For more than two decades, nobody could say where the “seeds” behind some of the most widely used elliptic curves came from. Anthropic now says its AI model Claude has found the answer for most of them, and it is mundane. The seeds were the output of an old C library random-number generator, lrand48, seeded with Unix timestamps from 1997 and 1998.
Anthropic stresses what this is not. “This is not a cryptographic break, new attack, or weakness in the ECDSA curves,” the company writes, and “there is no action to be taken or things to do differently.”
The mystery
NIST adopted the elliptic curve digital signature standard, ECDSA, in 2000 as part of the FIPS 186-2 Digital Signature Standard. For the standard’s prime and binary curves, the specification published a “seed” whose hash defines one of the curve’s coefficients. According to Anthropic’s research post, those seeds “were provided by the NSA with no explanation or justification”. That gap fuelled years of suspicion that the curves might have been chosen to contain a hidden weakness.
Cryptographers Neal Koblitz and Alfred Menezes summarised the controversy in their paper “A Riddle Wrapped in an Enigma“. Later came an amateur investigation into the seeds’ origin and a bounty for anyone who could find them, organised by Filippo Valsorda. The best-known story was that the late NSA mathematician Jerry Solinas had generated the seeds by hashing a humorous phrase. Anthropic says several of its staff had chased that lead without success, and it “turned out to be wrong”.
What Claude found
In October 2026, an Anthropic employee asked “an internal research model” whether it could work out how the seeds were generated, without pointing it at the passphrase clue. “In under half an hour, Claude discovered the origins of the NIST P-192, P-224, P-256, P-384 and P-521 seeds,” Anthropic writes. They were not hash outputs at all, “but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp”.
Anthropic says Claude guessed that the generating software used a pseudorandom generator from 1990s C libraries, which is weak enough that its output can be recognised. It spotted a tell-tale pattern of zero top bits in some seeds, recovered the generator’s internal state, and stepped it back to its starting value. For P-256, the standard’s most widely used curve, the published seed was the 1,842nd 20-byte candidate the generator produced. Anthropic says the prime-curve starting values all decode to timestamps “between May 1997 and April 1998”. The binary-curve values map to 17 April 1998 if the timestamps are doubled, though Anthropic hedges this, saying “the program may have halved the clock”.
The company published code to reproduce the seeds. TSN ran it, and it regenerates the published P-256 seed exactly.
Claude also explained where some of the curves’ base points came from. These are the fixed points from which every public key is derived. Anthropic says the base points of P-192 and five example curves in the ANSI X9.62 standard came from the random-number generator in FreeLIP, Arjen Lenstra’s long-integer arithmetic package. “As far as we know, no NIST base point has been explained before,” the post says.
What it means, and what it doesn’t
Anthropic’s reading is reassuring. “In fact, this makes us more confident the curves were chosen without any backdoors or intentional weaknesses,” it writes, adding that the findings make the idea of deliberate backdoors “much less plausible”. It describes the result as “a fun closing chapter”, noting that most researchers already trusted the curves.
Open questions
Anthropic lists what is still unexplained:
- Skipped candidates. Some potentially viable curves were passed over. For P-256, candidate 876 of the same run would also have produced a suitable curve. Anthropic does not know what criteria were used, or whether this was unintentional. Because so few were skipped, it does not believe weakened curves were selected, though it accepts that searching over timestamps to get a particular property is “still conceivable” in principle.
- One seed is unrecovered. The binary curve B-163’s seed “fits nothing Claude has tried”.
- Most base points remain unexplained. Anthropic does not know how the base points for P-224, P-256, P-384 and P-521, or for the NIST binary curves, were generated.
The bounty
“The $36,864 for finding the seeds will be donated to the Internet Security Research Group,” Anthropic says. The group runs the Let’s Encrypt certificate authority. The work is credited to ten Anthropic staff, including Nicholas Carlini, Paul Crowley and Steve Weis.
What this means
- Anthropic says Claude traced the NIST P-192, P-224, P-256, P-384 and P-521 seeds to lrand48 output seeded with 1997-98 Unix timestamps, and published code that reproduces them.
- This is not a cryptographic break. Anthropic says a backdoor is now much less plausible and no action is needed.
- One seed and most base points remain unexplained. This is Anthropic’s own account.
Sources
- Anthropic: Claude reveals ECDSA curve origins
- NIST: FIPS 186-2 Digital Signature Standard
- Koblitz and Menezes: A Riddle Wrapped in an Enigma
- Steve Weis: NIST curve seed origins
- Filippo Valsorda: NIST Elliptic Curves Seeds Bounty
Related stories
- Anthropic Says Claude Designed More Efficient Quantum Circuits
- Quantum and wallet keys: Europol says the risk is exposed keys, and Ethereum researchers urge a careful move
- Coinbase Sets Out What It Wants From Bitcoin’s Move to Quantum-Safe Signatures
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
