Anthropic’s Claude model has solved a cryptography mystery that stood for a quarter century: the origin of the “seed” values baked into the NIST elliptic curves that secure much of the intern
Anthropic’s Claude model has solved a cryptography mystery that stood for a quarter century: the origin of the “seed” values baked into the NIST elliptic curves that secure much of the internet. The answer, published October 16, is that the seeds were never a hidden NSA backdoor.
They came from a 1990s random number generator seeded with a Unix timestamp, according to Anthropic’s research. The company says the finding makes a deliberate weakness in the curves “much less plausible.”
The curves in question, P-192, P-224, P-256, P-384, and P-521, underpin ECDSA, the most widely used elliptic-curve signature standard, which NIST adopted in 2000 under FIPS 186-2. Each curve’s coefficient is defined by a “seed” parameter, and the NSA supplied those seeds without explaining where they came from. That silence fueled two decades of speculation that the agency might have chosen curves it could secretly break.
For a cryptographic standard to be trusted, its parameters should be “nothing-up-my-sleeve” numbers, values generated in a way that leaves no room for a designer to hide a weakness. The NIST seeds failed that test.
The P-256 seed, for example, was published as “SEED = C49D3608 86E70493 6A6678E1 139D26B7 819F7E90” with no provenance. Cryptographers Neal Koblitz and Alfred Menezes documented the controversy in a paper titled “A Riddle Wrapped in an Enigma,” and a public bounty sought anyone who could explain the seeds.
The best-known theory held that longtime NSA cryptographer Jerry Solinas generated the seeds from a hash of a humorous passphrase. Solinas, who died in 2023, once recalled a message along the lines of “Give Bob and Jerry a raise.” That tip turned out to be wrong.
Anthropic says a curious employee asked an internal research model in October 2026 to work out how the seeds were generated, and Claude found the answer in under half an hour. None of the seeds came from a hash. Instead, they were outputs of lrand48, a linear congruential random number generator that shipped with 1990s-era C libraries, initialized from the system clock.
Claude’s method was forensic. It wrote a scanner that slid along each published seed bit by bit, checking whether adjacent chunks matched consecutive outputs of 34 candidate generators. A telltale pattern, zero top bits across all 20 words in several seeds, pointed to lrand48, which returns only the top 31 bits of its 48-bit state.
Recovering the state of the prime-curve seeds required solving a lattice problem with the LLL algorithm, because those seeds kept fewer bits of each output. Every recovered 48-bit state regenerated all 160 bits of its seed, which Anthropic notes does not happen by chance.
The initial states resolved to Unix timestamps between May 1997 and April 1998. Claude also traced the base points of P-192 and five ANSI X9.62 example curves to a random number generator inside FreeLIP, Arjen Lenstra’s long-integer package, seeded with small integers such as 20000 and 20517.
Anthropic is explicit that this is “not a cryptographic break, new attack, or weakness in the ECDSA curves.” The opposite: because the seeds can now be reproduced from a clock-seeded generator, there is far less room for deliberate subversion. The curves read as boring, verifiable mathematics rather than a suspected intelligence operation.
For crypto readers, one distinction matters. Bitcoin and Ethereum sign transactions with secp256k1, a different curve specified by the Standards for Efficient Cryptography Group rather than NIST, so this discovery does not directly change their security posture.
The finding instead shores up the broader elliptic-curve ecosystem, because the NIST curves still protect the TLS and web infrastructure that crypto exchanges and wallets rely on daily. It also lands amid wider post-quantum and cryptographic-hardening work across the industry.
Anthropic left two open questions. First, the generator appears to have skipped some viable candidate seeds. For P-256, the published seed was candidate 1,842 even though candidate 876 also produced a valid curve, and the company does not know what selection criteria, if any, were used.
Second, the base points of the four largest NIST curves, P-224, P-256, P-384, and P-521, do not fit the FreeLIP recipe, and their origin remains unexplained.
The discovery also reinforces a separate October 16 Anthropic result: Claude can redesign quantum circuits, including a roughly 17-fold gate reduction for elliptic-curve point addition, the core step in a future quantum attack on these same systems. Together, the two papers show AI moving from writing about cryptography to performing real cryptographic archaeology, a shift the industry is already watching closely.
No. Anthropic’s Claude traced the curve seeds to a clock-seeded 1990s random number generator, which the company says makes a deliberate backdoor much less plausible.
Does this affect Bitcoin’s security?Not directly. Bitcoin uses the secp256k1 curve, which is separate from the NIST P-curves. The finding concerns the NIST curves that secure TLS and other internet infrastructure.
What is a nothing-up-my-sleeve number?It is a constant generated by a transparent, reproducible process so no one can hide a weakness in it. The NIST seeds lacked that provenance, which is why their origin stayed controversial for 25 years.
Will quantum computers break ECDSA?A large enough fault-tolerant quantum computer could eventually solve the elliptic-curve discrete logarithm problem that ECDSA relies on. That threat is separate from this finding, which concerns parameter provenance, not cryptographic weakness.
