Anthropic says Claude cracked decades-old mystery of NIST curve seeds

Summary

• Claude traced the ECDSA curve seeds to a 1990s C-library random generator seeded by a Unix clock.
• The NSA supplied the seeds in 2000 with no explanation, fueling decades of backdoor speculation.
• Anthropic says the finding is not a break and supports confidence that the curves were honestly chosen.

The latest

The seeds behind the ECDSA elliptic curves in US federal standards were not hash outputs at all but values produced by lrand48, a weak C-library pseudorandom generator seeded with a Unix timestamp, Anthropic said in research published on 16 October 2026 by its Frontier Red Team. The company said the work was done by Claude, which reconstructed the generation method in under half an hour.

Details

• The open question: NIST adopted ECDSA in 2000 under FIPS 186-2 and published a seed for each curve whose hash fixes the coefficient b. The National Security Agency supplied those seeds without explanation, a silence that sustained decades of suspicion. The P-256 seed is C49D3608 86E70493 6A6678E1 139D26B7 819F7E90.
• The false lead: The prevailing rumor traced to Jerry Solinas in 2015, who pointed to the hash of a jokey phrase but added: "I think there was a counter involved rather than multiple hashes, but I don't know the details." Solinas died in 2023, his colleagues did not respond, and Anthropic says the hint was wrong.
• The method: In October 2026 an Anthropic employee asked an internal research model to infer the generation method, withholding the phrase-hash hint entirely. Claude's first hypothesis was a 1990s C-library generator with recognizable output, and it wrote a scanner testing every seed bit by bit across 34 combinations of generators and output slices.
• The decisive pattern: In 4 of the 10 seeds, the top bit of all 20 words was zero, a coincidence with probability 1 in 5,810. That signature matches lrand48, which returns only the top 31 bits of a 48-bit state. Claude then brute-forced the 17 hidden bits against the first word and confirmed the next four.
• The harder cases: Prime-curve seeds retained fewer bits per output, so the problem was recast as a truncated linear generator and solved with LLL lattice basis reduction over each window. Five NIST prime seeds and five ANSI X9.62 seeds all resolved to the same form, lrand48() >> 23.
• The timestamps: Recovered states map to clock values between May 1997 and April 1998: P-192 and prime192v2/v3 at 1997-05-18 14:45:34, P-256 at 1997-08-16 01:52:34, P-224 at 1998-04-03 12:52:07. Binary curves read as February 1984 until the timestamps are doubled, landing on 17 April 1998, suggesting the program divided the clock by 2.
• The verification: Each recovered 48-bit state regenerates all 160 bits of its seed, which Anthropic says cannot happen by chance across 10 seeds. Reconstructing P-256 took 1,842 iterations, each drawing 20 bytes as a candidate seed. The recovered curves span P-192, P-224, P-256, P-384, P-521 and the ANSI X9.62 set.
• The base points: Seeds do not determine the base point G. Anthropic traced the base points of P-192 and five ANSI X9.62 curves to the generator in Arjen Lenstra's FreeLIP package, whose code also appeared in early versions of Victor Shoup's NTL. The recipe seeds a small integer, discards 7 outputs, then tests 26-bit candidate x-coordinates.
• What remains unexplained: The base points of P-224, P-256, P-384, P-521 and the binary curves are still unaccounted for, as is the B-163 seed, which matched nothing Claude tried. Runs also skipped valid candidates: candidate 876 in the P-256 run was a prime-order curve of the right size, with three more skipped in P-224 and seven across the ANSI runs.
• Caveats and bounty: Anthropic says the criteria behind those skips are unknown and may be unintentional, and frames the result as neither a cryptographic break nor a weakness in ECDSA. The 36,864 dollars offered for identifying the seeds goes to the Internet Security Research Group; reproduction code for all 14 seeds and 6 base points was released under CC0 1.0.

Background

Neil Koblitz and Alfred Menezes published A Riddle Wrapped in an Enigma in 2015 on the unexplained provenance of the NIST curves. Several Anthropic employees had separately chased the phrase-hash theory without result before the model was asked to start from scratch.

Between the lines

The result cuts both ways on confidence. A clock-seeded generator from a standard C library is reproducible by anyone, which Anthropic says shrinks the space for hidden manipulation and supports treating the coefficients as safe. But the unexplained skipped candidates and the unresolved base points mean the reconstruction is not total. Anthropic's own framing is that no action is required.

What's next

Whether independent cryptographers reproduce the released CC0 code, and whether anyone accounts for the B-163 seed and the base points of P-224, P-256, P-384, P-521 and the binary curves.

Source: Anthropic (Frontier Red Team)