Few suspicions in cryptography have lasted as long as this one. The elliptic curves standardised by the US National Institute of Standards and Technology — the curves that secure banking apps, messaging and much of the web — were generated from unexplained seed numbers produced by the NSA. For two decades, cryptographers have wondered whether those seeds were chosen to conceal a secret weakness. New analysis of the curve-generation process now offers the strongest evidence yet that they were not.
To understand the suspicion, start with how the curves were made. Their parameters were derived by hashing seed values — long, arbitrary-looking numbers that NIST published but never explained. Because a hash is one-way, nobody could work backwards to learn how the seeds were picked. After the Snowden revelations showed the NSA had genuinely subverted another standard, the random-number generator Dual_EC_DRBG, the unexplained seeds looked damning. Overviews of the standard are maintained in NIST’s elliptic curve cryptography project pages, and our security coverage has followed the debate for years.
What the New Analysis Did Differently
Researchers revisited the structure of the generation process itself, testing whether the seeds could plausibly have been ground through a search for a weak curve — the attack the conspiracy requires. Their conclusion: the seeds show the fingerprints of a constrained, mechanical process rather than a malicious search, and the statistical properties of the resulting curves match what an honest procedure would produce. In plain terms, pulling off the suspected backdoor would have required computational feats inconsistent with how the numbers actually look.
Why It Matters Beyond History
This is not just archaeology. Trust in standard curves underpins decisions being made right now, as industry migrates toward post-quantum cryptography and argues about which new standards to adopt and whose process to trust. The episode’s real lesson may be procedural: unexplained constants invite permanent suspicion, which is why modern standards increasingly use rigid, transparent generation rules that leave nothing to take on faith.
The Dual_EC Shadow
Context explains why the suspicion refused to die. In 2007, researchers showed that the Dual_EC_DRBG random-number generator — also standardised through NIST, also NSA-influenced — contained constants that would allow whoever chose them to predict its output, and later reporting indicated the NSA had paid to make it the default in commercial products. When an agency has been caught rigging one set of unexplained numbers, every other set of unexplained numbers it touched inherits the suspicion. The elliptic curve seeds were, in that sense, victims of a proven crime committed elsewhere.
The new analysis also highlights an asymmetry worth remembering. Proving a negative — that a generation process was honest — is far harder than planting the doubt was. The researchers’ work succeeds not by finding a confession in the numbers but by showing the alleged crime would have required capabilities and left traces that the evidence does not support. In security, that is often the strongest form of reassurance available, and it is why the paper has been received as close to a settlement as this twenty-year argument is likely to get.
There is a final irony the researchers themselves note. The decades of suspicion, however uncomfortable for the standards bodies, materially improved cryptography. Distrust of the NIST curves drove adoption of alternatives with transparent generation — curves whose constants are small, memorable numbers nobody needs to take on faith — and pushed the whole field toward ‘nothing-up-my-sleeve’ design as a norm. The new analysis may close the historical question, but the culture it created is permanent, and arguably the healthiest outcome of the affair: a discipline that now assumes its standards will be audited, and generates its magic numbers where everyone can watch.
The curves, it seems, were probably honest — but the two decades of doubt were the price of generating them in the dark. Read more cryptography and security analysis in our technology section.
