The clock does not pick the point.
Anthropic published the note on October 16. https://www.anthropic.com/research/ecdsa-curve-origins. The line under the title is “It’s just timestamps.” The next paragraph says there is no action to be taken. @sweis, one of the ten authors, pasted the not-a-break sentence into replies. https://x.com/sweis/status/2111461978074198175. When I read that one it had 142 likes, 5 reposts, 2 replies, and 16,244 impressions. The reply from the day before is the one that still has a question in it. https://x.com/sweis/status/2111177417817825315. 65 likes, 7 reposts, 6 replies, 11,031 impressions. He asked why a few candidates were skipped. One viable curve for P-256. Three for P-224. He had not found a pattern, or a test that failed on the skipped ones, including attacks invented after 1997.
The shorter posts close the file. @SparkyMark96 at 19:55 UTC on October 16 wrote that Claude solved a 25-year cryptography mystery, and that the seeds came from a basic 1990s generator seeded with the clock. https://x.com/SparkyMark96/status/2111184345029317039. Forty impressions when I read it. @conradlotz on October 17 put “under 30 minutes” in the first line. https://x.com/conradlotz/status/2111445813935091929. Forty-nine impressions. @The_Tradesman1 the same morning led with the timestamp line. The long text under that post does mention the open base points. https://x.com/The_Tradesman1/status/2111398044122112291. 150 impressions. The half-hour sentence is the one getting copied.
Filippo Valsorda posted the bounty note the same day. https://words.filippo.io/seeds-solved/. The team claimed it at 01:07:51 UTC on October 15. They donated, so the prize is $36,864, paid to the Internet Security Research Group.
I ran the Python on the Anthropic page. I did not run his Go port, and I did not test whether a skipped candidate is prime order.
What the half hour found
ECDSA is the signature standard NIST put in FIPS 186-2 in 2000. The prime curves publish a 20-byte seed. A hash of that seed sets a coefficient of the curve. The spec does not say how the seed was picked. P-256’s seed is C49D3608 86E70493 6A6678E1 139D26B7 819F7E90.
The rumor was a hash of a sentence. The page quotes Jerry Solinas in 2015. He thought the code hashed something like “Give Bob and Jerry a raise,” that Bob Reiter wrote it, and that neither of them could find the archive. Solinas died in 2023. Employees at Anthropic chased that phrase and got nothing.
In October someone asked an internal research model to find the generator, and did not hand it the phrase. The page says the model had the NIST P-192, P-224, P-256, P-384, and P-521 seeds in under half an hour. None of them is a hash. Each one is output from lrand48, started by srand48 on a Unix time.
The recipe on the page is short. Shift the timestamp left by 16 bits and set the low 16 to 0x330E. That is the state srand48 writes. Step the generator. For a prime-curve candidate, take 20 bytes from the top 8 bits of the state. P-256 is candidate 1,842 of a run that started at 01:52:34 UTC on August 16, 1997. I ran that loop. It printed C49D360886E704936A6678E1139D26B7819F7E90. That is the seed in the standard. The other four NIST prime seeds on the page matched too.
Ten prime-curve seeds, the five NIST ones and five from ANSI X9.62, sit on timestamps from May 15, 1997 to April 3, 1998. Four of the ten have the top bit clear in every 32-bit word. The page puts the chance of that at 1 in 5,810, and treats it as the mark of lrand48, which returns 31 bits of a 48-bit state.
The four binary curves they could recover do not read as 1998 until you double the timestamp. Raw, they look like February 1984. Doubled, they land on April 17, 1998, two weeks after the P-224 run. The page says the program may have halved the clock. That is a fit, not a recovered source file.
Valsorda describes the same family as drand48, one byte at a time. I am not treating the two programs as the same file. He says he reimplemented it in Go and the published seeds came out. A 2017 note from Bernstein and Lange, as he reports it, needed about 70 bits of freedom to aim at a hypothetical class of 2^61 weak prime-order curves. If you let someone pick any timestamp in that year and any of the first 16 prime-order candidates, he counts barely 30 bits. Not enough for that method. He writes that this rules the method out. I did not redo the bit count.
The candidate they did not publish
Candidate 1,842 is not the first valid curve in that run.
Anthropic says candidate 876 of the same P-256 run also gives a prime-order curve of the right size, with the parameters chosen the same way, and they did not publish it. P-224’s run passed three. The two ANSI runs passed seven more. Valsorda lists the unpublished P-256 seed as the 876th accepted seed, prefix 50c7. My loop at 876 printed 50C71A63F911DB7B2F31618ECF609D37154437F9. I matched the prefix. I did not check the order.
Weis wrote that the group had not seen a pattern in the skips, and had not seen a later attack that those curves fail and the published ones pass. He left it as a bug, or another S-box story. The page is less closed than the opening. A handful of skips does not look like a hunt for rare weak curves, because that hunt only works if weak curves are easy to find. They still write that someone could have searched timestamps for a property. You would only do that if you planned to publish the timestamp as proof the seed was ordinary. They did not publish the timestamp. The page says nothing in the numbers shows how many runs there were.
No action is the right sentence if you mean do not rotate a P-256 key because a clock turned up. It is the wrong sentence if you mean the choice is explained. The clock explains the bytes of candidate 1,842. It does not explain why 876 lost.
The seed does not set the point
Every public key on these curves is a multiple of a base point, G. The seed does not pick G.
The page found G for six curves from May 1997, P-192 and five ANSI examples, in the generator from FreeLIP. Seed a small integer, drop seven outputs, then take x-coordinates until one sits on the curve. P-192’s seed there is 20000. The base points of P-224, P-256, P-384, and P-521 do not fit. The page says no NIST base point had been explained before these six, and these four still are not. B-163, one binary seed, fits nothing they tried. I am not hanging this note on a curve nobody uses. P-256’s G is the one in the signatures.
A regenerated seed is a check I can run on a laptop. I did. It says the published bytes are what that clock emitted at step 1,842. It does not say the clock was the only run, and it does not say where G came from. Both of those are still open on the page that says there is nothing to do.
If a post says the half hour closed the backdoor question, ask which choice it closed. The seed bytes, the curve they shipped instead of 876, or the base point. The page answers the first one.