I am Paul Ducklin, joined as usual by David Emerson, CTO and Head of Operations at SolCyber.
Hello, David.
DAVID. Hey, there.
DUCK. We have the third in our occasional series, David, of Classic Crypto.
It goes back to the 1990s, but deals with a solution to a thorny issue – not a problem, an issue – that was only solved in the last week or so.
And so my subtitle is, “The Seeds of Time.”
And it has to do with, “How did NIST and the NSA in the US decide on the elliptic curves for cryptography that they introduced in the late 1990s?”
DAVID. We have a couple of things intersecting here, not the least of which is that Anthropic, which is attempting to go IPO․․․
․․․is seeking a valuation north of US$1.5 trillion.
DUCK. [LAUGHS] That’s almost a number that beggars belief.
It’s almost cryptographically absurd, isn’t it?
DAVID. Yes, it’s certainly in that magnitude.
And so there have been a number of headlines – this included everything from publishing discoveries in science and mathematics, to cryptography.
And I think some of those are aligned with this impression they’re trying to lead into the market, which is, “This is a real capable system.”
By lore, this guy named Jerry Solinas had indicated in about 2015․․․
DUCK. That’s lore L-O-R-E, not L-A-W, right?
DAVID. No, no․․․
Jerry Solinas indicated that the seed that defined the elliptic curve that was going to be used for the polynomial values on this cryptographic algorithm was a hash of a joke.
In 2015, he indicated that was the case.
He did mention that he had forgotten the joke, if he knew what it was, so it’s entirely possible the joke was, “The seeds of time.”
Who knows?
DUCK. Maybe we should just explain, at this point, David, that when you think about a random number generator, the idea of a seed for a deterministic random bit generator, as NIST likes to call them․․․
The seed for those means that you can generate the same sequence of values over again, which is important if you want to repeat a simulation exactly.
But here, the idea is the seed generates some starting value, and from the starting value, you generate the elliptic curve parameters.
And then, by explaining that you generated the seed using this joke text that you ran through a weird randomizing algorithm, other people can verify that they get the same curve parameters.
This helps avoid the whole drama of, “What made you choose this weird prime number that’s yay long? Is there some skulduggery?”
But the NSA never said where that magic starting seed came from.
DAVID. Yes.
DAVID. It was just, “Oh, we hashed a joke.” [LAUGHS]
“Well, which joke?”
“Oh, we can’t remember.”
DAVID. Coming from an NSA project, I think it also gets treated with a heavy skepticism.
There have been many cases where the NSA has been caught red-handed doing things that are beneficial to the interests of the NSA.
DUCK. [FAKE INCREDULITY] Really?
Surely not, David.
There is a history of governments wanting to meddle in cryptography, isn’t there?
Particularly in the US, where it was regulated as munitions until about the year 2000 – I think Bill Clinton finally got rid of that?
DAVID. Yes.
DUCK. In Britain, it was even worse.
We invented public-key cryptography before the Americans did, and we decided [A] not to use it, and [B] not to tell anyone.
Even when you guys told the world, we decided, “We won’t admit we knew about it earlier because we don’t want people to know how clever we are.”
That was a marketing opportunity down the toilet, but there you go. [LAUGHS]
So governments and cryptography have a checkered relationship, don’t they?
DAVID. Yes, and this was probably the cleanest, actually most innocent answer to get about the seeds in the first place.
DUCK. Yes.
DAVID. This truly is an indication that those seeds were generated without intent, in some way, to bamboozle the user into acting in the interest of the NSA.
That’s kind of cool, and it doesn’t weaken the actual underlying algorithm, and certainly, in my mind, doesn’t weaken it materially against the weaknesses that exist in implementation in practice.
The fact is that quantum decryption is imminent, I believe.
There will be a cryptographically relevant quantum computer soon that can execute Shor’s algorithm on this and break everything up to 112-bit.
DUCK. Soon?
Should we have a wager here on the podcast?
I’m cynical and skeptical compared to you, but it doesn’t really matter.
The point is, this is a fantastic opportunity, even if you’re as skeptical as me, to say, “Why don’t we practice making this change promptly, because we never know when the next problem might arise.”
MD5 was broken years and years ago, and it still lives on in some places, but how hard should it be to change it?
DAVID. I’d like to get you on some calls with some of the people we advise, maybe. [LAUGHS]
I feel like that’s the broken record that we end up playing for a lot of things, right?
Like, how hard can this possibly really be?
DUCK. But this is a great story.
The way they generated these supposedly random curve parameters, that could not easily have been manipulated to be the ones they want, turned out to be something that you wouldn’t expect from top-level cryptographers.
They used a 1990s or 1980s-style crummy random number generator, which is how Claude and the researchers happened upon the fact that they probably just used the Unix timestamp of the second when they ran the program to make the seed.
And it’s probably as simple as that. [LAUGHS]
DAVID. I think every seed that they identified came from either 1997 or 1998.
It’s a pretty bounded set of things.
DUCK. Anthropic, they’ve written a nice paper where they showed 20-byte seeds broken into five lots of four bytes.
So, they’re DWORDs, 32-bit values, and they’ve highlighted the high hex digit in each, and they’re all less than 8, which means these 32-bit numbers are all 31-bit numbers.
In other words, they probably used a random number generator that produced 31 bits instead of 32 bits.
“We’ll clear out the top bit, so the numbers always come out zero or positive.”
And that smells like the old C function rand() or the function lrand48(), which is what a brief brute-force attack showed that it almost certainly was.
So it’s really obvious when you know what to look for, but for, what, 25 years, nobody noticed? [LAUGHTER]
DAVID. Well no one, probably until now, had ready access to this much compute, and to this much associative power, and a $1.5+ trillion company at the point where it needs to increase its valuation, right?
There are a lot of things happening!
DUCK. Yes, so they can have 10 people working full time, looking for funky stuff.
Would you agree that what’s settled here is all this fuss about how NIST couldn’t explain whether the parameters for the elliptic curves they introduced in the late 1990s were truly randomly generated, or whether they had maybe picked ones to suit themselves.
It looks now as if, literally, they are the seeds of time.
DAVID. Yes, that is the joke.
The joke, in fact, is the selection mechanism.
DUCK. For all that we’ve been cynical about their reasons for doing this – maybe they just want to boost their IPO value – I did like the way Anthropic started the article.
It says, “It’s just timestamps.”
“The decades-old mystery of the origins of one of the most popular cryptographic standards has been explained.”
[LAUGHTER]
When they were asked, surely the people who’d done the code would not have forgotten that they used lrand48()?
Do you think they’ve got secrecy and confidentiality so ingrained that they just come up with a non-dishonest but unspecific explanation?
Or do you think they were crushingly embarrassed that it would come out they just used some crappy random number generator that happened to be available on every Unix?
[LAUGHTER]
If you’re a LinkedIn user and you’re not yet following @SolCyber, do so now to keep up with the delightfully useful Amos The Armadillo’s Almanac series. SolCyber’s lovable mascot Amos provides regular, amusing, and easy-to-digest explanations of cybersecurity jargon, from MiTMs and IDSes to DDoSes and RCEs.
Even if you know all the jargon yourself, Amos will help you explain it to colleagues, friends, and family in an unpretentious, unintimidating way.
DAVID. I mean, who knows?
The only story that I heard about the seeds was published in 2015.
It was an interview with Jerry Solinas, which I previously mentioned.
He was saying that the primary author told this Steve Weis guy that he had given him a joke.
And I feel like it was maybe not an obtuse answer so much as a game of Telephone, potentially.
DUCK. Yes.
DAVID. Or a misremembrance, right?
Like, this is an easy thing to conflate, the joke being “the seed of time.”
DUCK. And, to be fair, Jerry Solinas did say, according to the quote in the Anthropic article, “I believe there was a counter rather than multiple hashing.”
And that is fundamentally true, right?
A timestamp is a monotonic increasing counter, isn’t it? [LAUGHS]
DAVID. I really don’t think that we’ve proven that there was any kind of subterfuge here on the part of the NSA.
You know, I think this sort of validates the algorithm, which, by the way, is very old and needs to be replaced anyway.
But, at the very least, this is one instance where it doesn’t appear there’s still room in the bit depth for the NSA to have created a “nobody but us” kind of backdoor.
DUCK. Maybe their goal was to get us all wasting loads of time, until Anthropic came along with a billion GPUs.
But it does put a little more of a human face on the NSA, in my opinion.
Jerry Solinas, sadly․․․ he died in 2023.
So he didn’t see the end of this.
DAVID. In the public eye, I think some of this is what you saw with the publication of REA, the Reverse Engineer Anything packages on GitHub.
DUCK. Yes.
DAVID. That was maybe two weeks ago.
DUCK. That’s a great topic for another podcast!
So, write that down, David.
That’s a fun thing as well.
DAVID. Yes, and I think that that’s partially what you’re seeing here.
“Oh, my God, if they can do this with Photoshop․․․” I don’t remember what they’re calling it, ArtCraft?
“If they can do this with closed source, is anything safe?”
And, “Oh, if they can reverse engineer these seeds, are weaker things that do depend on seeds safe?”
And the answer is, “No.”
But we are in an age where the Library of Babel is real; we have infinite monkeys now on infinite typewriters; and you can make any code that you want.
So, whether it’s by reverse engineering, or whether it’s by forward engineering because of prompting and active vibe coding, I think that it matters little how something is made.
You need to start adapting to the world in which all of these things are possible; in which it’s possible to reverse a seed; in which it’s possible to reverse your closed source code that you thought previously impenetrable; and in which it’s possible to simply create an open source product that is an alternative to a closed source product.
All of these things are now on the table, and I don’t really think there’s a massive distinction between them.
DUCK. It’s almost as though there’s only an upside, isn’t there?
Which is that security-through-obscurity was never a good idea; it’s never worked; and now you can’t, for a moment, claim that it does.
DAVID. Yes, exactly.
DUCK. The tools have always been there.
For REA, as I understand it, there are very few brand-new tools that it will hook into to do reverse engineering.
DAVID. It’s just the scale and the associative ability that we have now.
It really is nothing new, technically, but the scale was not previously worth it.
Nobody wanted to spend the money to plow through a gigantic binary and convert it to Rust.
DUCK. Although this may have been designed to talk up Anthropic’s IPO valuation, and make their share price shoot up when they go live, it is an interesting report.
DAVID. They haven’t turned a profit yet, but it turns out you can use an LLM for something.
[LAUGHTER]
Have you been to the website isaiprofitable?
It’s definitely something to take a look at.
Essentially, it lays out, by company, the expenditure and the total revenues against that expenditure.
DUCK. [TYPING] I-S-A-I-P-R-O-F-I-T-A-B-L-E-.C-O-M [THWACK OF ENTER KEY]
DAVID. Negative $344 billion at the moment, but it’s real-time accounting for the spend on AI.
[LAUGHTER]
My point, really, is that if you’re Anthropic, this is the shenanigans you have to pull in order to justify a $1.5 trillion valuation when you’ve actually lost $11 billion somehow in the last 10 years.
DUCK. Now, that is a beautifully cynical website, isn’t it?
All the figures are literally in the red.
DAVID. Yes.
DUCK. Negative $344 billion – Amazon.
DAVID. Except for the chip makers.
Get down to the bottom, and the chip makers are making out like gangsters.
DUCK. AMD, Micron, and NVIDIA. [LAUGHS]
Massively profitable!
Roundabouts and swings, but almost on a galactic scale.
So what do we learn from all of this, David, apart from the fact that security-through-obscurity never worked.
But if you still thought you could convince yourself otherwise, here’s some tangible evidence that you were deluding yourself, and everyone else.
What can we learn beyond that?
DAVID. Beyond that, implementation matters more than worrying about the specific algorithm.
ECDSA is not compromised.
Even if ECDSA were compromised in the way of some other algorithms, which were provably strong but nonetheless canted in the favor of the NSA; even if it were․․․
․․․fundamentally, the things that people have done to implement it are the biggest vulnerability.
Sony, in the PlayStation, used a code value that was always static when they did ECDSA.
And so, in 2010, there was a talk where a researcher extracted Sony’s signing key and published it.
There have been flaws in Android’s implementation of ECDSA.
There have been flaws in Putty for, I don’t even know how many versions, like 20 versions?
Putty was generating signing values with ECDSA where the top 9 bits were always zero, so 60 signatures would be enough to recover the key.
DUCK. Do you remember the Debian fiasco of, what was it, 10, 15 years ago?
DAVID. I don’t, no.
DUCK. Someone did an automated code review.
There was something that said, “Hey, this code seems to use values that are not properly initialized. You should not use this code.”
So it all got removed.
So there was some build of Debian where the random number generator had basically, I’m kidding you not, 15 bits of entropy by default.
DAVID. Oh.
DUCK. All of the stuff that they tried to do to get non-determinism into a deterministic system got removed.
This code “improvement” left the random number generator based on one pid, process ID, and on Linux, by default, the maximum value it could have was 32768․․․ 215.
DAVID. Yes.
DUCK. That’s someone actually improving code, based on some kind of automated code review that they did not understand.
And that’s not the fault of AI.
DAVID. Yes.
DUCK. That’s the fault of people going, “You know what? Should I take a shortcut and still look really clever, or should I do it properly?”
DAVID. That really is, I think, the biggest lesson here.
The problem probably isn’t ECDSA. [LAUGHS]
It’s probably your implementation of it.
DUCK. Yes.
DAVID. We could go on, but there really are a lot of examples of this kind of breaking implementation that essentially weakens it to the point that it doesn’t matter how strong the underlying algorithm was.
And then I think the second point is that things change.
Algorithms are broken; cryptographically-relevant quantum computing may emerge.
This is a limited lifespan algorithm – this is not an algorithm that was intended to live forever.
NIST wants you replacing this by 2035; that timeline hasn’t changed.
You must move on from deprecated algorithms or you will reap the wages of your lack of discipline.
[LAUGHTER]
I don’t know what to say.
DUCK. You will pay for the seeds of time, basically, won’t you?
DAVID. Right.
DUCK. Because, ironically, if you go to the link where these seeds that are being talked about here was originally published on NIST’s own site, the first page of the document is a big red block.
And it says, “Don’t use this document anymore. We’ve updated it.”
And the reason is that they had really short keys, that we can now crack, that they’ve removed.
So, I think you’re right.
The problem is almost certainly not going to be some funky quantum computer; it’s not going to be that someone actually figured out what those curve parameters were in advance and chose them dodgily in 1997.
The problem is going to be that somebody uses the best cryptographic implementation in the world, keeps it bang up to date․․․
․․․and just in case you forget your private key or lose it, they have a hard-wired password in there as well.
DAVID. Yes, or they forget that the pid is actually what’s setting all of this. [LAUGHS]
DUCK. Yes, or that French freezer debacle, which seems to have depended on the fact that there was a “totally random” password that was deterministically generated from the date. [LAUGHS]
“Because it’s too hard to do it properly.”
So if you had to put it in one sentence, David, what would that sentence be?
DAVID. Implement carefully; practice ongoing hygiene.
DUCK. And don’t be afraid to change when change is necessary?
DAVID. That’s practicing ongoing hygiene!
Come on, you gave me one sentence.
[LAUGHTER]
DUCK. Yes, I was thinking I could use a semicolon, or a comma and an “and”․․․
DAVID. Ah, I see, I see. [LAUGHS]
Very LLM of you.
Maybe an em-dash?
DUCK. Very run-on sentency․․․
DAVID. [LAUGHS] Yes.
DUCK. David, thank you so much for joining me on this episode.
It was great fun.
It’s great to talk about something that an LLM has found that is interesting and important, but doesn’t mean the end of the world, and actually reminds us of that lesson that you just taught to us.
So, thanks to everybody who tuned in and listened.
If you like this podcast, please subscribe on your favorite podcast feed.
Maybe leave us a comment, and rate us online?
That helps us a lot.
Promote us on social media – tell your friends, your family, your colleagues, especially your boss.
And please visit https://solcyber.com/blog, where you’ll find lots more content of this sort: low on sales schpiel ,and high on fun with a serious side.
Oh, and remember, until next time, stay secure.
DAVID. Especially your boss.
DUCK. [LAUGHS]
[FX: CALL ENDS]
Catch up now, or subscribe to find out about new episodes as soon as they come out. Find us on Apple Podcasts, Audible, Spotify, Podbean, or via our RSS feed if you use your own audio app.
Why not ask how SolCyber can help you do cybersecurity in the most human-friendly way? Don’t get stuck behind an ever-expanding convoy of security tools that leave you at the whim of policies and procedures that are dictated by the tools, even though they don’t suit your IT team, your colleagues, or your customers!
Paul Ducklin
10/29/2026
Share this article:
Table of contents:
The world doesn’t need another traditional MSSP or MDR or XDR.
We start with identity and end with transparency — protecting where attacks begin and keeping you informed, with as much visibility as you want. No black boxes, just clear, expert-driven security.
I am interested in SolCyber Foundational Coverage™
I am interested in a Free Demo
15320
We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it. Privacy policy
