For 25 years, people said the NSA hashed a joke to make NIST's curve seeds. Claude found a clock instead.
Anthropic says one of its models traced the seeds behind NIST's most-used elliptic curves to a 1990s random number generator started with a timestamp. It rules out a few backdoor theories. It doesn't rule out all of them.
The number is 1,842. Claude started a 1990s-style random number generator at 01:52:34 UTC on August 16, 1997, asked it for 20 bytes at a time, and the 1,842nd chunk matched the seed behind NIST’s P-256 curve exactly. It’s one of the most widely used curves in everyday cryptography. Until this week, nobody outside the NSA could say where its seed came from.
Anthropic published the result on October 16. An employee asked an internal research model how the seeds might have been generated, without mentioning the popular theory, and Anthropic says the model had its answer in under half an hour.
The story everyone believed
NIST adopted P-192, P-224, P-256, P-384 and P-521 in the 2000 Digital Signature Standard. Each curve comes with a “seed”, and the seeds came from the NSA with no explanation. That gap fed years of suspicion that the agency had tried many seeds until it found one that hid a weakness only it knew about.
The best-known account was a tale from NSA mathematician Jerry Solinas. In a 2015 email he said the seeds came from hashing a joke phrase, something like “Give Bob and Jerry a raise”. Nobody could find the phrase. Solinas died in 2023. In 2023 cryptography engineer Filippo Valsorda put up a bounty of $12,288 for anyone who could show how the seeds were made.
What Claude actually found
The phrase was a dead end, and Anthropic says its employees had burned time on it. Claude skipped it and guessed how the 1990s software must have worked. It wrote a scanner that slid along each published seed looking for the fingerprints of old C-library generators.
The fingerprint was in the top bits. For four of the ten seeds Anthropic studied, the top bit of every one of the 20 words was zero, which would happen by chance about once in 5,810 tries. That pattern points to lrand48, which only returns 31 bits of a 48-bit state. For the prime curves, Claude recovered the generator’s internal state with a lattice-reduction method and stepped it backwards until it hit a Unix timestamp.
Every prime-curve seed landed between May 1997 and April 1998. P-192 took 139 tries, P-521 took 1,136, P-384 took 2,688, and P-224 needed 7,026. Valsorda wrote that he reimplemented the algorithm in Go and reproduced the result himself.
Who confirmed it
Valsorda’s own post says the bounty was claimed on October 15 at 01:07:51 UTC by ten people from Anthropic, including Nicholas Carlini and Steve Weis. Weis had written about the seed mystery for years. They gave the prize to ISRG, the nonprofit behind Let’s Encrypt, which tripled it to $36,864.
Two details differ between the sources. Anthropic’s post says lrand48, Valsorda’s says drand48. Both describe the same thing, a generator seeded by a timestamp passed to srand48. A crypto news site that read both posts noted the naming difference and said it didn’t run either implementation. I didn’t run the code either.
What it rules out, and what it doesn’t
Anthropic calls this “not a cryptographic break” and says nobody needs to do anything. Valsorda argues it kills one specific theory. In 2017 Daniel Bernstein and Tanja Lange described how an attacker with 70 bits of freedom in choosing the seed could aim at a hypothetical family of weak curves. A seed taken from a clock gives far less room. Valsorda puts it at barely 30 bits, even with generous assumptions.
Anthropic is more careful than some of its headlines. Its own post lists loose ends: some candidates were skipped, and the criteria are unknown. For P-256, candidate 876 of the same run also gives a valid curve of the right size, but the published seed is candidate 1,842. One binary-curve seed, B-163, fits nothing Claude tried. The base points for P-224, P-256, P-384 and P-521 are still unexplained.
My read
This is good news for the web, and I think the framing around it is a bit too neat. A backdoor never needed an exotic generator. It needed someone choosing which run to publish. Anthropic admits it is “still conceivable” that curves were picked by searching over timestamps, though it argues you’d only do that if you meant to publish the timestamp as proof of innocence. Commenters on Hacker News raised the same worry, and nobody has an answer yet.
The less flattering lesson is about process. The seeds weren’t produced with the “nothing up my sleeve” method modern cryptographers want, where anyone can see there was no choice. They came from an ordinary tool, started at an arbitrary second, with the details never written down.
It’s also worth noticing who did the digging. Anthropic is preparing an IPO (see our look at its prospectus) and likes a clean demonstration of what its models can do. That doesn’t make the result wrong, since anyone can re-run it, and Valsorda did. I’d still treat “this settles it” as more confident than the evidence. We covered a milder case of the same caution when Anthropic said Claude found a CRISPR-like system.
CoinDesk adds one practical note: Bitcoin isn’t touched, because it uses a different curve, secp256k1.
Sources
- Claude reveals ECDSA curve origins, Anthropic Frontier Red Team
- The NIST Elliptic Curves Seeds Bounty Has Been Claimed, Filippo Valsorda
- Anthropic’s Claude cracks a 25-year NSA curve mystery, what it means for bitcoin, CoinDesk
- NIST curve seeds traced to lrand48 by Anthropic team, The Terminal