The Case of the Mystery Seeds · Chapter 4

The mystery

We now know the NIST curves really did come from their seeds. This chapter is about the seeds themselves: who supplied them, what he remembered, why the world grew suspicious, and the bounty that sat unclaimed for three years.

Nib says: Every detective story needs a suspect, a motive and a red herring. This one has all three. Halfway down there's a toy where you can hunt for the lost phrase yourself. Spoiler: you won't find it, and in Chapter 8 you'll see why nobody could have.

The man with the seeds

The seeds came from Jerry Solinas, a long-time mathematician at the NSA. Alfred Menezes, the main author of the ANSI X9.62 curve standard, has said that Solinas gave the seeds to the standards committee in the fall of 1997, while attending meetings as the NSA's representative. They went into X9.62, and from there into NIST's signature standard, FIPS 186-2, in 2000. No document anywhere explained how the seeds had been chosen.

For a while, nobody much minded. Then the story grew a shadow.

Twenty-five years, in brief

  1. Fall 1997

    Solinas hands over the seeds

    The NSA's representative gives the X9.62 committee the seeds behind the curves, according to Alfred Menezes.

  2. 1999–2000

    The curves become standard

    X9.62 is published in 1999, and questions about the unexplained seeds appear on Usenet soon after. NIST publishes its recommended curves in July 1999 and adopts them with ECDSA in FIPS 186-2 in 2000.

  3. 2006–2014

    A backdoor elsewhere

    NIST standardizes Dual_EC_DRBG, an NSA-designed random number generator, in 2006. In 2013, reporting based on documents leaked by Edward Snowden indicates the NSA had a hand in weakening it. NIST withdraws it in 2014. Suddenly every unexplained NSA number looks suspicious.

  4. 2013–2015

    "Jerry deserves a raise"

    Solinas tells a standards contributor the seeds were SHA-1 hashes of a joke phrase, something like "Jerry deserves a raise", lost when his computer was replaced. Asked by cryptographer Daniel Bernstein in 2014, he writes that they came from hashing a humorous message, perhaps "Give Bob and Jerry a raise", and that a colleague, Bob Reiter, wrote the code.

  5. 2015

    "A Riddle Wrapped in an Enigma"

    Neal Koblitz and Alfred Menezes publish a review of the controversy. They argue that seed shopping would only have worked if the NSA knew of a class of weak curves so large that outside researchers would very likely have found it too.

  6. 2017

    A sketch of how it could be done

    Bernstein and Tanja Lange describe a technique that could use about 70 bits of freedom in choosing seeds to hit a hypothetical family of weak curves. The theory keeps the suspicion alive.

  7. 2018

    Asking politely

    Steve Weis files freedom-of-information requests. NIST says it has no documentation; the NSA stops responding.

  8. 2023

    Solinas dies, and a bounty appears

    Solinas dies in early 2023. In September, Weis publishes what he had pieced together. On October 5, Filippo Valsorda offers a bounty for the phrases: $12,288, tripled to $36,864 if given to charity. Half goes to the first person to find one phrase, half to whoever finds all five.

  9. October 2026

    Solved

    An Anthropic team claims the full bounty on October 15 and donates it to ISRG. The answer, published the next day, surprises everyone. That's the second half of this case.

The red herring

The phrase story was charming, plausible and widely repeated. If the seeds were hashes of English phrases, they would be nothing-up-my-sleeve numbers after all, just with a lost sleeve. And it suggested a hunt: guess phrases, hash them, compare. People spent years trying variations of names, raises and punctuation. Try it.

Hunt for the lost phrase

Type a guess. We blend it with SHA-1 and compare the result to all five NIST seeds. Or let the goblins try a batch of variations.

Press Check my guess.

Nothing matches, of course. Hunters assumed the right phrase was simply too strange to guess. The real reason is that the premise was wrong. Memory is a funny thing: decades later, Solinas remembered the joke, but the seeds weren't made that way at all.

Why it mattered

Most working cryptographers were never seriously worried. Koblitz and Menezes's argument was persuasive: for seed shopping to plant a backdoor, the NSA would have needed a secret attack on a large family of curves, and in decades of public research nobody had found a hint of one.

But "probably fine" isn't the same as "explained". P-256 protects an enormous amount of internet traffic. The unexplained seeds fed doubts that pushed some engineers toward alternative curves, and they were a recurring talking point for people who distrusted the standards altogether. Valsorda said that ending the speculation was part of why he offered the bounty.

The question that would settle it was simple to state: how much freedom did whoever made these seeds really have? To answer that, you'd need to find the actual process that produced them. Phrase-guessing had failed for a decade.

Nib says: In October 2026, an Anthropic researcher asked one of Claude's internal research models to work out how the seeds were made, and deliberately didn't mention the phrase story. Without the red herring, Claude asked a different question: what kind of 1990s program spits out 20 random-looking bytes? To follow its answer, we need to learn how computers fake randomness. That's Chapter 5.

Words in this chapter

Tap any word with a dotted gold underline to see what it means. Here they all are in one place.

Three things to keep

Check yourself

Why did the Dual_EC affair make people more worried about the curve seeds, even though it involved a different standard?

It showed the NSA had been willing to put a weakness into a public cryptography standard. After that, any NSA-supplied number with no explanation, like the curve seeds, looked like a possible hiding place.

Koblitz and Menezes argued a seed backdoor was unlikely. What was their key point?

Seed shopping only works if weak curves are reasonably common, so the designer can find one by trying seeds. If a weakness that common existed, outside researchers would very likely have stumbled on it in the decades since.

What single fact would settle the question for good?

The actual process that produced the seeds. If it was something simple and fixed, there was too little freedom to shop for a weak curve.

Go deeper