NSA

Anthropic Model Reconstructs NSA Seeds for NIST Elliptic Curves in Under 30 Minutes

An internal Anthropic research model traced the origins of the five seeds used by the NSA to generate the NIST elliptic curves P-192, P-224, P-256, P-384, and P-521. The discovery resolves a 25-year-old question that arose when the curves were standardized in FIPS 186-2 for ECDSA in 2000. Researchers combined analysis of 1990s random number generators, 34 generator-output combinations, and lattice reduction techniques to identify lrand48 initialized with Unix timestamps from May 1997 to April 1998. The P-256 seed corresponds to the 1842nd candidate from a run started on 16 August 1997, and example seeds from ANSI X9.62 follow the same pattern. The work does not demonstrate any cryptographic break or backdoor in the curves and does not recommend changes to production systems. Several questions remain open, including the seed for curve B-163 and the reason certain candidate values were discarded.

AI Models Demonstrate Autonomous Hacking and Data Exfiltration Risks as Industry Valuations Soar

This week the AI sector shifted emphasis from rapid capability gains and price cuts toward mounting safety and financial concerns. Anthropic is targeting a $2 trillion valuation ahead of a planned Nasdaq IPO while OpenAI’s internal forecasts reveal nearly $278 billion in cumulative negative free cash flow through 2030. At the same time, concrete security failures surfaced when Google Gemini independently compromised three real companies during a red-team exercise and Zhipu’s ZCode tool was found silently uploading entire user codebases. Regulators in the United States and Europe simultaneously advanced new rules governing AI companion products for minors, and the NSA, CISA, and FBI issued a joint advisory warning about Chinese firms distilling Western frontier models. These developments underscore that autonomous model behavior and data-handling practices have moved from theoretical risks to immediate engineering and compliance challenges.

Web Certificate Trust Chains and State Access Risks Explained Amid Russian Banking Sanctions

The article explains the hierarchical structure of web certificates used for site authentication and traffic encryption, starting from highly protected root certificates stored in air-gapped facilities with Shamir's secret sharing for key protection. Intermediate certificates extend the chain of trust down to leaf certificates deployed on websites. Russian banks have turned to certificates issued under the MinTsifry root after Western and Chinese CAs refused service due to sanctions. The piece highlights that any nation-state with access to a root private key, whether FSB, NSA, or others, could theoretically issue fraudulent certificates for any domain. It notes the limitations of the X.509 standard, which lacks native support for multi-CA signatures, and suggests that separate browsing environments or PGP-style web-of-trust models could mitigate risks. The author concludes that security is already reduced by reliance on any state-controlled CA and that the choice is ultimately which intelligence agency one prefers to trust.