Anthropic研究团队在2026年10月15日成功解开了困扰密码学界的谜题，破解了NIST椭圆曲线（P-192、P-224、P-256、P-384、P-521）种子参数的生成方式12。该发现解决了一项悬赏三年的密码学挑战，团队因此获得36,864美元奖励2。
研究表明，这些曲线的种子并非如已故密码学家Jerry Solinas此前所述通过哈希英文句子生成，而是在1997年5月至1998年4月间使用drand48伪随机数生成器以Unix时间戳为初值生成12。其中NIST P-256种子为C49D360886E704936A6678E1139D26B7819F7E90，需经过1842次迭代才能输出标准化种子1。二进制曲线（B-233、B-283、B-409、B-571）的种子初始化时间均为1998年4月17日1。部分基点则来自FreeLIP随机数生成器，其中P-192的生成器种子为200001。
这项发现具有重要的安全意义——它完全排除了密码学家Bernstein和Lange所描述的技术可能性，确认NSA无法通过选择时间戳来攻击或在曲线中植入后门2，从而增强了人们对NIST曲线安全性的信心1。由John Wood、Henry de Valence、Ava Howell、Zack Voase、Lucy Sweet等十名成员组成的Anthropic团队已将全部奖励捐赠给了运营Let's Encrypt的非营利组织ISRG12。不过，B-163曲线的一个种子仍未被解释，P-224、P-256、P-384、P-521的基点生成方式也仍有待澄清1。
Anthropic researchers have solved a 25-year cryptographic mystery by determining how the seed parameters for NIST elliptic curves were generated.12 The team discovered that the seeds for curves including P-192, P-224, P-256, P-384, and P-521 were not derived from hashed English sentences as previously theorized, but rather generated using the lrand48 pseudorandom number generator seeded with Unix timestamps between May 1997 and April 1998.12 The breakthrough, announced on October 15, 2026, confirmed that the curves contain no hidden backdoors or intentional weaknesses, significantly bolstering confidence in their security.2
The research team, comprising ten members from Anthropic including John Wood and Henry de Valence, successfully claimed a $36,864 bounty that had been outstanding for three years.12 For the P-256 curve specifically, the seed value C49D360886E704936A6678E1139D26B7819F7E90 required 1,842 iterations of the pseudorandom generator to produce the standardized seed.1 The findings demonstrate that the NSA could not have introduced vulnerabilities through strategic timestamp selection, eliminating concerns raised by cryptographers Bernstein and Lange regarding potential attack vectors.2 The team donated the full prize amount to the Internet Security Research Group, the nonprofit organization that operates Let's Encrypt.2
Despite this progress, some questions remain unresolved.1 One seed parameter, designated B-163, has not yet been explained, and the derivation methods for the base points of P-224, P-256, P-384, and P-521 remain unclear.1
评论
还没有评论，欢迎留下第一条。