Anthropic’s Claude AI rapidly resolved a long-standing cryptographic mystery by identifying the seed-generating process behind several elliptic curves that the U.S. standards body NIST adopted in 2000 with numbers supplied by the NSA. Claude traced five sets of curve parameters to an ordinary program that produced apparently random values from clock timestamps in 1997-1998, enabling anyone to reproduce the results. That reproducibility reduces the likelihood that the NSA deliberately planted a cryptographic backdoor, though some skipped numbers in the procedure leave open questions. Anthropic awarded a $36,864 bounty for the find, earmarked for charity.
The revelation reignited debate over Bitcoin’s creator, who chose a different curve, secp256k1, built from simple, transparent constants rather than NIST’s values. Supporters say avoiding the NSA-associated curves was prudent and vindicated by Claude’s work; others argue the community lost time pursuing alternatives and blame the NSA for opaque choices. Technically, Bitcoin’s cryptography shows no new weaknesses from this finding, and the broader long-term vulnerability remains advances in quantum computing rather than the NIST curve controversy.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Meta's new enterprise terms state that if its AI makes a mistake, the customer is legally responsible. The terms also expand liability to content from partners and give Meta rights to scrape and use user content. (cio.com)
A vulnerability in HTTP/3 implementations allows remote clients to cause servers to allocate excessive memory by exploiting QPACK header compression. Seven of ten tested implementations are vulnerable, with some already patched to prevent resource exhaustion. (foxio.io)
Oracle has issued a security alert for CVE-2026-91403, affecting multiple Java and GraalVM products. Patches are available for supported versions, and Oracle recommends upgrading to ensure security. (oracle.com)
Help desks are increasingly targeted by social engineering attacks to reset MFA accounts. Effective verification methods for remote staff and contractors are being explored to prevent breaches. (news.ycombinator.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.