The NIST Elliptic Curves Seeds Bounty Has Been Claimed

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

16 Oct 2026 The NIST Elliptic Curves Seeds Bounty Has been Claimed. We now know how the seeds of the NIST elliptic curves were generated: they’re not the hash of some saucy sentence, but the output of drand48 seeded with the time, which was indeed in 1997–98.

2026年10月16日，NIST椭圆曲线种子赏金已被认领。我们现在知道了NIST椭圆曲线的种子是如何生成的：它们并非源于某些俏皮句子的哈希值，而是使用1997年至1998年间的时间戳作为种子，通过drand48生成的输出。

John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini, and Steve Weis from Anthropic solved the riddle and on October 15th, 2026, at 01:07:51 UTC, claimed the full bounty I announced three years ago. They chose to donate the prize to ISRG, the non-profit that operates Let’s Encrypt, tripling its value to $36,864 (36 Ki$).

来自Anthropic的John Wood、Henry de Valence、Ava Howell、Zack Voase、Lucy Sweet、Amir Omidi、Paul Crowley、Iain McGinniss、Nicholas Carlini和Steve Weis解开了这个谜题，并于2026年10月15日协调世界时01:07:51认领了我三年前宣布的全部赏金。他们选择将这笔奖金捐赠给运营Let’s Encrypt的非营利组织ISRG，使其价值翻了三倍，达到36,864美元（36 Ki$）。

Thank you to Amir Omidi, Chris Palmer, Colm MacCárthaigh, David Adrian, David Anderson, Jeff Hodges, Matt Green, Matthew McPherrin, Paul Kehrer, Ryan Sleevi, and Soatok for contributing to the bounty. This helps fill out a page of cryptographic history, and reinforces our confidence in these critical cryptographic primitives.

感谢Amir Omidi、Chris Palmer、Colm MacCárthaigh、David Adrian、David Anderson、Jeff Hodges、Matt Green、Matthew McPherrin、Paul Kehrer、Ryan Sleevi和Soatok对赏金的贡献。这有助于填补密码学历史的一页，并增强了我们对这些关键密码学原语的信心。

The NIST elliptic curves (P-192, P-224, P-256, P-384, and P-521) were published by NIST in FIPS 186-2 in 2000. They were generated at random according to ANSI X9.62 by taking an arbitrary seed, hashing it with SHA-1, and using the output to derive some of the parameters. Until this week, we had no idea how those arbitrary seeds were picked.

NIST椭圆曲线（P-192、P-224、P-256、P-384和P-521）由NIST于2000年在FIPS 186-2中发布。它们是根据ANSI X9.62标准随机生成的，方法是选取一个任意种子，用SHA-1进行哈希处理，并利用输出结果推导出部分参数。直到本周，我们还不知道这些任意种子是如何选取的。

The lore was that Dr. Jerry Solinas, who passed away in early 2023, generated them in 1997 by hashing some English sentences that he later forgot. You can read more in this article by Steve Weis or in the original bounty announcement. Turns out memory can play tricks on everyone: we now know they were instead generated with the POSIX-standard drand48 random number generator.

传闻称，于2023年初去世的Jerry Solinas博士在1997年通过哈希处理一些后来被他遗忘的英文句子生成了这些种子。你可以在Steve Weis的这篇文章或最初的赏金公告中阅读更多内容。事实证明，记忆会欺骗任何人：我们现在知道它们实际上是使用POSIX标准的drand48随机数生成器生成的。

The algorithm is as simple as passing the then-current UNIX timestamp to srand48() and then producing one byte at a time with drand48. Each sequence of 20 bytes is tried as a seed following ANSI X9.62 and rejected if the resulting curve is not valid. Some timestamps are used to generate multiple curves, by continuing to try seeds after accepting the first one. I reimplemented the algorithm in Go to verify the claim. Read more in Anthropic’s writeup.

该算法非常简单，只需将当时当前的UNIX时间戳传递给srand48()，然后使用drand48一次生成一个字节。每个20字节的序列都会按照ANSI X9.62标准作为种子进行尝试，如果生成的曲线无效则被拒绝。一些时间戳被用于生成多条曲线，即在接受第一个种子后继续尝试后续种子。我用Go语言重新实现了该算法以验证这一说法。更多信息请阅读Anthropic的报告。

There are two additional undocumented criteria beyond the ANSI X9.62 ones, one fairly clear and one that still escapes us. If the bit length of the order n of the resulting curve is more than the bit length of the base field p of the curve, the seed is rejected. (The condition is not the stricter n < p, because prime239v2 has p < n < 2²³⁹.) This leaves us with roughly twice as many valid seeds as were published.

除了ANSI X9.62标准之外，还有两个未记录的额外标准，其中一个相当明确，另一个仍未被我们破解。如果所得曲线的阶n的位长大于曲线基域p的位长，则该种子会被拒绝。（该条件并非更严格的n < p，因为prime239v2满足p < n < 2²³⁹。）这使得我们得到的有效种子数量大约是已发布数量的两倍。

We explored a number of explanations for this last bit, and found no good fit. Maybe the same RNG was used to validate seeds, consuming RNG output and skipping some potential candidates, although the “gaps” are not regular. Maybe there was just a bug in one of the algorithms that returned the wrong result half the time; these calculations, which we can now do with off-the-shelf software in minutes, were still very much state-of-the-art in 1997.

我们针对最后一点探讨了多种解释，但没有找到合适的结论。也许是同一个随机数生成器被用于验证种子，消耗了随机数输出并跳过了一些潜在的候选者，尽管这些“间隙”并不规律。也许只是其中一个算法存在漏洞，导致一半时间返回了错误结果；这些计算在今天可以用现成的软件在几分钟内完成，但在1997年仍属于最前沿的技术。

What does this mean for the security of elliptic curve cryptography based on the NIST curves? Well, even before this discovery there were no serious concerns among practitioners. In Section 3.1 of their 2015 paper “A riddle wrapped in an enigma,” Koblitz and Menezes make a convincing argument that it’s implausible that the NSA could have selected a seed to exploit a weakness that escaped more than 15 (now 25) years of cryptanalysis.

这对基于NIST曲线的椭圆曲线密码学的安全性意味着什么？实际上，即使在这一发现之前，从业者中也没有严重的担忧。Koblitz和Menezes在他们2015年的论文《A riddle wrapped in an enigma》第3.1节中提出了一个令人信服的论点，即NSA不可能选择一个种子来利用一个逃过了超过15年（现在是25年）密码分析的弱点。

However, as reported in a later version of that paper, Daniel Bernstein and Tanja Lange described to Koblitz and Menezes in 2017 a technique that could have exploited 70 bits of freedom in selection of the seed to target a hypothetical class of 2⁶¹ weak prime-order curves. (Bernstein is the author of a competing elliptic curve design, Curve25519.) This contributed to enduring conspiracy theories, which had significant appeal among the non-specialist public (although many have since moved on to other, adjacent, conspiracy theories).

然而，正如该论文后续版本中所述，Daniel Bernstein和Tanja Lange在2017年向Koblitz和Menezes描述了一种技术，该技术可以利用种子选择中70位的自由度，针对一类假设的2⁶¹个弱素数阶曲线。（Bernstein是竞争性椭圆曲线设计Curve25519的作者。）这助长了持久的阴谋论，这些理论在非专业公众中具有很大的吸引力（尽管许多人后来已经转向了其他相关的阴谋论）。

All this speculation harmed confidence in robust cryptographic systems and was part of my motivation for the bounty. This week’s findings completely rule out the technique described by Bernstein and Lange. Even if the NSA had been free to pick any timestamp in 1997–98 and any of the first 16 prime-order candidates (which generously accounts for the unexplained rejections), they would have had barely 30 bits of freedom.

所有这些猜测损害了人们对稳健密码系统的信心，这也是我设立赏金的部分动机。本周的发现完全排除了Bernstein和Lange所描述的技术。即使NSA可以自由选择1997年至1998年间的任何时间戳以及前16个素数阶候选者中的任何一个（这已经宽泛地解释了那些无法解释的拒绝情况），他们也几乎只有30位的自由度。

Not enough to intentionally target a hypothetical small class of weak curves, not enough to embed any kind of NOBUS backdoor. Along with deterministic and hedged ECDSA signing algorithms, formally verified field implementations, and the 2015 complete addition formulas by Renes, Costello, and Batina, this nicely completes the

这不足以刻意针对一类假设的弱曲线，也不足以植入任何形式的NOBUS后门。连同确定性和对冲的ECDSA签名算法、形式化验证的域实现，以及Renes、Costello和Batina在2015年提出的完整加法公式，这很好地完善了