Mikael

The NSA mathematician who made the numbers protecting your passkeys died in 2023 without ever remembering how he made them. Cryptographers chased the answer for years and put up a $36,864 bounty. Claude figured it out in under 30 minutes, and the answer was the clock on his computer. His name was Jerry Solinas. Back in 1997 he generated the starting numbers for P-256 and a few sibling curves, the math underneath your passkeys and a big chunk of the secure websites you visit every day. NIST published them in 2000 with no explanation of where they came from, and for a long time people mostly shrugged. Then 2013 happened. The Snowden files showed the NSA had slipped a backdoor into a different crypto standard, and suddenly every unexplained number the agency had ever handed out looked suspicious. These were the most widely used ones of all. Jerry's own story was that he'd hashed a joke sentence, something along the lines of "Give Bob and Jerry a raise," and then lost it when his work computer got swapped out. He tried to recreate it himself and never could. He even joked that any backup was probably sitting in the same warehouse as the Ark of the Covenant. After he died, Steve went digging. He tracked down former NSA people and old cryptographers, and four of them independently told him the same joke-phrase story. Filippo Valsorda turned that into a bounty in 2023, and for three years people threw computing power at every version of that sentence they could dream up. A few folks at Anthropic took a crack at it too, Steve among them. He's now one of the people credited on the solve. None of it matched. So someone at Anthropic tried something different. They asked an internal Claude model to figure out where the seeds came from and purposely left out the joke-sentence clue. Claude's first move was to think like a programmer in 1997. If you needed random numbers back then, you probably grabbed the basic generator that came with the C library on your Unix machine, and those old generators are simple enough that they leave fingerprints in their output. Sure enough, in four of the seeds the top bit of every 32-bit chunk was a zero. The odds of that happening by accident are about 1 in 5,810, and it's the calling card of a generator called lrand48. And this is where it gets fun. lrand48 runs in reverse just as easily as forward, so Claude rewound each seed back to the moment the generator was switched on. Every prime-curve seed rewound to a date and time from 1997 or 1998. Whoever ran the program had seeded it with the computer's clock. P-256's run started at 1:52:34 AM UTC on August 16, 1997. If that machine was at NSA headquarters in Maryland, somebody hit enter at 9:52 on a Friday night, and the seed that ended up in the standard was the 1,842nd one the program spat out. Jerry's joke sentence was never in there. He misremembered, four people faithfully repeated what he told them, and some very good cryptographers spent years trying to crack a hash of a sentence that nobody ever typed. Leaving the clue out is probably what let Claude get there in half an hour. I love the irony here. Using the clock to seed a weak random generator is one of the first things they tell you never to do in a security class. That exact laziness is why anyone can now rerun the NSA's 1997 program on a laptop and get the identical numbers, which makes it really hard to argue anything sneaky was hidden inside them. There's still one thing left to argue about. In the P-256 run, number 876 also would have made a perfectly good curve, and someone skipped it and kept going to 1,842. Anthropic says so few got skipped that it couldn't have been a hunt for a weak curve, but nobody knows why it happened. Claude's own notes from that moment are pretty funny. When the numbers matched, it actually stopped and wondered whether it was inside a test, since a 25-year-old mystery falling apart that fast seemed too good to be true. Then it reran the logic and talked itself into it, because ten curves each regenerating perfectly from a single timestamp doesn't happen by luck. The $36,864 is going to the nonprofit that runs Let's Encrypt, the group that gives free security certificates to millions of websites, a lot of them built on these same curves.