[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-slug-claude-nist-curve-seeds-lrand48":3,"topics-all":38,"news-related-ac04da32-378f-403c-83c9-4cf2e29948e3":57},{"id":4,"title":5,"summary":6,"content":7,"original_url":8,"source_id":9,"tags":10,"translations":24,"news_slug":31,"published_at":32,"created_at":33,"modified_at":34,"is_published":35,"publish_type":36,"image_url":14,"view_count":37},"ac04da32-378f-403c-83c9-4cf2e29948e3","Claude半小时破解NSA曲线种子25年悬案","NIST椭圆曲线标准ECDSA的种子常数25年来来源不明,社区一度怀疑NSA埋了后门,悬赏3.6万美元无果。2026年10月Anthropic让Claude无提示推理,不到半小时确认:种子来自1997年C库lrand48随机数生成器加Unix时间戳,可逐字节复现,后门论大幅降温。","全球 HTTPS、比特币签名里最常用的椭圆曲线标准 ECDSA,有一个悬了 25 年的疑问:NIST 标准曲线的那串种子常数到底怎么来的?2026 年 10 月,Anthropic 在官方研究页面给出了答案——是 Claude 用不到半小时找到的,而答案平凡得让人想笑:1997 年的一台机器,拿 C 标准库的 lrand48 随机数生成器,用 Unix 时间戳做种子跑出来的。\n\n## 一个悬了 25 年的疑问\n\nECDSA 于 2000 年被 NIST 采纳进 FIPS 186-2 数字签名标准,文档里每条曲线都附了一个\"种子\"参数,其哈希值决定曲线系数。问题是,这些种子由 NSA 提供,却没有任何生成方式的说明。以 P-256 为例,种子是 `C49D3608 86E70493 6A6678E1 139D26B7 819F7E90`,没人知道它从哪来。\n\n密码学界因此怀疑了几十年:NSA 会不会故意挑了带后门的曲线?NSA 员工 Jerry Solinas 2015 年的说法是,种子来自某句幽默短语的哈希,大意是\"给 Bob 和 Jerry 加薪\"。可他 2023 年去世,档案也找不到,线索就此中断。社区甚至挂出了 36,864 美元的悬赏。Anthropic 员工顺着\"短语哈希\"的思路搜过,一无所获。\n\n## Claude 换了个角度\n\n2026 年 10 月,一名 Anthropic 员工让内部研究模型在不提示任何线索的前提下自己推理。Claude 的切入点是:不猜短语,反推 90 年代生成曲线的软件怎么写——那个年代的程序大概率用 C 库自带的伪随机数生成器,而这类老式 PRNG 的输出是有统计特征可识别的。\n\nClaude 写了个扫描器,把每条种子按位滑动,测试相邻片段是否是某款 90 年代生成器的连续输出,一共扫了 34 种组合。突破口是一个肉眼可见的异常:部分种子的最高位全是零,纯靠巧合出现的概率只有 1\u002F5810——这正是 lrand48 只返回 48 位状态中高 31 位的签名。随后它对每个 32 位词暴力尝试 2 的 17 次方种隐藏位取值,验证后续四个词是否吻合,四条种子全部对上;素数曲线的种子截位更狠,恢复内部状态靠的是教科书级的 LLL 格基规约算法,把问题变成一个格问题直接解。\n\n最关键的一步是把生成器状态往回倒推:lrand48 可以逆向运行,当状态回到 srand48 初始化的形态时,十条素数曲线种子的初始化值全是 Unix 时间戳,落在 1997 年 5 月到 1998 年 4 月之间。P-256 的种子是同一时间戳下第 1842 个候选,每段 20 字节,至今任何人都能用官方贴出的几十行 Python 代码逐字节复现。\n\n## 不是攻破,反而是洗白\n\n必须说清楚:这不是密码学破解,ECDSA 曲线本身毫发无损。恰恰相反,结论让\"NSA 蓄意埋后门\"的阴谋论大幅降温——种子来自一个任何人都能复现的弱随机数生成器加系统时钟,可供操纵的空间小得多。Anthropic 团队还顺带解开了一半基点之谜:1997 年 5 月生成的六条曲线(含 P-192 和五条 ANSI X9.62 示例曲线)的基点,来自 Arjen Lenstra 的 FreeLIP 大整数库里的随机数生成器,生成器种子就是 20000、20420 这类小整数。\n\n当然悬念没有全清:P-224\u002F256\u002F384\u002F521 的基点来源未明,B-163 那颗种子对不上任何已知模式,P-256 的运行还跳过了 876 号这个同样可行的候选,筛选标准无从考证。那 36,864 美元悬赏将捐给互联网安全研究组织 ISRG。\n\n## 所以呢\n\n这件事真正的看点,不是密码学出事,而是一个 AI 模型在真实开放科研问题上表现出的\"解题品味\":知道放弃传闻走错的方向,知道从软件工程的时代背景反推实现,甚至在内部思考里先怀疑自己\"是不是处在测试环境里\",再用 160 位全匹配的概率说服自己。当模型开始对\"太顺的结果\"保持警惕,这类 25 年悬案被逐个翻篇,可能只是时间问题。\n\n参考:[Anthropic 官方研究页](https:\u002F\u002Fwww.anthropic.com\u002Fresearch\u002Fecdsa-curve-origins)\n","https:\u002F\u002Fwww.anthropic.com\u002Fresearch\u002Fecdsa-curve-origins","1fa87d30-d9f3-4752-b3be-0373933b3aaf",[11,15,18,21],{"id":12,"name":13,"slug":13,"description":14,"color":14},"5e628969-6d2a-437f-998a-104e4b16cfb1","ai-progress",null,{"id":16,"name":17,"slug":17,"description":14,"color":14},"23544f6a-eea1-4f05-aa8d-749ca862d5d2","anthropic",{"id":19,"name":20,"slug":20,"description":14,"color":14},"dca4d0ab-7994-43a7-839e-7756fc77344a","claude",{"id":22,"name":23,"slug":23,"description":14,"color":14},"02bfdc0f-5e23-4fbb-b31a-7cc03cdba1ee","security",[25],{"id":26,"lang":27,"title":28,"summary":29,"content":30},"21c49645-fd18-41c8-a70a-75dc959e16fb","en","Claude Cracks 25-Year NIST Curve Seed Mystery in 30 Minutes","Claude cracked the 25-year NIST seed mystery in 30 minutes: ECDSA curve seeds came from a 1997 lrand48 RNG keyed by Unix time, not an NSA backdoor.","One of the most widely used elliptic-curve signature standards, ECDSA, has carried an open question for a quarter century: where did the \"seed\" constants behind the NIST standard curves come from? In October 2026, Anthropic's research page finally answered it — Claude found the answer in under half an hour, and it is almost embarrassingly ordinary: a 1997-era machine running the C library's lrand48 random number generator, seeded with a Unix timestamp.\n\n## A 25-Year-Old Question\n\nECDSA was adopted by NIST in 2000 as part of the FIPS 186-2 Digital Signature Standard. For each curve, the specification published a \"seed\" parameter whose hash defines the curve's coefficient. The problem: those seeds were provided by the NSA with no explanation of how they were generated. For P-256, the seed is `C49D3608 86E70493 6A6678E1 139D26B7 819F7E90`, and nobody knew its origin.\n\nCryptographers suspected for decades that the NSA might have deliberately chosen curves with backdoors. NSA employee Jerry Solinas said in 2015 that the seeds came from the hash of a humorous passphrase along the lines of \"Give Bob and Jerry a raise.\" He died in 2023, no archives could be found, and the trail went cold. The community even posted a $36,864 bounty. Anthropic employees had chased the passphrase idea and came up empty.\n\n## Claude Took a Different Angle\n\nIn October 2026, an Anthropic employee asked an internal research model to work it out without being pointed at any clue. Claude's move was to stop guessing phrases and instead reason about how 1990s curve-generation software would have been written: programs of that era almost certainly used the pseudo-random number generator shipped with C libraries, and old PRNGs are weak enough that their output is statistically recognizable.\n\nClaude wrote a scanner that slid along each published seed one bit at a time, testing whether adjacent chunks were consecutive outputs of a 1990s-vintage generator — 34 combinations in total. The breakthrough was a pattern visible by eye: the top bits of some seeds were all zero, which would happen by chance with probability 1\u002F5,810. That is the signature of lrand48, which only returns the top 31 bits of a 48-bit state. Claude then brute-forced all 2^17 values of the 17 hidden bits for the first word and checked that the next four words followed — it worked for all four seeds. The prime-curve seeds kept even fewer bits, and recovering the internal state became a textbook lattice problem, solved with LLL basis reduction.\n\nThe decisive step was running the generator backwards: lrand48 inverts as easily as it advances. When each state stepped back to the form srand48 would initialize, all ten prime-curve seeds decoded to Unix timestamps between May 1997 and April 1998. P-256's seed was candidate number 1,842 under its timestamp, 20 bytes per candidate — and today anyone can reproduce it byte-for-byte with the few dozen lines of Python Anthropic published.\n\n## Not a Break — an Acquittal\n\nTo be clear: this is not a cryptographic break, and the ECDSA curves are unharmed. If anything, it weakens the NSA-backdoor theory considerably — the seeds came from a weak, reproducible PRNG initialized from the system clock, leaving far less room for subversion. The team also explained half of the base-point mystery: the base points of the six curves generated in May 1997 (P-192 plus five ANSI X9.62 example curves) came from the random number generator inside FreeLIP, Arjen Lenstra's big-integer library, with generator seeds as small as 20000 and 20420.\n\nLoose ends remain: the base points of P-224\u002F256\u002F384\u002F521 are still unexplained, the binary seed B-163 fits nothing tried so far, and P-256's run skipped candidate 876, which would also have produced a viable curve — the selection criteria are unknown. The $36,864 bounty will be donated to the Internet Security Research Group.\n\n## So What\n\nThe real story here is not a cryptography incident but a display of research taste by an AI model: knowing to abandon the rumor-driven direction, reasoning from the engineering context of the era, and — in its own internal thinking — first suspecting it might be inside a simulated test environment, then convincing itself with the 160-bit match. When models start doubting results that look too good, 25-year-old open questions may just start falling one by one.\n\nReference: [Anthropic research page](https:\u002F\u002Fwww.anthropic.com\u002Fresearch\u002Fecdsa-curve-origins)\n","claude-nist-curve-seeds-lrand48","2026-10-17T19:20:00Z","2026-10-17T19:09:18.240393Z","2026-10-17T19:09:18.240412Z",true,"agent",97,[39,48],{"slug":40,"tag_slug":40,"title_zh":41,"title_en":42,"intro_zh":43,"intro_en":44,"id":45,"is_active":35,"created_at":46,"modified_at":47},"ai-for-science","AI for Science 2026：从 UniPert 到 GPT-Rosalind 的硬核进化","AI for Science 2026: from UniPert to GPT-Rosalind","生命科学、化学材料、物理世界模型——AI 正在从\"语言工具\"变成\"实验伙伴\"。本专题收录 AI 在三大科学方向的关键节点：UniPert 统一基因与化学扰动空间、GPT-Rosalind 端到端生命科学推理、达摩院 AI 智能体 28 小时找到 4 种超导新材料、Anthropic Claude Science 把工作台做成标准品。","From language tool to lab partner — AI is reshaping life sciences, chemistry\u002Fmaterials, and physical world models. This topic covers the key milestones: UniPert unifying genetic-chemical perturbation spaces, GPT-Rosalind's end-to-end life-sciences reasoning, DAMO's AI agent discovering 4 superconducting materials in 28 hours, and Anthropic's Claude Science workbench going mainstream.","988a4300-5fab-41c4-b5d8-63711a2dc757","2026-09-10T01:34:15.296649Z","2026-09-10T01:34:15.296663Z",{"slug":49,"tag_slug":49,"title_zh":50,"title_en":51,"intro_zh":52,"intro_en":53,"id":54,"is_active":35,"created_at":55,"modified_at":56},"h3-series","MiniMax H3 系列：从开源权重到 35 倍吞吐","MiniMax H3 Series: from open weights to 35x throughput","MiniMax H3 自 2026 年 8 月开源以来节奏密集：官方把生成、参考与编辑收回一个模型；ComfyUI 当天压进 RTX 3060；摩尔线程 3 小时完成国产 GPU 适配；fal 后训练版把吞吐拉到 35 倍；FastH3 蒸馏再砍推理成本。本专题持续追踪 H3 的发布—开源—蒸馏—部署全链路。","Since MiniMax open-sourced H3 in August 2026 the pace has been relentless: one unified omni-modal model, same-day ComfyUI support down to an RTX 3060, a 3-hour Day-0 port to Moore Threads GPUs, fal's post-trained H3 Max at 35x throughput, and FastH3 distillation cutting inference cost further. This topic tracks the full H3 chain — release, open weights, distillation, deployment.","83ef0daa-3c31-4cb3-86ed-e5ee58654d5f","2026-09-08T07:33:19.942193Z","2026-09-08T07:33:19.942209Z",{"items":58},[59,64,69,74,79,84],{"id":60,"title":61,"news_slug":62,"published_at":63},"5796d012-e921-4760-b58f-653b90c151b1","Claude 削攻击面:25 个开源项目 493 处问题","claude-attack-surface-reduction-openssh","2026-10-22T05:20:00+00:00",{"id":65,"title":66,"news_slug":67,"published_at":68},"a7a8ca05-6134-4b27-8dc0-ae3c0a764630","Claude 自主设计量子电路:53 小时拿到一个数量级提速","claude-quantum-circuit-redesign","2026-10-19T10:00:00+00:00",{"id":70,"title":71,"news_slug":72,"published_at":73},"390c2437-4e4f-45ec-8270-67c5bfa4fa47","ChatGPT、Claude、Grok、Gemini 罕见同时下线,周四早晨全球 AI 集体失声","chatgpt-claude-grok-gemini-thursday-outage","2026-09-05T06:00:00+00:00",{"id":75,"title":76,"news_slug":77,"published_at":78},"3b255a3f-1206-4f5b-9f34-824c4e0355f1","Claude 11 天写下费马大定理首个机器验证证明:1300 万行 Lean 代码","claude-fermat-last-theorem-lean-proof","2026-09-04T21:05:15+00:00",{"id":80,"title":81,"news_slug":82,"published_at":83},"03ed8da8-e7e1-427c-9387-faeb985fa50f","Anthropic 最贵模型 Fable 5 发布两月,企业支出占比仅 11%","anthropic-fable-5-ramp-11-percent","2026-09-01T04:00:00+00:00",{"id":85,"title":86,"news_slug":87,"published_at":88},"39724847-fdc9-4199-ac46-311e7b49d385","Ramp 数据复盘 Fable 5:旗舰上市两月仅占企业 Anthropic 支出 11%,70 倍价差压住前沿模型溢价","ramp-data-fable-5-adoption-plateaus","2026-08-26T08:00:00+00:00"]