Claude Traces the Mystery NIST Curve Seeds to a 1997 Random Number Generator

Anthropic says an internal research version of Claude has solved one of cryptography’s longest-running small mysteries: where the “seeds” behind the NIST elliptic curves came from. The company published the result on October 16, 2026, and cryptographer Filippo Valsorda, who ran a public bounty for the answer, confirmed it the same day.

The mystery

The NIST curves P-192, P-224, P-256, P-384 and P-521 were standardized in FIPS 186-2 in 2000 and underpin the ECDSA signature standard, which Anthropic calls the most widely used elliptic curve cryptography standard. Each curve was derived by hashing a published 20-byte seed, but the seeds were supplied by the NSA with no explanation. The P-256 seed, for example, is C49D3608 86E70493 6A6678E1 139D26B7 819F7E90. That gap fed years of speculation that the curves could have been chosen to hide a weakness. The best-known story, from NSA mathematician Jerry Solinas before his death in 2023, was that the seeds were hashes of a humorous phrase.

What Claude found

According to Anthropic, an employee asked the model to work out how the seeds were generated without pointing it at the passphrase rumor. In under half an hour, Claude found that the five NIST prime-curve seeds were not hashes at all, but output from the C library’s lrand48 random number generator, initialized with a Unix timestamp. It spotted a statistical fingerprint of that 1990s generator in some seeds, then recovered the generator’s internal state with a standard lattice technique and stepped it back to the moment it was seeded.

Every prime-curve run traces to a timestamp between May 1997 and April 1998. For P-256, the generator was seeded at 01:52:34 UTC on August 16, 1997, and the published seed is the 1,842nd 20-byte candidate. Anthropic published short code that regenerates the seeds; Gobi Daily ran it and got the published P-256 seed. Anthropic says Claude also explained four binary-curve seeds and the base points of P-192 and five ANSI X9.62 example curves.

Independent check and bounty

Valsorda wrote that he reimplemented the algorithm in Go to verify the claim. The Anthropic team claimed his bounty on October 15 and chose to donate it to the Internet Security Research Group, the nonprofit that runs Let’s Encrypt, which tripled its value to $36,864.

What it means

Anthropic says this is not a cryptographic break, new attack or weakness, and that nobody needs to change anything. Because the seeds came from a simple clock-seeded generator that anyone can rerun, it says a deliberate backdoor is much less plausible. Valsorda estimates that even with free choice of timestamp, a designer would have had only about 30 bits of freedom, too little to target a hidden class of weak curves.

What’s still open

Some runs skipped candidates that would also have produced valid curves; P-256’s candidate 876 is one, and nobody yet knows why. The seed for the binary curve B-163 remains unexplained, as do the base points of P-224, P-256, P-384 and P-521.