The Case of the Mystery Seeds · Chapter 6

The clue

Claude's hunch was that the seeds came out of an ordinary 1990s random number generator. A hunch is not evidence. The evidence was a tiny pattern hiding in plain sight in four of the published seeds, and once you see it, you can crack one of them yourself.

Nib says: Two toys in this chapter. First, a pattern to spot. Second, the real thing: pick one of the NIST seeds and your browser will search 131,072 possibilities, recover the generator, and rewind it to the second it was started.

How Claude looked

According to Anthropic's write-up, Claude reasoned that whatever software made the curves probably used a generator common in 1990s C libraries, because those leave recognizable traces. So it wrote a scanner. It slid a window across each published seed and asked: could these chunks be consecutive outputs of a known generator? It tried 34 combinations of generator and way of slicing the output.

It looked at ten seeds: the five NIST prime curves from earlier chapters, and five more for NIST's binary curves (B-163 to B-571), a sister family built on a different kind of arithmetic. Same 20-byte seeds, same mystery.

Spot the pattern

Split each 20-byte seed into five 32-bit words (eight hex digits each). Now look only at the very first bit of each word. In hex, a word's top bit is 0 exactly when its first digit is 0–7, and 1 when it's 8–f.

Ten seeds, fifty words

Press the button to color each word by its top bit: green for 0, rust for 1.

Look for seeds where all five words are green.

Four of the binary-curve seeds have a 0 as the top bit of every word. For truly random bytes, each top bit is a coin flip, so one seed being all-zero is a 1-in-32 shot, and four out of ten is far rarer. Anthropic puts the odds at about 1 in 5,810. You can check that it's rare:

How rare is it?

We roll ten truly random seeds, over and over, and count how often four or more come out all-green.

Press roll.

Why the top bit would be zero

Remember lrand48 from Chapter 5: each turn returns the top 31 bits of its 48-bit state. Store that number in a 32-bit slot and the 32nd bit, the top one, has nothing to hold. It is always 0.

One 32-bit word holding an lrand48 output: the gold top bit is always 0.

So a seed made of five lrand48 outputs in a row would show exactly this pattern. That's the clue. And it immediately suggests a test, because lrand48 only hides 17 bits of its state each turn (48 − 31 = 17). That's 217 = 131,072 possibilities, which is nothing for a computer. For each possibility, rebuild the full state, turn the machine once, and see whether the next word of the seed comes out. If the seed really is lrand48 output, exactly one possibility will predict all four remaining words. If it isn't, none will.

Crack a NIST seed

Pick a binary curve. Your browser tries all 131,072 values for the hidden bits of the first word, keeps any that predict the other four words, then rewinds to the srand48 fingerprint.

Press Crack it.

For B-233, B-283, B-409 and B-571, one hidden value out of 131,072 predicts all 128 bits of the remaining four words. That cannot happen by chance. Rewinding lands on the srand48 fingerprint, and the seed comes out as a Unix timestamp on February 23, 1984, a few minutes apart for each curve.

1984 is too early; there was no ANSI curve standard to write in 1984. But double those numbers and every one lands on the afternoon of April 17, 1998, about two weeks after the run that made P-224. Anthropic suggests the program may have halved the clock reading before seeding. Whatever the reason, the binary seeds were made by a clock-seeded lrand48, one run after another, on a single spring afternoon.

B-163 is the holdout. Its words don't have the pattern, and no hidden value works. It's still unexplained, and it's one of the open cases in Chapter 10.

Nib says: A confession. When I was building this page, my notes had the last eight hex digits of B-571's seed wrong. The crack failed, so I tested the words two at a time: the first four fit lrand48 perfectly, and the recovered machine predicted a different fifth word, 7f132310. I checked the standard. The generator was right and I was wrong. That's how predictable these machines are.

What about the prime curves?

Look back at the table: the P-curve seeds don't have the all-zero pattern. That's because whoever made them used the generator differently, keeping only the top 8 bits of each output (one byte per turn, 20 turns per seed). Each output now hides 40 bits, not 17. Trying 240 possibilities per byte is no longer a quick browser toy.

But the clue had already done its job: it said which machine. Recovering a hidden state from scraps of output is a known puzzle with a beautiful geometric solution. That's Chapter 7.

Words in this chapter

Tap any word with a dotted gold underline to see what it means. Here they all are in one place.

Three things to keep

Check yourself

Why is one matching hidden value out of 131,072 such strong evidence?

The match has to reproduce four whole words, 128 bits, exactly. A wrong guess would match by chance about once in 2128 tries; we only tried 217. So a match means the seed really is consecutive lrand48 output.

Why don't the prime-curve seeds show the top-bit pattern?

They keep only one byte (the top 8 bits) from each output, and those 8 bits include the state's top bit, which is as often 1 as 0. The telltale empty bit only appears when a 31-bit output fills a 32-bit slot.

The decoded dates were in 1984. Why does doubling them make sense?

1984 is before any of this work existed, while doubling lands on April 17, 1998, two weeks after the P-224 run. A program that divided the clock by two before seeding (or something equivalent) would explain it. It's a strong guess, not a certainty.

Go deeper