Thirty bits

August 16, 1997. 01:52:34 UTC. Seed the C library's drand48 generator with that timestamp, draw 20 bytes at a time, and candidate 1,842 is C49D3608 86E70493 6A6678E1 139D26B7 819F7E90, the seed behind P-256, the workhorse curve of web TLS. On Friday Filippo Valsorda confirmed that an Anthropic team had traced all five NIST prime-curve seeds to timestamps like that one, and he paid out the bounty he posted three years ago.

For 25 years the seeds came with no explanation. The NSA supplied them and NIST published them in 2000. The only account anyone had was Jerry Solinas's recollection that he had hashed a joke sentence about getting himself and a colleague a raise and then lost it. Searchers, including several at Anthropic, chased that clue for years. It was wrong. The model that found the answer in under half an hour was never pointed at it. Solinas died in 2023, still a bogeyman to the curves' critics, three years before a workstation clock cleared him.

The lesson isn't that the NSA was innocent, though on this evidence it was. It's what finally closed the case. A decade of arguing that the agency couldn't have cheated never settled it. A count of how much it could have cheated did. A published constant is only as trustworthy as the bound on the choice behind it, and that bound has to be recorded when the number is drawn. Recollection is not a record.

Here is the count. In 2017 Daniel Bernstein and Tanja Lange described how roughly 70 bits of freedom in picking a seed could have been used to land on a hypothetical class of weak curves. That attack, plus Dual_EC_DRBG, kept the suspicion rational long after specialists had dismissed it. Dual_EC_DRBG was a NIST random-number standard built on NSA-supplied constants, and the 2013 Snowden documents tied it to an NSA backdoor. The timestamps shrink the NSA's freedom to something you can bound. Valsorda did the arithmetic, granting the agency any second in 1997–98 and any of the first 16 valid candidates from each run:

That leaves them forty bits short of the attack, even on a generous accounting. No argument about the NSA's intentions could do that. Arithmetic does.

The fair objection is that none of this changes anything. Practitioners already trusted the curves. Koblitz and Menezes argued in 2015 that rigging a seed to survive years of cryptanalysis was implausible, and Anthropic's own writeup says there is nothing to do differently. No patch, no rotated keys. All true. But implausibility persuaded the specialists and nobody else. Everyone else got conspiracy theories. Valsorda, who now recommends the NIST curves over Curve25519, writes that the speculation damaged confidence in systems that were sound.

Doubt about a constant isn't free just because the constant was fine.

The record is still incomplete, and its gaps show where the bound ends. Each run passed over about half the valid seeds for a reason nobody has found; P-256's run skipped a perfectly good candidate 876 on its way to 1,842. Nobody knows yet how the base points for P-224, P-256, P-384 and P-521 were chosen. Those gaps are tolerable only because the clock bounds them.

Every number an engineer publishes with a straight face raises the same question, whether it's a salt, a benchmark result or a threshold in a config: how many others could you have picked? If a model's score is the best of 20 seeds, the honest disclosure is the 20. Only the person drawing the number can write that down, and only at the time.

Valsorda's coda is that the NIST curves are finally rehabilitated, just in time to be retired for post-quantum signatures. Whoever picks the constants for what comes next should keep a better witness than a clock nobody knew was watching.