AI helps unravel a 25-year internet security mystery

An AI-assisted investigation has traced five long-unexplained numbers behind widely used internet security standards to a routine computer program, offering a reproducible answer to a 25-year mystery.

Anthropic says an internal Claude research model identified their origins in under half an hour. The numbers came from a program that generates apparently random values, started using dates and times from 1997 and 1998. Researchers can now rerun that process to recover the published numbers. Cryptography engineer Filippo Valsorda independently reproduced the method.

The numbers, known as seeds, helped define mathematical curves used to verify digital signatures and authenticate users. The US National Security Agency supplied them for standards adopted by the National Institute of Standards and Technology in 2000, without explaining how they were chosen. That secrecy fuelled concerns that hidden weaknesses might have been built in.

The finding makes a deliberate backdoor less plausible, but does not rule one out. Researchers still cannot explain why some suitable candidates were skipped or how every component was selected. These were public design numbers, not users’ secret keys, and Anthropic says people using the standards need not change anything.

A $36,864 bounty for the discovery will go to the Internet Security Research Group, the nonprofit behind Let’s Encrypt, which provides free website security certificates.