Anthropic says Claude traced the seeds of NIST's ECDSA curve to an RNG from the 1990s

Anthropic’s Frontier Red Team reported in an October 16, 2026 research paper that an internal Claude search model had traced the seed origins of NIST’s ECDSA curve to the C library’s lrand48 random number generator seeded with Unix timestamps, answering a provenance question that had remained open since the NSA provided the values without explanation.

The unexplained seeds of the NSA

ECDSA is the most widely used elliptic curve cryptography standard. NIST adopted it in 2000 as part of the FIPS 186-2 digital signature standard, which lists standard elliptic curves of various sizes and security levels. For curves on prime and binary fields, the specification has published a seed parameter whose hash value defines the coefficient b of the curve. The NSA provided these seeds without any explanation or justification, and the post reproduces seed P-256, C49D3608 86E70493 6A6678E1 139D26B7 819F7E90, as an example of a value published without information about its provenance.

Neal Koblitz and Alfred Menezes summarized the controversy in the article “A Riddle Wrapped in an Enigma”, and the question subsequently led to an amateur investigation into the origins of the seeds and a bounty for anyone who managed to find them. The main story claimed that longtime NSA employee Jerry Solinas had generated the seeds as a hash of a funny passphrase. In a 2015 statement reproduced in the post, Solinas recalled: “The message was along the lines of ‘Give Bob and Jerry a raise’ or ‘Bob and Jerry rule’ or something like that.” He said Bob Reiter wrote the code and that no archive from the period has been found. Solinas died in 2023 and other colleagues did not respond, leaving the question of derivation open.

How Claude recovered the seeds

Several Anthropic employees had unsuccessfully chased the seeds following the tip of a humorous passphrase, which turned out to be wrong, according to the post. In October 2026, an Anthropic employee asked an internal research model if he could figure out how the seeds were generated without pointing out the supposed clue. In less than half an hour, Anthropic reports, Claude identified the sources of NIST seeds P-192, P-224, P-256, P-384, and P-521: output of the C library’s lrand48 random number generator, seeded with a Unix timestamp, with no hash algorithm involved. The generation program drew 20 bytes per iteration as the candidate seed, and the published P-256 seed was the 1842 candidate of its run.

Having exhausted the sentence-based searches, Claude approached the problem from the generator side, hypothesizing software built on a pseudorandom number generator supplied with the 1990s C libraries, with output weak enough to be recognizable. Its scanner gradually advanced along each published seed, testing adjacent pieces as potential consecutive outputs of a ’90s-vintage generator across 34 combinations of generators and output sections. Among the seeds, one pattern stood out: Written as five 32-bit words, four out of ten have a zero at the top of all 20 words, an arrangement that occurs by chance with probability 1/5810. This pointed to lrand48, a linear congruential generator that returns only the first 31 bits of a 48-bit state. For those four seeds, Claude recovered the state of the generator by trying each of the 2^17 possible values of the 17 hidden bits of the first word and verifying that the next four words followed, which was successful for all four.

The seeds of the primary curve were produced by the same lrand48 generator, although each output retained fewer bits. Reconstructing the internal state of a truncated linear congruential generator is a textbook lattice problem, which Claude solved with Lenstra–Lenstra–Lovász (LLL) basis reduction, applying the solver to every possible window. All five seeds from the NIST primary curve, plus five more from the ANSI X9.62 standard, matched the same pattern, lrand48() >> 23, and each recovered 48-bit state regenerates all 160 bits of its seed.

The post also reproduces Claude’s recorded internal reasoning during the session, in which the model tested whether it could work within a simulated test environment before concluding: “It is verified by direct computation on my part: 160-bit match from a 32-bit seed + small index: no random coincidence (10 × 160 bits). It’s real.”

Timestamps and basis points

Since the generator works both backwards and forwards, Claude ran the state of each seed backwards until it reached an srand48 initialization state, recognizable by the low 16 bits of 0x330E, a shape that occurs once every 65,536 steps. For all ten seeds of the primary curve, the initializations were Unix timestamps between May 1997 and April 1998. The four initializations of the binary curve instead read as February 1984; doubling these timestamps maps them to April 17, 1998, two weeks after the P-224’s run, leading the team to suggest that the program may have halved the clock.

Claude also identified where some of the base points on the curve came from. Each curve specifies a base point G, whose fixed point each ECDSA public key is a multiple, and the retrieved seed does not determine this. For the six curves generated in May 1997 – P-192 plus the ANSI According to this recipe, the generator is seeded with a small integer, seven outputs are discarded, candidate x coordinates are drawn from mod-reduced 26-bit outputs, and the extraction repeats until x falls on the curve. The generator seeds identified by Claude are 20000 for P-192; 20420, 20507 and 20509 for prime239v1 up to v3; and 20512 and 20517 for prime192v2 and v3. Anthropic says that, as far as it knows, no NIST base points have been explained before, and the P-224, P-256, P-384, and P-521 base points do not fit this recipe.

Security assessment and open questions

Anthropic says the findings do not represent a cryptographic break, a new attack, or any weakness in the ECDSA curves. The team said the seeds were produced by a common pseudorandom number generator initialized by the clock, a method anyone can now reproduce, which it says leaves much less room for subversion and increases confidence that the parameters are secure. The post frames the result as a final chapter and the end of years of speculation, telling readers that there is no action to be taken because most researchers already trust the curves.

Some questions remain open. Not all 20-byte seed candidates could produce a viable curve, and the team observed that some potentially good candidates were ignored. The published seed of P-256 is candidate 1842, but candidate 876 from the same series also produces a first-order curve of the right size, with parameters chosen in the same way as the published curve. The P-224 run missed three of these candidates, and the two runs behind the ANSI X9.62 example curves missed seven more. Because the number of missed candidates is small, the team said they do not consider the selection of weakened curves plausible, although it remains conceivable in principle that curves with a specific property could have been chosen by searching the timestamps. One seed has completely resisted recovery: the fifth binary seed, B-163, matches nothing that Claude tested. The base points of P-224, P-256, P-384, and P-521, along with those of the NIST binary curves, are still unknown.

The $36,864 bounty for finding the seeds will be donated to the Internet Security Research Group, and the post thanks Filippo Valsorda for organizing the bounty by posthumously recognizing Solinas. The work is credited to John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini and Steve Weis. The reproduction code on the page is dedicated to the public domain under CC0 1.0 Universal.