Nib explains · Case file

The Case of the Mystery Seeds

Some of the most widely used encryption on the internet is built on a handful of curves that NIST published in 2000. Each curve came from a "seed", a string of random-looking bytes supplied by the NSA, with no explanation of where those bytes came from. For 25 years, nobody could say.

Nib says: In October 2026, Claude cracked it in under half an hour, and the cryptographer who had offered a bounty for the answer checked it himself. The answer turned out to be delightfully ordinary. This case file starts from zero, so by the time we reach the solve you'll be able to run it yourself.

The case in one paragraph

The curves P-192, P-224, P-256, P-384 and P-521 were standardized for digital signatures in FIPS 186-2. Each curve's main coefficient was made by hashing a 20-byte seed, a trick meant to prove that nobody hand-picked a weak curve. But that proof only works if you know where the seed came from, and the NSA never said. The story told for years was that the seeds were hashes of English sentences their author later forgot. In 2023, cryptographer Filippo Valsorda offered a bounty for anyone who could find those sentences. On October 16, 2026, Anthropic's Frontier Red Team published the answer: there were no sentences. The seeds were output from an ordinary C-library random number generator, started from the computer's clock on dates in 1997 and 1998.

Chapters

  1. 1
    Open

    How can a lock be public?

    Public-key cryptography, clock arithmetic and one-way functions. Play a key exchange with two goblins.

  2. 2
    Open

    What is an elliptic curve, really?

    Add points on a curve with your finger, then watch the same rule turn into scattered dots on a grid.

  3. 3
    Open

    Why curves need seeds

    "Nothing up my sleeve" numbers, and a live check that turns P-256's seed into P-256's curve.

  4. 4
    Open

    The mystery

    The NSA's seeds, the forgotten joke phrase, the suspicion, and the bounty. Hunt for the lost phrase yourself.

  5. 5
    Open

    Fake randomness

    How computers make random-looking numbers, from the Mersenne Twister down to lrand48. Start it from any moment, then rewind it.

  6. 6
    Open

    The clue

    The odd pattern in four of the seeds, and a NIST seed you can crack in your browser back to April 1998.

  7. 7
    Open

    Lattices

    Reduce a lattice by hand, then watch LLL recover the hidden bits behind each prime-curve seed in milliseconds.

  8. 8
    Open

    The reveal

    Rewind P-256 to 01:52:34 UTC on August 16, 1997, then run the 1997 program yourself and watch every seed appear.

  9. 9
    Open

    Why it's not a backdoor

    Count the bits of freedom the curve-makers really had, then try to rig the 1997 clock yourself.

  10. 10
    Open

    Nib's open cases

    The skipped curves, B-163 and four base points: what we tried, an independent recount, and a pre-registered hypothesis that failed.

The primary sources