Claude Traced the NIST ECDSA Curve Seeds to a 1990s Random Number Generator

Anthropic says Claude has solved a puzzle that cryptographers argued about for decades: where the seeds behind NIST's elliptic curves came from. In a post dated October 16, 2026, the company's Frontier Red Team reports that the seeds for the standard ECDSA curves were produced by the C library generator lrand48, seeded with a Unix timestamp, rather than by hashing a memorable phrase. The write-up is on anthropic.com/research/ecdsa-curve-origins.

Anthropic is explicit that this is not a break of ECDSA. It is a provenance finding about how the curve parameters were chosen, and it speaks to a long-running fear that the curves hide an intentional weakness. This post walks through the claim, how Claude reached it, what the evidence does and does not establish, and how it fits Anthropic's recent run of AI-for-science and cryptography work.

TL;DR: the claims at a glance

Background: why the seeds mattered

NIST adopted ECDSA in 2000 through FIPS 186-2. The standard listed elliptic curves whose coefficient b was derived from a "seed" value that the NSA supplied without explanation. The idea of a seed is supposed to reassure: if the curve parameter is the hash of a seed, the designer cannot freely pick a curve with a hidden weakness, because they would have to find a seed that hashes to it.

When the seeds themselves look arbitrary, that reassurance weakens. The debate is discussed in the 2015 paper A Riddle Wrapped in an Enigma by Neal Koblitz and Alfred Menezes, and it later grew into an amateur investigation and a bounty for anyone who could explain the seeds. A 2015 tip suggested the seeds were hashes of a humorous passphrase. Jerry Solinas, the former NSA employee often associated with the curves, described a counter-based hashing process he could not recall in detail. He died in 2023. Anthropic's team says the passphrase tip was wrong.

If you track the broader worry about hidden weaknesses in cryptographic standards, explainx.ai has covered the adjacent threads: Anthropic's July report on cryptographic weaknesses in HAWK and AES and the debate over AI labs probing cryptography with claims checked against what was verified.

How Claude reached the answer

According to Anthropic, an employee asked an internal research model to work out how the seeds were generated, without the incorrect passphrase clue. Claude is reported to have done so in under 30 minutes. The steps described are worth reading closely because they are a clean example of hypothesis-driven analysis rather than blind search.

Step 1: guess a weak 1990s generator

Claude hypothesized that the software that produced the seeds used a weak pseudorandom generator typical of the 1990s, and wrote a scanner that tested adjacent chunks of each seed for generator output patterns. The scan covered 34 generator and slice combinations.

Step 2: spot the zero top bit

It noticed that the top bit was zero across all words in four of the ten seeds. By chance that happens with probability about 1 in 5,810. That pattern matches lrand48, which returns only the top 31 bits of a 48-bit internal state, so every word it emits has a clear high bit.

Step 3: recover the hidden state

For the binary-curve style case, the missing 17 bits were recovered by brute force over 2^17 values. For the truncated prime-curve seeds, built from lrand48() >> 23, Claude used the LLL lattice basis reduction algorithm, a standard tool for recovering hidden state from truncated linear generator output.

Step 4: wind the clock backward

Stepping the generator state back to a srand48 initialization, every prime-curve seed mapped to a timestamp between May 1997 and April 1998. The four binary-curve seeds mapped to February 1984 when read directly. Doubling those timestamps gave April 17, 1998, which suggests the program may have halved the clock value.

That last detail is the kind of oddity that makes the story credible: a messy, human-scale software artifact rather than a polished cover story.

The base points: a partial answer

Seeds define the curve coefficient; the base point is the generator point on the curve. Anthropic reports that six curves (P-192, prime192v2, prime192v3, prime239v1, prime239v2 and prime239v3) have base points that come from the random number generator in FreeLIP, Arjen Lenstra's long-integer package. Early versions of the NTL library shipped the same code.

The generator seeds involved are 20000 for P-192, 20420, 20507 and 20509 for the three prime239 curves, and 20512 and 20517 for prime192v2 and v3. Those small, human-looking numbers fit a programmer iterating through trial values.

The base points of P-224, P-256, P-384 and P-521 do not fit this recipe, and their origin remains unexplained. For anyone running TLS, code signing or a blockchain wallet on P-256, this is the loose end that matters most, and Anthropic says plainly it has not closed it.

What this does and does not prove

Anthropic's own caveats are the most useful part of the post.

• Not a break. The team states this is not a cryptographic break or weakness. Nothing about signature security changes today.
• Makes a backdoor less plausible, not impossible. The seeds came from a simple, reproducible process. The team considers it implausible that weakened curves were chosen, but notes it is conceivable that someone searched timestamps to make a seed look innocent.
• Skipped candidates. Each candidate seed is 20 bytes drawn from the generator, and P-256's published seed is candidate 1842. Yet P-256 candidate 876 also yields a prime-order curve with the same construction. P-224 skipped three such curves, and the ANSI runs skipped seven more. The selection criteria are unknown.
• Unknowable run count. Nothing in the numbers shows how many search runs occurred before the published seed was chosen.
• Open items. The fifth binary seed, B-163, is unexplained, and so are the base points of P-224, P-256, P-384, P-521 and the NIST binary curves.

In other words, the finding replaces a mystery ("why do these seeds look random but unexplained?") with a mundane answer for most of the seeds, while leaving the exact questions a skeptic would ask next. A claim like "a backdoor was impossible" is not what the research says.

What this means if you build with cryptography

For practitioners the day-to-day guidance does not change. Keep using vetted curves and libraries, keep an eye on migration plans to post-quantum schemes, and treat curve-provenance questions as a reason to prefer designs with fully documented, "nothing up my sleeve" parameters where you have the choice. Curve25519-style designs were created partly in response to exactly this unease.

If your compliance regime still requires NIST curves, nothing here gives you a reason to stop. The research shifts the likelihood estimate about intent, not the security margin of the math. The executive orders on post-quantum cryptography are a more pressing planning input than seed archaeology.

The AI angle: what kind of task is this?

This is a different kind of result from the benchmark headlines. The task had a known answer shape (find a generator and a timestamp that reproduce 14 published seeds) and an exact checker: either the generator reproduces the bytes or it does not. That makes it an ideal setting for an agent, because the model can form a hypothesis, test it in code, and know immediately whether it worked. The released CC0 code lets anyone replay the result, which is a stronger form of evidence than a model's narrative.

It also fits a pattern in Anthropic's recent science output. Claude recently designed quantum circuits that beat the best published ones, built a complete UV map of the sky, found a novel CRISPR-like enzyme system and, in an earlier post, covered Claude's Lean work on Fermat's Last Theorem. In each case the claim should be read alongside the verification story: here the verification is a reproducible script.

One caution applies. The post comes from the lab that built the model, and the "under half an hour" figure is Anthropic's account of an internal run. The code release is what lets outside cryptographers check the seeds themselves; the timing is not independently measurable.

Security and safety note

Any time an AI agent runs unattended analysis on sensitive code or data, the usual controls apply: sandbox it, limit network access, and review what it executes. If you deploy agents for security research, AgentBeam is the agent security platform from the explainx.ai team that stops AI agents before they take dangerous actions.

The bounty and credits

The $36,864 bounty tied to finding the seeds will be donated to the Internet Security Research Group, the nonprofit behind Let's Encrypt. Ten Anthropic researchers are credited, including John Wood and Steve Weis, and the team thanks Filippo Valsorda for organizing the bounty. The CC0 1.0 reproduction code reproduces all 14 seeds and six base points.

What to watch next

• Independent replication by cryptographers using the released code, particularly on the timestamp interpretation for the binary curves.
• Any new evidence on the P-256 base point, the most widely deployed unexplained item.
• Whether NIST or the NSA comment on the 1997-98 provenance or on the skipped candidate curves.
• Whether other labs publish similar "agent plus exact checker" results on old standards.

Related reading

• Anthropic on cryptographic weaknesses in HAWK and AES (July 2026)
• AI labs probing cryptography: claimed vs verified
• Claude designed quantum circuits that beat the best published ones
• Claude Science and the first complete UV sky map
• Claude and the CRISPR-like enzyme system discovery
• Post-quantum cryptography executive orders
• Claude and the Lean proof of Fermat's Last Theorem
• Official: Anthropic research post and AgentBeam for agent security

Figures and details reflect Anthropic's post of October 16, 2026 and may be revised as outside researchers replicate the work.