Why it's not a backdoor

Freedom is just the number of different results you could have chosen between. Cryptographers count it in bits: F bits of freedom means 2^F options. Each extra bit doubles the choice.

To plant a backdoor by seed shopping, a designer needs enough options to stumble on one of their secretly weak curves. If 1 curve in 2^k is weak, they need roughly k bits of freedom to expect to find one.

So what freedom did the 1997 program offer? Two kinds. When to press Enter: the clock seed. Being generous, say any second in 1997 or 1998, about 63 million seconds, roughly 2²⁶. And which candidate to keep from each run: we saw valid curves were skipped, so allow the maker to choose among the first 16 good ones, another 2⁴. Valsorda's generous total: barely 30 bits, about a billion options.

The red line starts at 70 for a reason. The most worked-out version of the backdoor worry came from Daniel Bernstein and Tanja Lange, who in 2017 described to Koblitz and Menezes a technique that could use about 70 bits of freedom in choosing a seed to aim at a hypothetical family of weak curves. Thirty bits is nowhere close: each missing bit halves your chances, and 40 missing bits leaves about a one-in-a-trillion shot.

Could weak curves be much more common, say 1 in a billion, so that 30 bits would be enough? Then a weakness affecting one curve in every billion would have been sitting in plain sight for 25 years of public research on elliptic curves. That was Koblitz and Menezes's argument in 2015, and now that the freedom is known to be this small, it's very hard to dodge.

Let's make it concrete. Suppose you, the villain, want the seed to start with some particular pattern of hex digits; think of that pattern as a stand-in for "lands in my secret weak family". You control the start time within a window in 1997, and you may keep any of the first 16 candidates from a run. Each hex digit you demand costs 4 bits.

With a day of start times you can usually force four or five hex digits, around 20 bits. With the whole of 1997 and 1998 you'd get to about seven or eight digits, 30 bits. A real backdoor would need to steer the curve into a family far rarer than "starts with eight particular hex digits", and the program gave no other knob to turn. The curve itself comes from SHA-1 of the seed, which nobody can steer.

And this is the villain's best case. The evidence suggests the makers mostly took what came: P-384 and P-521 were the first acceptable curves of their runs. The skipped candidates add a little unexplained freedom, which is why we counted it anyway.

The seeds behind P-256 and its siblings were not chosen to hide anything. They came from a stock random number generator and a wall clock. Even an all-powerful designer with that setup had about 30 bits to play with, which rules out the seed-shopping backdoor that had been sketched, and any other that would need comparable steering.

Valsorda's own conclusion was that this completes a "rehabilitation" of the NIST curves, which he now personally recommends over the popular alternative Curve25519. There's an irony in the timing. A large enough quantum computer would break all elliptic-curve cryptography, NIST curves and alternatives alike, so the world is moving to new, post-quantum signature schemes. The NIST curves were cleared just as they began to retire.

That same transition is where AI is now being pointed. In July 2026, Anthropic reported that one of its research models found a new attack on HAWK, a post-quantum signature candidate in NIST's process: not a break of anything in use, but a sign that the next generation of standards will be checked by AI from day one. The tools that settled an old mystery are already working on the new ones.