An internal research version of Claude has traced the origin of the seeds behind the NIST elliptic curves to a 1990s clock and a standard C library random number generator, solving in under 30 minutes a provenance question that had fuelled suspicion for more than 25 years. Anthropic reported the result on October 16, 2026, after an employee asked the model how the seeds were generated.
The employee did not steer Claude toward the long-standing rumour that the seeds were hashes of a hidden phrase. Working without that prompt, Claude followed the numbers themselves and reconstructed a simple, reproducible generation process using lrand48 and Unix-timestamp initialisation.
A Statistical Fingerprint In The Seeds
The seeds were published with FIPS 186-2 in 2000 for curves P-192, P-224, P-256, P-384 and P-521. Because no convincing explanation of their origin was supplied, the apparently arbitrary values fed theories that the National Security Agency had chosen them to hide a deliberate backdoor.
Claude spotted a statistical fingerprint that a hash of a phrase would not explain. Some seeds had all of their top bits clear, a pattern Anthropic puts at about 1 in 5,810, pointing instead to lrand48, the C library generator that returns the top 31 bits of a 48-bit internal state.
That clue changed the problem from searching for words to recovering a generator state. Once the generator was identified, its outputs could be tested, reversed and matched against candidate start times, as readers familiar with what Claude is would expect from a model applied to structured technical evidence.
Rewinding lrand48 To 1997 And 1998
Claude recovered the generator’s internal state, using LLL lattice techniques for the prime curves and brute force for the binary curves. It then rewound that state to srand48 initialisations based on Unix timestamps between May 1997 and April 1998.
The matches are specific. The P-256 seed was candidate 1,842 from a run started on August 16, 1997, at 01:52:34 UTC, while the P-192 seed took 139 iterations from May 18, 1997, a level of detail that can be checked independently rather than taken on trust.
Claude also traced the base points for six curves to Arjen Lenstra’s FreeLIP library. That second finding strengthens the ordinary-tooling explanation, because it links another part of the curve construction to known contemporary software rather than to a secret process.
What Remains Unexplained, And What This Is Not
The result is not complete. Anthropic says the B-163 seed and the base points for P-224, P-256, P-384 and P-521 remain unexplained, so the reconstruction leaves open questions for researchers to test.
Anthropic stresses that the finding is not a cryptographic break, attack or weakness in the curves. Its importance is the opposite: a simple, reproducible origin leaves much less room for subversion than an opaque seed that no outsider could regenerate.
Independent checking followed quickly. Cryptographer Filippo Valsorda reimplemented the solution in Go and confirmed the match, and the $36,864 bounty attached to the problem will be donated to the Internet Security Research Group. Anthropic says the team behind the work numbered ten people, in a project that also shows how Claude Code-style tooling and model reasoning can be combined on research tasks.
Why It Matters
The NIST ECDSA curve seeds are the central entity, because trust in widely used elliptic curves depends on how their starting values were chosen. Their attributes are provenance, whether they can be regenerated, transparency, whether outsiders can verify the process, and exposure, since the same curves secure banking, web and government systems.
Their neighbours are NIST as publisher, the NSA as the agency long suspected of influencing the choice, and implementers who had to trust the curves without evidence of origin. Our background on what Anthropic is helps explain why the company published the reconstruction and the remaining gaps together, rather than claiming the whole history is closed.
Verifiable provenance does not prove every parameter choice was ideal, and the unexplained items matter. It does, however, replace an untestable suspicion with a concrete, repeatable account that other cryptographers can run, challenge and extend.
Background
The NIST curves became a lasting controversy after FIPS 186-2 published their seeds in 2000 without a convincing derivation, and suspicion deepened over the following decades, with former NSA mathematician Jerry Solinas recalling a phrase along the lines of “Give Bob and Jerry a raise” as a possible source. That hash-of-a-phrase story shaped debate for more than 25 years, until Claude’s reconstruction pointed instead to everyday 1990s C tooling, a system clock and lrand48.
Source: AI Weekly, Cybersecurity News
0 Comments