Harper: For twenty-five years, a core piece of internet security has relied on a handful of numbers provided by the NSA. And for twenty-five years, no one knew where they came from. They just appeared in the standard.
Darius: Oh, right, this is the thing with the funny passphrase! I always heard the best theory was that it was a hash of some joke, like 'Give Bob and Jerry a raise' or something.
Harper: That was the story. A researcher named Jerry Solinas, who was at the NSA, even said something like that. But he passed away, and the trail went cold. And that whole story, it turns out, was completely wrong.
Darius: Wait, really? So what was it?
Harper: Researchers at Anthropic pointed their AI model, Claude, at the problem. And according to their post, in less than half an hour, it figured it out.
Darius: It brute-forced the passphrase?
Harper: No, that's the genius of it. It didn't look for a phrase at all. It basically acted like a software archaeologist. It hypothesized that in the nineties, you wouldn't write a complex custom thing, you'd just use whatever random number generator was built into the standard C library at the time.
Darius: Okay, that makes sense. You use the tools you have.
Harper: Exactly. And those old generators were weak. Weak enough that they leave fingerprints. Claude scanned the mystery numbers and noticed a pattern in some of them—the top bits were all zero. Which, apparently, is a dead giveaway for a specific generator called `lrand48`.
Darius: So it's a visible flaw. You can just see it?
Harper: Once you know to look for it, yeah. From there, it's just math—fancy math, but known math. You can work backwards from that output and figure out the internal state of the generator when it made the numbers.
Darius: And what was the state? What was the secret ingredient?
Harper: This is the best part. It was the clock. They just seeded the random number generator with the Unix timestamp. The dates all correspond to a period between May 1997 and April 1998.
Darius: That's it? All the conspiracy theories about NSA backdoors, and it was just a programmer running a script on a Tuesday in 1997?
Harper: Basically. And this is why the crypto community is breathing a sigh of relief. A secret, complex process is suspicious. A simple, boring, reproducible one is much, much harder to hide a backdoor in. So this discovery actually makes the standard more trustworthy.
Darius: It’s the best possible boring answer.
Harper: It is. The article even quotes the AI's internal monologue, where it's like 'Wait, this seems too simple, am I in a simulation?' before it confirms the math. Even the AI couldn't believe it at first.
Darius: But the article says there are still open questions. It didn't solve everything.
Harper: Right. It found the origin for most of the main seeds, but not all of them. And it also couldn't figure out where some of the other parameters, the 'base points', came from for the most popular curves. I'll be honest, the mechanics of how it found the ones it did find went a little over my head. Something about another old library called FreeLIP.
Darius: The part that gets me, though, is the skipped curves. For the P-256 curve, the one we use everywhere, the script generated almost two thousand candidate seeds. It took number 1,842. But the article says candidate number 876 was also perfectly valid. Why skip it?
Harper: I'm not so sure this is a closed case because of that. The authors say it's probably not a big deal because the number of skips is small. But you don't just throw out a perfectly good result for no reason. They were filtering for something. We now know how the sausage was made, but we don't know why they picked this specific sausage.
Darius: But if it was a backdoor, wouldn't they have just hidden the whole process? Revealing that it came from a timestamp seems like a weird way to build in a secret weakness. The article makes the point that if weakened curves were that easy to find, they'd be common. It feels more like a bug in their script, or they were checking for some benign property that nobody wrote down.
Harper: Maybe. But it's a gap in the story. It reduces the space for a conspiracy, but doesn't quite eliminate it for me. It's a fun closing chapter, as the authors say, but maybe not the final one.
Darius: Still, the big ghost is out of the machine. And there was a bounty on this, right? For like thirty-six thousand dollars.
Harper: Yeah, and they're donating it to the Internet Security Research Group. So it's a clean end to that part of the story, at least. I'm Harper.
Darius: I'm Darius.