Claude Solved the 25-Year Mystery of the NIST Elliptic Curve Seeds

What happened

On October 16, 2026, Anthropic published Claude reveals ECDSA curve origins. In it, a team of ten Anthropic researchers explain that Claude worked out where the "seeds" behind the NIST elliptic curves came from, a question cryptographers had been asking for about 25 years.

The answer is almost comically ordinary. The seeds for the P-192, P-224, P-256, P-384 and P-521 curves were not the hash of a secret phrase. They were raw output of the C library's lrand48 random number generator, started from a Unix timestamp between May 1997 and April 1998. Anyone can now regenerate them with a few lines of code.

The same day, cryptographer Filippo Valsorda confirmed the result and announced that the team had claimed his NIST Elliptic Curves Seeds Bounty. This page is the long-form briefing behind the BSH Technologies Instagram carousel.

1. The mystery

• Where the curves come from. NIST standardised its elliptic curves in FIPS 186-2, the Digital Signature Standard, in 2000. The curves underpin ECDSA, one of the most widely used signature schemes on the internet. P-256 in particular secures a huge share of TLS connections and code signatures.
• A seed with no story. Following ANSI X9.62, each curve was generated from an arbitrary 160-bit seed, hashed with SHA-1 to set the curve's coefficient b. The seeds were supplied by the NSA, handed to the ANSI X9.62 committee in 1997, with no explanation of how they were chosen. P-256's, for example, is C49D3608 86E70493 6A6678E1 139D26B7 819F7E90.
• Why it mattered. An unexplained seed leaves room for suspicion that someone searched many seeds until they found a curve with a hidden weakness. Neal Koblitz and Alfred Menezes laid out the debate in A Riddle Wrapped in an Enigma.
• The rumour. The best story came from NSA mathematician Jerry Solinas, who recalled in 2015 that the seeds were a hash of a humorous phrase "along the lines of 'Give Bob and Jerry a raise'". Solinas died in 2023, and searches for the phrase came up empty.
• The bounty. In October 2023 Valsorda announced a $12,288 (12 Ki$) bounty for recovering the five seeds, tripled to $36,864 if the winner donated it to charity.

2. How Claude cracked it in under 30 minutes

According to Anthropic, several employees had chased the passphrase rumour without luck. In October 2026, one of them asked an internal research model how the seeds were generated, without pointing it at that clue. Claude took a different angle:

• Think like 1997 software. Claude guessed the generating program used a pseudorandom number generator that shipped with 1990s C libraries. Those generators are weak enough that their output can be recognised.
• Scan for fingerprints. It wrote a scanner that slid along each published seed one bit at a time, testing whether adjacent chunks looked like consecutive outputs of an old generator, across 34 combinations of generator and output slice.
• The tell. Written as five 32-bit words, four of the ten seeds had a zero top bit in all 20 words. By chance that happens with probability about 1 in 5,810. It is the signature of lrand48, which returns only the top 31 bits of a 48-bit state.
• Recover the state. For those seeds, Claude tried all 2¹⁷ values of the hidden bits and checked that the following words matched. The prime-curve seeds kept fewer bits of each output (lrand48() >> 23), so Claude treated it as a truncated linear congruential generator and recovered the state with lattice reduction (LLL), a textbook technique.
• Run the clock backwards. Because the generator runs backwards as easily as forwards, Claude stepped each state back to the form srand48() produces. For all ten prime-curve seeds, the starting value decoded to a Unix timestamp between May 1997 and April 1998.

Anthropic's post even quotes Claude's own reasoning at the moment of discovery, including it checking whether it was in a test environment before concluding: "It's real."

3. The answer: lrand48 and the clock

• The recipe. Seed the generator with the current Unix time, draw 20 bytes per candidate seed, and keep going until a candidate produces a valid curve. Each recovered 48-bit state regenerates all 160 bits of its seed, which does not happen by coincidence.
• P-256's birthday. The P-256 seed is candidate 1,842 of a run seeded at 1997-08-16 01:52:34 UTC. P-192 was candidate 139 of a run on 18 May 1997; P-224 was candidate 7,026 of a run on 3 April 1998.
• Ten curves, not five. The same method explains the five NIST prime curves plus five example curves from ANSI X9.62. Claude also found how four NIST binary-curve seeds were made, apparently from a halved clock reading on 17 April 1998.
• Base points too. Claude traced the base points of six curves, including P-192, to the random number generator in FreeLIP, Arjen Lenstra's long-integer arithmetic library. Anthropic says no NIST base point had been explained before.
• Reproducible. Anthropic published short Python scripts, released under CC0, that regenerate the seeds and the six base points. Valsorda independently reimplemented the algorithm in Go to verify it.

4. Why this rules out a backdoor

• Not a break. Anthropic is explicit: this is not a cryptographic break, a new attack or a weakness in ECDSA, and there is nothing anyone needs to change. If anything, it raises confidence that the curves were chosen without hidden weaknesses.
• Too little freedom. The worry was that the NSA could have searched huge numbers of seeds for a curve in a secret weak class. Valsorda notes that Daniel Bernstein and Tanja Lange had sketched a technique that would need about 70 bits of freedom in seed selection. Even generously allowing any timestamp in 1997-98 and any of the first 16 valid candidates, the NSA had "barely 30 bits of freedom", which he says completely rules that technique out.
• A rehabilitation arc. Valsorda writes that this completes the rehabilitation of NIST elliptic curve cryptography, and that he would now personally recommend the NIST curves over Curve25519. He adds, wryly, that it comes just in time for them to be retired in favour of post-quantum signatures.

5. What is still unexplained

• Skipped curves. Not every viable candidate was used. For P-256, candidate 876 of the same run also gives a valid prime-order curve, yet candidate 1,842 was published. Valsorda found one extra undocumented rule (reject if the curve order is longer than the field) but still has no explanation for why roughly half the remaining valid seeds were passed over. Anthropic says the number of skips is too small for it to be plausible that weakened curves were deliberately selected.
• One stubborn seed. The seed of the binary curve B-163 fits nothing Claude tried.
• Four base points. How the base points of P-224, P-256, P-384 and P-521 were chosen is still unknown, as are those of the binary curves.

6. The bounty goes to Let's Encrypt's nonprofit

Valsorda says the Anthropic team (John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini and Steve Weis) claimed the full bounty on October 15, 2026 at 01:07:51 UTC. They chose to donate it to the Internet Security Research Group, the nonprofit that runs Let's Encrypt, which tripled its value to $36,864.

Why it matters beyond cryptography

This is a clean example of what frontier models are starting to do in research: take a long-standing open question, ignore the misleading folklore, form a concrete hypothesis about how 1990s software behaved, and verify it with code that anyone can rerun. The result is checkable to the last bit, which is exactly what makes it trustworthy. For teams, the lesson is less about whether AI can help with deep technical problems and more about setting it up so its results can be verified.

Sources

• Anthropic: Claude reveals ECDSA curve origins (Oct 16, 2026)
• Filippo Valsorda: The NIST Elliptic Curves Seeds Bounty Has Been Claimed (Oct 16, 2026)
• Filippo Valsorda: Announcing the $12k NIST Elliptic Curves Seeds Bounty (Oct 5, 2023)
• Koblitz and Menezes: A Riddle Wrapped in an Enigma (IACR ePrint 2015/1018)
• NIST: FIPS 186-2, Digital Signature Standard (DSS)
• Internet Security Research Group
• The Defiant: Anthropic Says Claude Traced NIST Curve Seeds to 1990s Timestamps (Oct 2026)

How BSH can help

At BSH Technologies we help teams put AI to work on real engineering problems in a way they can verify: security reviews, cryptography and TLS audits, code analysis with reproducible checks, and agent setups that show their work. If you want AI that speeds up deep technical work without asking you to take its answers on faith, our Thrissur engineers can help you plan and build it.