Anthropic Says Claude Solved the 25-Year Mystery of NIST's ECDSA Curve Seeds

Anthropic's Frontier Red Team published a result on October 16, 2026 claiming that an internal Claude research model identified how the seed values behind the NIST elliptic curves were generated — a question the cryptography community has argued about for roughly a quarter century. According to the post, the seeds are not hashes of anything clever or sinister, but raw output from lrand48, a weak pseudorandom number generator that shipped with 1990s C libraries, initialized with a Unix timestamp. Anthropic is explicit that this is not a cryptographic break and that nobody needs to change anything.

What was actually found

ECDSA, standardized by NIST in 2000 as part of FIPS 186-2, specifies a set of elliptic curves. For the prime and binary field curves, the standard published a "seed" whose hash determines the curve coefficient b. The NSA supplied those seeds with no explanation — the P-256 seed, for example, is the opaque string C49D360886E704936A6678E1139D26B7819F7E90. That silence fed years of speculation, summarized in Neal Koblitz and Alfred Menezes' paper "A Riddle Wrapped in an Enigma," and eventually produced a community bounty for anyone who could explain the numbers.

The long-running folk explanation, attributed to the late NSA mathematician Jerry Solinas, was that the seeds came from hashing a joke passphrase along the lines of "Give Bob and Jerry a raise." Anthropic says several of its own employees chased that lead and got nowhere. In October 2026, an employee asked an internal research model to figure out the derivation without being given the rumor. Anthropic says Claude produced the answer in under half an hour, covering P-192, P-224, P-256, P-384 and P-521.

The mechanism described is mundane: seed srand48 with a Unix timestamp, then draw 20 bytes per candidate seed and iterate. P-256's published seed, per Anthropic, is candidate 1,842 of a run starting from a timestamp corresponding to August 16, 1997. The post includes short Python snippets that regenerate all ten prime-curve seeds and four binary-curve seeds from a date string and an iteration count.

How the model got there

The method is worth reading as a template, because it is ordinary cryptanalytic craft rather than anything exotic. Anthropic says Claude reasoned about what software a 1990s team would plausibly have used, guessed a vintage C-library PRNG, and wrote a scanner that slid bit-by-bit along each published seed checking whether adjacent chunks looked like consecutive generator outputs, across 34 combinations of generator and output slice.

The tell was statistical. Written as five 32-bit words, four of the ten seeds had a zero in the top bit of every word — a pattern Anthropic puts at roughly 1 in 5,810 by chance, and a signature of lrand48, which returns only the top 31 bits of a 48-bit state. From there, recovering the hidden bits was brute force over 2¹⁷ possibilities. The prime-curve seeds retained fewer bits per output, which turned state recovery into a truncated linear congruential generator problem — a textbook application of LLL lattice basis reduction. Running that solver over every bit window, Anthropic says, showed that five NIST prime-curve seeds and five ANSI X9.62 seeds all used lrand48() >> 23.

Because an LCG runs backward as easily as forward, Claude stepped each recovered state back to the form srand48 would have produced, identified by low bits equal to 0x330E. Hitting that form happens every 65,536 steps and proves nothing by itself. The evidence is that all ten resulting initializations decode as Unix timestamps between May 1997 and April 1998. The four binary-curve initializations decode as February 1984, but doubling them lands on April 17, 1998, two weeks after the P-224 run — which Anthropic suggests means the program may have halved the clock. That is an inference, not a confirmed reading.

Anthropic also quotes the model's own internal reasoning, including it questioning whether it was in a test environment before concluding the match across ten seeds and 160 bits each could not be coincidence.

Separately, Anthropic says Claude explained where some base points came from — the fixed point G that every ECDSA public key is a multiple of, which the curve seed does not determine. For P-192 and five ANSI X9.62 example curves, the base points reproduce from the random generator in FreeLIP, Arjen Lenstra's long-integer package, whose code also shipped in early versions of Victor Shoup's NTL. Anthropic says no NIST base point had been explained publicly before this.

Why it reduces suspicion without eliminating it

The security argument here is indirect and Anthropic states it carefully: a clock-seeded stock PRNG leaves little room for subversion, because anyone can now reproduce the process. A backdoored curve would require the generating party to steer the output, and a timestamp-seeded LCG with a published iteration count is a poor vehicle for that.

But the post does not claim proof. It notes that an adversary could in principle search over timestamps to find a run containing a curve with a desired property — and that nothing in the numbers reveals how many runs were performed. Anthropic's counterargument is practical rather than mathematical: the number of skipped candidates is small, and if weakened curves were easy to find in a handful of draws, weakened curves would have to be common.

Those skips are the most interesting loose end. Anthropic says candidate 876 of the P-256 run also yields a prime-order curve of the right size under the same parameter rules, yet candidate 1,842 was published. The P-224 run passed over three such curves, and the two ANSI runs passed over seven more. The selection criteria are unknown, and Anthropic allows it may be an unintentional artifact.

What's still unexplained

Four items remain open by Anthropic's own account: the B-163 binary seed fits nothing tried; the base points for P-224, P-256, P-384 and P-521 are unexplained; the NIST binary curve base points are unexplained; and the candidate-skipping rule is unknown. Anthropic says the $36,864 bounty, organized by Filippo Valsorda, will be donated to the Internet Security Research Group.

For readers tracking AI research claims, the methodological point matters more than the cryptography. This is a result where verification is cheap: the published code either regenerates the standardized seeds or it does not. That is a very different epistemic situation from AI-generated claims in domains with no fast oracle. Anthropic has been publicizing other scientific results from Claude, including work it says improved on published quantum circuit designs. Which specific model produced this result, how many attempts preceded the successful run, and how much human steering was involved were not disclosed.

What to watch

• Whether independent cryptographers reproduce the seed derivations and endorse the lrand48 explanation, or find a competing account of the skipped candidates.
• Whether anyone explains B-163 and the four unexplained NIST base points, which would close the remaining gaps in the provenance story.
• Whether Anthropic or others disclose process details — model version, number of attempts, degree of human prompting — that would let readers judge how repeatable this kind of discovery is.
• Whether standards bodies cite the finding in any future discussion of curve provenance, or treat it as historical trivia with no normative weight.
• Whether this pattern — AI applied to old, verifiable, well-defined puzzles with public ground truth — becomes the standard proving ground for claims about AI research capability.