Anthropic Says Claude Cracked the NIST Curve Seeds Mystery

For more than two decades, cryptographers wondered how the National Institute of Standards and Technology (NIST) picked the mysterious "seed" values behind the world's most widely deployed elliptic curves. On October 16, 2026, Anthropic said an internal research model—Claude—answered that question in under half an hour: the seeds were not hashes of a secret phrase, but consecutive outputs of the C library lrand48 pseudorandom generator, seeded with Unix timestamps from 1997 and 1998. The company published the finding, released reproducible code, claimed cryptographer Filippo Valsorda's seed bounty, and said the payout will be donated to the Internet Security Research Group (ISRG), the nonprofit behind Let's Encrypt.

The work was carried out by an Anthropic team of John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini and Steve Weis, using Claude.

Key facts

What Claude found

ECDSA—elliptic curve digital signature algorithm—is the dominant standard for curve-based public-key cryptography. NIST adopted it in 2000 in FIPS 186-2 (Digital Signature Standard), which lists standard curves. Each curve publishes a seed whose hash defines coefficient b. The seeds arrived from the NSA without explanation, fueling backdoor theories for years. The NIST P-256 seed, for instance, is C49D3608 86E70493 6A6678E1 139D26B7 819F7E90.

According to Anthropic, an employee in October 2026 asked an internal research model to derive the seeds without the folklore clue that NSA mathematician Jerry Solinas had hashed a joke passphrase (he recalled something like "Give Bob and Jerry a raise"). Prior Anthropic staff searches along that hash story had failed. Claude instead reconstructed a 1990s-era pipeline: initialize lrand48 with a Unix time, draw 20-byte chunks as successive candidates, and match the published values. For P-256, candidate number 1,842 at timestamp 1997-08-16 01:52:34 UTC reproduces the standard seed exactly—something Anthropic backs with public Python that Valsorda says he reimplemented in Go to verify. Valsorda describes the generator as drand48 output taken one byte at a time, while Anthropic describes it as lrand48() >> 23; both use the same srand48 state.

The 25-year riddle

Neal Koblitz and Alfred Menezes summarized the controversy in "A Riddle Wrapped in an Enigma" (2015). Because NIST never documented seed generation, practitioners debated whether parameters could hide a trapdoor. Amateur sleuths and professionals chased leads; Valsorda offered a bounty for a convincing explanation.

The Solinas passphrase story became the best-known narrative—memorable, human, and ultimately wrong. Solinas died in 2023; he had said Bob Reiter, who wrote the code, didn't remember the details either, and no archives were found. Anthropic says other colleagues did not respond. Anthropic's post frames the new result as closing that chapter: simple PRNG plus clock time, reproducible by anyone running the published scanner.

How Claude cracked it in under 30 minutes

Anthropic describes a chain of classic cryptanalytic reasoning, executed by the model with human verification afterward.

First, Claude hypothesized that curve seeds came from a 1990s C library PRNG, not a deliberate hash. It built a scanner that slid along each published seed one bit at a time and tested whether adjacent chunks looked like consecutive generator outputs—covering 34 combinations of generator and output slice.

A tell appeared in the top bits: written as five 32-bit words, four of ten seeds had a zero in the top bit for all 20 words—probability about 1 in 5,810 by chance. That pattern matches lrand48, which returns only the top 31 bits of a 48-bit linear congruential state. Claude brute-forced the 2¹⁷ hidden bits on the first word and checked that the next words followed.

Prime-field seeds kept fewer bits per output, so recovery needed lattice reduction (LLL) on a truncated linear congruential generator—a standard technique. Five NIST prime curves and five ANSI X9.62 seeds shared the same rule: lrand48() >> 23. Running the generator backward reached srand48-style states (low 16 bits 0x330E) that decode to Unix dates between May 1997 and April 1998. Binary-curve seeds initially looked like February 1984 until timestamps were doubled, mapping to 17 April 1998—suggesting the program may have halved the clock.

Anthropic also attributes some base points—the fixed generator G on each curve—to the random routine in Arjen Lenstra's FreeLIP library (also shipped in early NTL). That explained P-192 and five ANSI example curves; major NIST base points had not been explained before, the company says.

Reproducing the P-256 seed

The excerpt below (adapted from Anthropic's CC0 sample) regenerates the P-256 seed from its timestamp and candidate index:

from datetime import datetime, timezone

def unix(when):
    return int(datetime.fromisoformat(when).replace(tzinfo=timezone.utc).timestamp())

def candidate(t, n, per, shift, width):
    x, out = (t << 16) | 0x330E, ""
    for i in range(per * n):
        x = (0x5DEECE66D * x + 0xB) % 2**48
        if i >= per * (n - 1):
            out += "%0*X" % (width, x >> shift)
    return out

when = "1997-08-16 01:52:34"
n = 1842
print(candidate(unix(when), n, 20, 40, 2))
# C49D360886E704936A6678E1139D26B7819F7E90

What it means for security

Anthropic is explicit: "This is not a cryptographic break, new attack, or weakness in the ECDSA curves." The curves were already widely trusted; Valsorda notes that even before this result, serious practitioners had few practical concerns about the NIST parameters.

If anything, the story cuts against deliberate weakening. Seeds generated from a weak but transparent PRNG and a public timestamp leave little room for a hidden trapdoor selection process. Valsorda writes that this week's findings "completely rule out" the technique Daniel Bernstein and Tanja Lange described to Koblitz and Menezes; even with generous assumptions, an attacker would have had "barely 30 bits of freedom"—not enough to intentionally target a hypothetical small class of weak curves.

Operational guidance is unchanged: no rotation, no emergency patches. TLS, code signing, and hardware that rely on P-256 and siblings keep working as before. The win is epistemic—closing a famous open problem—not defensive.

What is still unexplained

Open threads remain. Anthropic could not recover the B-163 binary seed. Base points for P-224, P-256, P-384, and P-521 (and NIST binary curves) still lack a published recipe. The team observed skipped viable candidates—for P-256, candidate 876 in the same run also yields a usable curve, but NIST chose 1,842. Valsorda notes that roughly twice as many valid seeds exist as were published, with no satisfying explanation yet for the extra rejections. Because only a handful of skips appear across runs, Anthropic argues deliberate weak-curve picking is implausible, but the selection criteria are unknown.

Why it matters for AI in research

This is not a chatbot summarizing Wikipedia. An Anthropic employee posed an open research question; a model proposed testable hypotheses, wrote scanning code, recognized a statistical fingerprint, applied lattice techniques, and walked states backward to calendar dates—then humans validated and published. That pattern mirrors how Anthropic is reshaping its own workforce around agents, but here the agent is doing work that sat unsolved since the late 1990s.

It also sits beside Anthropic's broader posture on trust and public benefit—two days before the company committed shares to a Public Benefit Fund, its Frontier Red Team said the $36,864 bounty would go to ISRG. For AI watchers, the lesson is narrower than "models replace cryptographers": they can accelerate hypothesis generation and tooling on well-bounded historical puzzles, while humans still own verification, publication, and judgment about what matters for the field.

Sources

• Anthropic: Claude reveals ECDSA curve origins — Oct. 16, 2026
• Filippo Valsorda: The NIST Elliptic Curves Seeds Bounty Has Been Claimed — Oct. 16, 2026
• Neal Koblitz and Alfred Menezes: A Riddle Wrapped in an Enigma — 2015
• Filippo Valsorda: Announcing the $12k NIST Elliptic Curves Seeds Bounty — Oct. 5, 2023