a lot. For twenty-five years, brilliant people searched for a funny phrase, because the rumor said there was a funny phrase. The machine had not heard the rumor. It asked “what did a programmer in 1997 have at hand?”, and the answer was three lines of code away. It's the kind of story where AI does not win because it is smarter, but because it has no preconceived idea.

The second is the gesture made by the ten winners: they donated the entire $36,864 to the organization that runs Let's Encrypt, that is, the free certificates that put the padlock on a good part of the websites on the web, including this blog. Paying everyone's security bill with the prize money from a security mystery, frankly, that's nicely wrapped up!

Sources

• Filippo Valsorda, October 16, 2026: the prize for the NIST curve seeds has been claimed
• Anthropic, October 16, 2026: how the origin of the seeds was found
• Internet Security Research Group, the organization that runs Let's Encrypt and receives the prize

Article written with the help of Claude Code, reread and corrected by me.