- Let's Encrypt says the starting numbers behind the NIST elliptic curves came from an ordinary random number generator seeded with the time, which it says answers a 25-year question.
- The account matters because unexplained origins can erode trust in cryptography much of the web relies on, even when no weakness has been found.
- Leaders can ask which security components they rely on without a documented origin, and whether they support the open infrastructure they depend on.
Trust can fail without anything breaking
Security leaders often judge a technology by whether it has been broken. This week's news points to a second test: can anyone explain where it came from?
For about 25 years, a widely used piece of encryption left that second question open. On October 16, 2026, Let's Encrypt says, the question was answered. The certificate authority described the outcome in a post on October 29.
What Let's Encrypt reports
According to Let's Encrypt, the NIST elliptic curves are used in encryption across the Internet. Two NSA engineers produced the "seeds" behind them in the late 1990s. Years later, nobody could recall exactly how those seeds had been made.
The answer, as Let's Encrypt reports it, is ordinary. The seeds came from a standard random number generator, seeded with the time. Let's Encrypt calls the answer reassuring.
Let's Encrypt says the missing explanation led some people to grow skeptical. It does not say anyone found a weakness. Its point is that doubt alone chips away at trust in cryptographic infrastructure.
The post gives no technical detail on how the answer was found beyond saying the team enlisted Claude's help. Anthropic published its own writeup, which this story has not reviewed. The result is as Let's Encrypt reports it, not something WebPulse has verified.
Why a seed matters: background
This section is general background, not a claim from the Let's Encrypt post. An elliptic curve is a mathematical shape that encryption uses. Its settings must be chosen carefully.
The NIST curves' settings were derived from seeds through a published procedure. In plain terms, the seed is run through a hash function, a one-way scrambling step, and the output becomes the curve's settings. The procedure is public, but the seed that feeds it is only a starting number.
That left a worry. Someone could have picked a seed on purpose to produce a curve with a hidden weakness. Outsiders could not rule that out without knowing where the seed came from.
WebPulse's reading: an ordinary generator output is what you would expect if no one had steered the choice. The post does not say this rules out manipulation.
How a bounty drew out an answer
Filippo Valsorda started a bounty in 2023 to find the lost method. The prize was $12,288. If the solvers gave it to a nonprofit, it would triple to $36,864.
Twelve individuals, named in the post, put in their own money to fund it. Their aim, the post suggests, was to settle the speculation. Valsorda is on that list as well as being the bounty's founder.
A team of researchers at Anthropic solved it, according to Let's Encrypt. The post says the team enlisted Claude's help. They donated the prize to ISRG, the nonprofit behind Let's Encrypt.
This is one case. It shows what an AI-assisted research effort can do on a long-open question. It does not show a trend.
The idea: an unexplained choice keeps costing something
This is WebPulse's view, not the source's. An undocumented decision behaves like a building with lost blueprints. The building may be sound. But every inspection starts from suspicion, and no one can close the file.
The lesson is that cryptography earns trust from explanations that can be checked. Here, by Let's Encrypt's account, the explanation turned out to be dull.
What to ask your team
Nothing in the post says organisations should change their encryption. Let's Encrypt describes the finding as a boost to confidence in the cryptography behind much of the web. It also benefits from the story, since ISRG received the donation. Weigh that judgement accordingly.
Ask your security lead which components you depend on whose origin is "trust us." These could be vendor cryptography, licensed code or default settings nobody has reviewed. Ask what evidence exists that the origin is sound.
Ask suppliers how they document where their security choices came from. Put that question in procurement, not just in an audit.
Ask whether your company supports the open infrastructure it relies on. ISRG says it is a nonprofit 100% supported through donations, and it encourages companies to become sponsors.
The takeaway is simple. A decision nobody can explain leaves a question open even when it holds up. An explanation, even a plain one, is worth paying for.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Let's Encrypt.
