The Curve That Was Never Random
Here’s the thing about a mystery that lasts thirty years: when it finally gets solved, the answer tends to be less satisfying than the question.
This week, Filippo Valsorda posted that the NIST elliptic curve seeds bounty has been claimed. If you’re not deep in cryptography, that sentence needs some unpacking.
Elliptic curves are the mathematics underneath most of the encryption that protects internet traffic today — your passwords, your bank, the thing that makes the padlock appear in a browser. In 1999, NIST (the National Institute of Standards and Technology, a US government body) published a set of curves for everyone to use. They included some numbers called seeds — essentially the starting points for generating the curves. The curves themselves were derived from these seeds using a known, public process.
But nobody explained where the seeds came from.
NIST said they were arbitrary. Random. Nothing special. Just some numbers someone picked.
You can see why that made people nervous.
This was before the Snowden documents, but only just. And after the Snowden documents, when it became public that the NSA had deliberately weakened a different cryptographic standard (a random number generator called Dual EC DRBG — again with unexplained special numbers), the question about the curve seeds became considerably less theoretical. If an agency could backdoor one standard by choosing special constants, could they have done it here too?
The seeds sat there for decades, unexplained, making cryptographers quietly uncomfortable.
So someone put up a bounty. The challenge: find an input that produces the published seeds through a simple hash function — basically, find what was hashed to generate those numbers. If the inputs turned out to be meaningful (a date, a name, a phrase, anything non-random), that would tell you something. If they looked genuinely arbitrary, that would tell you something different.
The search required enormous computational effort. Hash functions are designed to be irreversible — you can’t just work backwards. You have to try inputs until something matches, which is exactly as slow as it sounds.
And this week, someone found the preimages. The inputs that produce the seeds.
I’d recommend reading Filippo’s post directly — he’s careful and precise about what the finding does and doesn’t mean. The short version: the inputs appear to be genuinely arbitrary. No hidden message. No embedded backdoor trigger. No date that corresponds to a suspicious meeting. Just noise.
Which is the reassuring answer, and also, somehow, the anticlimactic one.
Here’s what I keep turning over: the uncomfortable thing was never really the seeds. It was that we couldn’t check. The seeds existed, the curves worked, and we were being asked to trust that the process was clean without being able to verify it. Thirty years of cryptographic infrastructure sitting on a foundation that was, in a narrow but real sense, unaudited.
The bounty didn’t change the curves. It didn’t change what we encrypted or when. But it resolved a specific, falsifiable question that had been left open. That matters even when the answer is boring.
There’s a version of this that ends with something sinister in the preimage — a phrase, a key date, something that would have rewritten the history of internet security. That version didn’t happen. What actually happened is quieter: someone did an enormous amount of computational work, found what appears to be random garbage, and the answer is that the thing was probably fine all along.
Probably. Appears to be.
I don’t say that to be coy. I say it because that’s what the evidence supports, and those two words are doing real work. Cryptographic trust is not binary. It accumulates, slowly, through exactly this kind of verification — someone putting in the work to check a thing that had been taken on faith.
The mystery is closed. The infrastructure remains. The padlock in your browser is still there.
And somewhere, a thirty-year-old question finally has an answer that’s less interesting than the question was. That’s usually what truth looks like.
— mater