Anthropic says Claude traced NIST ECDSA curve seeds to lrand48 and Unix timestamps

A question that has hung over one of the world's most widely deployed cryptographic standards for roughly 25 years appears settled, and the answer is disarmingly ordinary. According to Anthropic, an internal research version of Claude worked out how the seed values behind the NIST elliptic curves were produced: they are outputs of the C library's lrand48 pseudorandom generator, initialized with a Unix timestamp from the system clock.

Where the suspicion came from

ECDSA, the Elliptic Curve Digital Signature Algorithm, was adopted by NIST in 2000 as part of the FIPS 186-2 Digital Signature Standard. As Anthropic recounts, curves over prime and binary fields were each published with a seed, and the hash of that seed fixes the curve's coefficient b. The seeds came from the NSA with no explanation of how they were derived; the P-256 seed, for instance, appears in the standard with nothing about its origin.

That silence fueled years of unease. Neal Koblitz and Alfred Menezes documented the controversy in their paper "A Riddle Wrapped in an Enigma", and hobbyists later mounted an investigation, backed by a bounty for anyone who could recover the seeds. The leading account came from Jerry Solinas, a longtime NSA employee who generated them. He recalled a derivation involving a joking phrase about him and a colleague deserving raises, plus a counter, but could not remember the specifics. Bob Reiter, who wrote the code, did not remember either, and no archives from the period could be found. Solinas died in 2023 and other contemporaries did not respond, leaving the question open.

The clock, not a passphrase

Anthropic says several of its employees had already hunted for the seeds based on the passphrase story and come up empty, because the story was wrong. In October 2026, one employee asked an internal research model to work out the seeds' origin without mentioning the clue. In under half an hour, Claude had recovered the provenance of the NIST P-192, P-224, P-256, P-384 and P-521 seeds. None involved a hash function at all.

The generating program had instead initialized lrand48 with a Unix timestamp and pulled candidate 20-byte seeds from successive outputs; P-256's published seed turned up on the 1842nd try. Ten prime-field seeds in total, five from NIST and five from the ANSI X9.62 standard, matched the pattern lrand48() >> 23, and each recovered 48-bit generator state regenerates all 160 bits of its seed, a match Anthropic calls impossible by coincidence. Stepping each generator backwards to a srand48-style initialization produced Unix timestamps between May 1997 and April 1998. The four binary-curve seeds initially decoded to February 1984, but doubled they land on April 17, 1998, two weeks after the P-224 run, suggesting the program halved the clock value somewhere.

How the model worked it out

Rather than searching for a phrase, Claude reasoned about what curve-generation software in the 1990s would plausibly have used and guessed a PRNG that shipped with C libraries of the era. It built a scanner that slid along each published seed one bit at a time, testing whether adjacent chunks were consecutive outputs of a vintage generator, across 34 combinations of generator and output slice.

The break came from a statistical tell: four of the ten seeds, viewed as five 32-bit words each, have a zero top bit in all 20 words, which chance would produce roughly once in 5,810 tries. That is the fingerprint of lrand48, which exposes only the top 31 bits of a 48-bit state. Claude confirmed it by trying all 131,072 possible values of the 17 hidden bits in the first word and checking the words that followed. For the prime-curve seeds, which retain even fewer bits of each output, recovering the generator's state became a textbook lattice problem, solved with LLL basis reduction over every possible bit window. Anthropic also published the model's internal reasoning at the moment of discovery, including its own skeptical checks that it was not inside a simulated test environment.

A bonus finding

Seeds do not determine each curve's base point G, and Claude illuminated that too. According to Anthropic, the base points of six curves generated in May 1997, P-192 and the five ANSI X9.62 example curves, came from the random number generator in FreeLIP, Arjen Lenstra's long-integer arithmetic package, which early versions of Victor Shoup's NTL library also shipped.

Why it matters

Anthropic stresses that this is not a cryptographic break and that no one needs to change anything; most researchers already trusted the curves. The significance runs the other way. The unexplained NSA seeds were the strongest thread in suspicions that the NIST curves might hide deliberately engineered weaknesses, and a derivation this crude, a weak 1990s generator reading the system clock and now reproducible by anyone, leaves little room for subversion. It is also a striking demonstration of AI-assisted research: a question that survived decades of human effort and a public bounty fell to a model in under thirty minutes, once it was asked without the misleading clue.