Claude cracked the 25-year NIST curve seed mystery

In October 2026, an Anthropic employee asked an internal research model how the seed values behind the NIST standard elliptic curves were generated. Less than half an hour later, Claude had an answer: the seeds were the output of lrand48, the pseudorandom number generator that ships in 1990s C libraries, initialized from a Unix timestamp. No hash, no classified process, no backdoor. Just a clock and a weak PRNG.

The question nobody could answer

ECDSA is the most widely used elliptic curve signature standard. NIST adopted it in 2000 as part of FIPS 186-2, and the specification publishes a 20-byte "seed" for each standard curve. Hashing that seed defines the curve, so the seed's origin matters. The seeds were supplied by the NSA with no explanation, and they became a 25-year running mystery in the cryptographic community. Neal Koblitz and Alfred Menezes wrote up the history in "A Riddle Wrapped in an Enigma", amateurs dug into it, and Filippo Valsorda organized a $36,864 bounty for anyone who could find them.

The best circulating story was that NSA engineer Jerry Solinas generated the seeds by hashing a humorous passphrase along the lines of "Give Bob and Jerry a raise". Solinas told a reporter in 2015 that he thought there was a counter or multiple hashing involved, but that nobody remembered the details. He died in 2023, the other colleagues from that era did not respond, and the question stayed open.

What Claude found

None of the seeds were the result of any hash algorithm. Each one came from lrand48, seeded with srand48(t) where t is a Unix timestamp. The generating program drew 20 bytes per candidate seed and kept iterating until it found an acceptable curve. P-256, the workhorse curve behind most TLS and signatures, turned out to be candidate number 1,842 of a run started on August 16, 1997.

The interesting part is how Claude got there. The passphrase rumor had already been searched and produced nothing. Claude instead guessed that the software must have used a PRNG from a 1990s C library, wrote a scanner that slid along each published seed and tested whether adjacent chunks were consecutive outputs of old generators, and noticed a pattern: the top bits of some seeds were all zero. That is the signature of lrand48, which returns only the top 31 bits of its 48-bit state, a coincidence with probability about 1/5,810. Brute-forcing the hidden bits recovered the internal state for four seeds, and for the truncated ones Claude used LLL lattice reduction, a textbook tool for recovering the state of truncated linear congruential generators. Run the generator backwards and every prime-curve seed's initialization resolves to a Unix timestamp between May 1997 and April 1998. The four binary-curve seeds read as February 1984, which maps to April 17, 1998 if the program halved the clock.

Claude also located the base points (the fixed point G that every ECDSA public key is a multiple of) for P-192 and five ANSI X9.62 example curves: they came from the random number generator in FreeLIP, Arjen Lenstra's long-integer arithmetic package, which early versions of Victor Shoup's NTL library also shipped.

What it means

This is not a cryptographic break, a new attack, or a weakness. Anthropic is explicit that readers should take this as a closing chapter: there is no action to take, and the seeds being reproducible from a clock makes a deliberately planted weakness much less plausible, not more. The $36,864 bounty will be donated to the Internet Security Research Group.

The open pieces remain honest: some viable candidate curves were skipped during the runs and nobody knows why, the B-163 binary seed fits nothing Claude tried, and the base points of P-224, P-256, P-384 and P-521 are still unexplained. The work comes from Anthropic's Frontier Red Team, with John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini and Steve Weis.

If you run ECDSA, which effectively means you do, nothing changes. The curves you sign with every day were generated in a way anyone can now reproduce, and the 25-year suspicion about them loses most of its footing.