Almost every secure connection you make today depends on elliptic-curve cryptography — the mathematics behind ECDSA signatures, key exchange and much of the modern web’s trust infrastructure. Yet a question planted in the standardisation process decades ago has never fully died: where did the standard curves’ constants actually come from? The curves were published by the National Institute of Standards and Technology with seed values that were never satisfactorily explained, and the story of that omission remains required reading in our technology blog.
Elliptic curves for cryptography must be chosen carefully; a poorly chosen curve can harbour mathematical structure that makes the supposedly hard problem easy for whoever knows the secret. The standard process is to generate curve parameters from a published seed using a published algorithm, so anyone can verify nothing was smuggled in. The NIST curves’ seeds, famously, were provided without an account of how they were selected — a gap cryptographers noticed immediately and have discussed ever since, as the history in the ECDSA literature records.
A Suspicion With a Precedent
Scepticism about standardised constants is not paranoia; it has a documented precedent. The Dual_EC_DRBG affair — in which a NIST-standardised random number generator was revealed to contain a probable backdoor, with a major vendor paid to make it the default in its products — demonstrated that the standards process itself could be steered. That revelation, confirmed through documents leaked in 2013, permanently changed how unexplained numbers in standards are received.
Against that background, the curves’ defenders make fair points: the famous curves have withstood decades of global cryptanalysis without a shortcut emerging, the mathematics community has hunted intensively, and a trapdoor that powerful would represent an extraordinary secret kept implausibly well. Both things can be true — the curves may be safe, and the process that produced them may still have been unacceptable.
How the Industry Answered
The engineering world’s verdict was to route around the question. Newer curve designs — most prominently Curve25519 and its signature sibling Ed25519 — were generated by a fully transparent, “nothing-up-my-sleeve” process in which every constant is the smallest value satisfying published criteria. These curves now dominate new protocols, from messaging apps to VPNs, and major platforms have migrated certificates, keys and code-signing systems accordingly. The migration cost billions in aggregate engineering time — the true price of one unexplained seed.
Standards bodies absorbed the procedural lesson. Modern processes face demands for published seeds, public justification of every constant, and open design competitions of the kind that produced the newest post-quantum algorithms. Transparency is no longer a courtesy extended by standardisers; it is the price of adoption, enforced by an industry that will simply choose different mathematics if it is not satisfied.
The Question That Remains
Trust, But Verify — Permanently
The debate’s healthiest legacy may be cultural. A generation of engineers raised on this story treats unexplained constants the way auditors treat unexplained cash: as findings, not footnotes. Open-source implementations are now expected to document the provenance of every parameter; protocol designers compete to demonstrate that their choices contain no room for hidden structure; and “trust us” has been retired as an acceptable design argument in security engineering.
That cultural shift protects more than cryptography. The same instinct — demand the derivation, check the seed, assume the process can be gamed — is how healthy technical institutions behave in every field where the stakes justify it. The curves taught the internet to ask for receipts, and the internet has not stopped asking since.
The original question — who chose those seeds, and how — will probably never be answered definitively, and in a sense it no longer needs to be. The system’s response is the story: suspicion imposed verification, verification became design doctrine, and the cryptography securing the next generation of the internet is built to be distrusted safely. For a field whose entire product is justified confidence, that may be the healthiest possible outcome. Read more deep-dives in our technology blog.
