Anthropic researchers (John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini, and Steve Weis) claimed a bounty on October 15, 2026 by showing the NIST elliptic-curve seeds were generated with the POSIX drand48 RNG seeded with UNIX timestamps in 1997-98. They donated the prize to ISRG, bringing the total to $36,864. Reimplementing the generation in Go confirmed that srand48(timestamp) produced byte sequences which, when tested under the ANSI X9.62 seed-to-curve process, yield P-192, P-224, P-256, P-384, and P-521 (and prime239 variants) at particular timestamps. The published mapping of timestamps to accepted seed indices and several nonpublished accepted seeds corroborates the claim and is documented in Anthropic’s writeup.
Two undocumented selection rules remain: seeds were rejected if the bit length of the curve order n exceeded the bit length of the base field p (a looser check than n < p), and a second unexplained pattern of rejections halves the expected published set, possibly due to RNG consumption or legacy bugs. Security implications are decisive: the timestamp+seed space gives at most ~30 bits of adversarial freedom, eliminating plausible NOBUS/backdoor scenarios and refuting Bernstein-Lange targeting concerns. Combined with modern ECDSA fixes and verified implementations, this restores practical confidence in NIST curves even as post-quantum signatures approach deployment.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Solène Rapenne describes her self-hosted infrastructure built on Incus OS, focusing on security, automation, and ease of recovery. The setup uses containers and virtual machines to run multiple services securely on a single machine. (dataswamp.org)
Neuralwatt emphasizes that prompt caching significantly impacts energy efficiency in AI models, with cache misses roughly doubling energy use. Proper harness design can reduce unnecessary recomputation, saving both energy and computational costs. (neuralwatt.com)
An integration in Home Assistant scans secrets without user authorization, causing privacy concerns. The user warns that this mechanism could be abused, despite no consent given. (github.com)
Cloudera has been ordered to pay back wages and faces a two-year debarment for discriminating against US workers. The settlement was secured by the U.S. Department of Justice and the Department of Labor. (justice.gov)
911 emergency response system in the US struggles to effectively address mental health crises and properly route emergency calls. This highlights the need for specialized response protocols to improve outcomes. (themarshallproject.org)
Claude revealed that the seeds for the widely used ECDSA elliptic curve standards were generated using a Unix time seed in the C library's random-number generator, not by hashing humorous phrases as previously thought. This discovery clarifies the long-standing mystery about the origins of these cryptographic parameters. (anthropic.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.