Cloud of suspicion lifted from NIST curves

NIST published a suite of elliptic curves in 2000 whose coefficients were derived from seeds provided by the NSA, and cryptographers long suspected those seeds might hide a backdoor after the agency was shown to have tampered with Dual_EC_DRBG. Security of elliptic-curve cryptography rests on the hardness of the discrete logarithm problem; the specific coefficient b in curves of the form y^2 = x^3 − 3x + b (mod p) was the focal point because a specially engineered b could make discrete logs feasible for an adversary. Jerry Solinas of the NSA originally said the seeds were generated by hashing an ASCII message but had forgotten the exact procedure, fueling doubt and a 2023 bounty from Philippo Valsorda to reverse-engineer the seeds.

Researchers at Anthropic have now recovered the seed-generation method and demonstrated that Solinas created the seeds in good faith: the process used a date rather than a secret phrase and produces the reported coefficients without a hidden trapdoor. Valsorda verified the work and awarded the bounty. The result removes the primary provenance-based objection to using the NIST curves, highlights that the recovery required heavy brute force plus conceptual narrowing of candidates (not an exploit of the curves themselves), and has led some experts to again favor NIST curves for now, even as post-quantum signatures approach adoption.