Claude cracked the 25-year mystery of where NIST's elliptic-curve seeds came from: 1990s timestamps

Anthropic on Friday, Oct. 16, 2026, said a Claude research model figured out in under half an hour how the NSA-supplied "seed" values behind NIST's standard ECDSA curves were generated — a question cryptographers had argued about since the curves were standardized in 2000.

For 25 years the most-used curves on the internet carried a little asterisk: numbers handed over by the NSA with no receipt. The receipt turns out to be a desk clock in 1997 and a lousy random-number generator — which is about the most reassuring boring answer possible. The bigger signal is who found it: a model, in half an hour, on a puzzle humans chased for decades. Today it's a fun closing chapter. Point the same skill at a codebase or a protocol and it's a red team that never gets bored.

Anthropic's Frontier Red Team published "Claude reveals ECDSA curve origins" on Oct. 16, 2026. ECDSA is the Elliptic Curve Digital Signature Algorithm, the math that signs a large share of internet traffic. A seed, here, is a starter number whose hash sets a curve coefficient. Those lines are Anthropic's.

NIST adopted the standard curves in 2000 in FIPS 186-2, the Digital Signature Standard. Each curve came with a seed. The seeds were supplied by the NSA with no explanation, which for years fed suspicion that curves such as P-256 could have been chosen to hide a weakness. Those lines are Anthropic's account of the history, with FIPS 186-2 as the place the seeds were published.

The best-known story, from longtime NSA employee Jerry Solinas, who died in 2023, was that the seeds came from hashing a joke passphrase such as "Give Bob and Jerry a raise." Anthropic employees had chased that lead without success. Those lines are Anthropic's.

An Anthropic employee in October 2026 asked an internal research model to work out how the seeds were generated, without pointing it at that clue. In under half an hour, Claude found the origins of the NIST P-192, P-224, P-256, P-384, and P-521 seeds. Anthropic does not name a public model version. Those lines are Anthropic's.

None of those seeds came from a hash. They are output of the C library's lrand48 generator — a 1990s-era pseudorandom number routine — seeded with a Unix timestamp, meaning seconds since 1970. Each 20-byte draw was a candidate seed. P-256's published seed was candidate 1,842. Those lines are Anthropic's.

Claude scanned the seeds for the fingerprint of 1990s generators, noticed top bits that were always zero (a lrand48 signature), recovered the generator's hidden state using lattice reduction on truncated outputs — a math method for reconstructing missing bits — then stepped the generator backward to its srand48 start. Those steps are Anthropic's.

The ten prime-curve seeds (five NIST plus five ANSI X9.62 example curves) map to Unix timestamps between May 1997 and April 1998. Four binary-curve seeds appear to map to April 17, 1998, if the clock was halved. Prime curves use a prime modulus; binary curves use a different field. Those mappings are Anthropic's.

Claude also explained base points for six curves generated in May 1997 — P-192 and five ANSI X9.62 curves — using the random generator from Arjen Lenstra's FreeLIP library. Anthropic says no NIST base point had been explained before. A base point is the starting spot on the curve used in signatures. Those lines are Anthropic's.

Still unexplained, as Anthropic lists them: the B-163 seed; the base points for P-224, P-256, P-384, P-521, and the binary curves; and why a few viable candidates were skipped, for example P-256 candidate 876.

Anthropic's conclusion: this is not an attack or a weakness in ECDSA. It makes a deliberate backdoor much less plausible. The post says: "There is no action to be taken." Those lines are Anthropic's.

The $36,864 NIST Elliptic Curves Seeds Bounty, organized by Filippo Valsorda, will be donated to the Internet Security Research Group, the nonprofit behind Let's Encrypt. Anthropic published code that regenerates the seeds. The named team: John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini, and Steve Weis. Those lines are Anthropic's.

Claude's logged reasoning included checking whether it was in a test environment before concluding: "It's real." That line is Anthropic's.

The picture is the title frame of Anthropic's official explainer video: "Where the NIST seeds came from," over the curve names P-192 through B-571 on a night-sky illustration. It is the company's graphic from the research post. The frame does not print a calendar date.

In plain terms, Anthropic said on Friday that an internal Claude research model traced NIST's long-mysterious ECDSA curve seeds to a 1990s C-library random generator started with a desk clock, not a hidden hash. The finding, Anthropic says, is not an attack on ECDSA and makes a planted weakness much less plausible. A $36,864 bounty goes to the group behind Let's Encrypt.