Filippo Valsorda
A well-known cryptographer and Go security engineer who previously worked at Google, focusing on cryptography and security engineering.
Timeline (last 90 days)
In October 2023, Filippo Valsorda launched a bounty: 12,288 dollars for the seeds, tripled if the winner donates the prize.
Filippo Valsorda reimplemented it in Go and got exactly matching output, with the timestamps: P-521 1997-08-08, P-256 1997-08-16, P-384 1997-08-30, P-224 1998-04-03.
Filippo Valsorda's calculations show that even allowing any timestamp in the 1997–98 window and the first 16 prime-order candidates per curve, there is barely 30 bits of freedom, insufficient to deliberately target a hypothetical small class of weak curves or embed a NOBUS backdoor.
The P-256 generation process skipped the 876th candidate; Filippo counted that the number of valid seeds is about twice the published number, and he identified one extra rejection rule (the bit length of n must not exceed p), but the second rule remains unknown.
Filippo Valsorda now personally recommends NIST ECC over Curve25519/Ed25519/X25519, for reasons including P-256 being everywhere, preferring to concentrate effort on one well-implemented curve, and ML-DSA-44 being a better choice for new signatures.
Filippo Valsorda reports that the bounty on the origin of the NIST elliptic curve seeds has been claimed.
All Facts (6)
Filippo Valsorda reimplemented it in Go and got exactly matching output, with the timestamps: P-521 1997-08-08, P-256 1997-08-16, P-384 1997-08-30, P-224 1998-04-03.
50%UnverifiedFilippo Valsorda's calculations show that even allowing any timestamp in the 1997–98 window and the first 16 prime-order candidates per curve, there is barely 30 bits of freedom, insufficient to deliberately target a hypothetical small class of weak curves or embed a NOBUS backdoor.
50%UnverifiedThe P-256 generation process skipped the 876th candidate; Filippo counted that the number of valid seeds is about twice the published number, and he identified one extra rejection rule (the bit length of n must not exceed p), but the second rule remains unknown.
50%UnverifiedFilippo Valsorda now personally recommends NIST ECC over Curve25519/Ed25519/X25519, for reasons including P-256 being everywhere, preferring to concentrate effort on one well-implemented curve, and ML-DSA-44 being a better choice for new signatures.
50%UnverifiedFilippo Valsorda reports that the bounty on the origin of the NIST elliptic curve seeds has been claimed.
50%UnverifiedIn October 2023, Filippo Valsorda launched a bounty: 12,288 dollars for the seeds, tripled if the winner donates the prize.
50%