Claude cracks 25

For more than 25 years, cybersecurity experts have wrestled with a troubling question: Did the US National Security Agency (NSA) secretly introduce a vulnerability into some of the internet's most widely used cryptographic standards, potentially giving American intelligence agencies a way to bypass security protections?Now, Anthropic says its Claude AI model has traced the origins of the mysterious numbers at the center of the controversy in less than half an hour, providing a surprisingly ordinary explanation for a puzzle that had occupied cryptographers for decades. Rather than an elaborate espionage mechanism, the answer appears to lie in a simple computer program from the 1990s and the date and time displayed on a computer clock.GalleryAnthropic's Claude AI (Photo: Anthropic)To understand the significance of the discovery, it is necessary to go back to 2000, when the US National Institute of Standards and Technology (NIST) adopted a set of cryptographic standards based on mathematical structures known as elliptic curves.These mathematical systems underpin digital signatures, which allow computers to verify identities and confirm that information has not been altered. They remain an important component of digital security, including systems used to authenticate online communications, software and electronic transactions.But one detail troubled cryptography experts from the beginning. Some of the numbers used to generate the standardized curves had been supplied by the NSA without any explanation of how they were chosen.The concern was that the numbers might not have been selected innocently, but deliberately engineered to introduce a hidden weakness that only the intelligence agency knew how to exploit.Put simply, critics worried that the United States had helped design a sophisticated lock for the digital world while secretly retaining a key that could open it.Those suspicions intensified in 2013, following former NSA contractor Edward Snowden's revelations about American surveillance programs and efforts to influence cryptographic technologies. Despite years of research and debate, however, cryptographers had been unable to establish precisely where the mysterious numbers had come from.The answer was hiding in a 1990s computer programAccording to research published by Anthropic on October 16, Claude identified the origins of five previously unexplained numerical values, known as seeds, used in standardized elliptic curves designated P-192, P-224, P-256, P-384 and P-521.The model determined that the values were generated using lrand48, a relatively simple pseudorandom number generator commonly available in C programming libraries during the 1990s.Such software produces sequences of numbers that appear random but are actually calculated according to fixed mathematical rules. To begin generating a sequence, the program needs an initial value, known as a seed. One common method is to use a timestamp taken from the computer's clock.NSA headquarters (Photo: Reuters)Claude discovered that the mysterious values could be reproduced using this type of generator initialized with timestamps from 1997 and 1998.In the case of P-256, one of the most widely used standardized curves, the model traced the relevant sequence to August 16, 1997. The published value appeared as the 1,842nd candidate generated by the program.The finding suggests that numbers whose unexplained origins had fueled decades of speculation may simply have resulted from routine software used by cryptographers in the late 1990s.Importantly, Anthropic emphasized that the discovery does not represent a successful attack on encryption or digital signatures, nor does it expose a new security vulnerability."This is not a cryptographic break, new attack, or weakness in the ECDSA curves," the company said in its research report.Although the finding makes the theory of a deliberately engineered NSA backdoor considerably less plausible, it does not resolve every question about the original standards. Researchers have yet to explain how certain additional mathematical parameters were selected or why some apparently suitable candidates were passed over during the generation process.Nevertheless, the ability to reconstruct the original values using a common computer program offers strong evidence that at least this part of the standards' development followed a straightforward process rather than one designed to conceal an intelligence capability.The discovery also has an interesting connection to cryptocurrencies. Bitcoin and Ethereum use a different elliptic curve, known as secp256k1, rather than the NIST P-256 curve examined in the research. Questions about the NSA's involvement in cryptographic standardization have long been part of debates over which mathematical systems should be trusted.The significance of the mystery was reflected in a financial prize established in 2023 by cryptography engineer Filippo Valsorda, who offered a reward to anyone who could establish where the original values came from.The bounty began at approximately $12,000 and eventually reached $36,864. Following Claude's discovery, Valsorda independently reproduced the results and confirmed that the Anthropic research team had solved the central puzzle.The researchers chose to donate the prize money to the Internet Security Research Group, a nonprofit organization that supports internet security initiatives, including the widely used Let's Encrypt certificate service.Beyond resolving much of a longstanding cryptographic controversy, the achievement illustrates the growing ability of artificial intelligence models to conduct mathematical investigations rather than simply retrieve or summarize existing information.According to Anthropic, Claude examined competing hypotheses, identified previously overlooked numerical patterns and reconstructed the process that had generated the mysterious values.After more than a quarter-century of suspicion, speculation and unsuccessful attempts to explain the numbers, an unexpectedly simple answer has emerged: what some feared might be evidence of a sophisticated intelligence operation appears to have originated with an ordinary computer program and a clock running in the 1990s.