In Under 30 Minutes Claude Solved a 26-Year-Old Cryptography Mystery: the NSA's Unexplained NIST Curve Seeds Came From lrand48 and Unix Timestamps

For 26 years, cryptographers have wondered where the seed values behind NIST's standard elliptic curves came from. On October 16, Anthropic published an answer: its Frontier Red Team reports that an internal research instance of Claude worked out the origins of the NIST P-192, P-224, P-256, P-384 and P-521 seeds in under half an hour. They were never the output of any hash algorithm at all — they are consecutive 20-byte draws from lrand48, the pseudorandom number generator shipped with the C standard library, initialized with a Unix timestamp.

The backstory explains why anyone cared. ECDSA, the most widely used elliptic curve signature standard, was adopted by NIST in 2000 as part of FIPS 186-2. For each standard curve the specification published a "seed" whose hash defines one curve coefficient, and those seeds were supplied by the National Security Agency with no explanation or justification. The P-256 seed, for instance, is the hex string C49D3608 86E70493 6A6678E1 139D26B7 819F7E90 — and nothing in the record says why. That gap fueled decades of speculation that the curves might have been chosen to hide a deliberate weakness, a debate captured in Neal Koblitz and Alfred Menezes's paper "A Riddle Wrapped in an Enigma" and an amateur investigation with a public bounty.

The best-known lead was a joke. In 2015, longtime NSA mathematician Jerry Solinas recalled that the seeds might have come from hashing a humorous passphrase along the lines of "Give Bob and Jerry a raise" — but he could not remember the details, the archives were never found, and Solinas died in 2023. Several Anthropic employees had chased the passphrase theory without success. It turned out to be wrong. This October, one curious employee asked an internal research model whether it could figure out how the seeds were generated, without handing over the flawed clue.

Claude's approach was hypothesis-driven rather than a blind search. It guessed that 1990s-generation software would have used a weak PRNG whose output can be recognized, then wrote a scanner that slid along each published seed one bit at a time, testing whether adjacent chunks matched consecutive outputs from any of 34 generator and slice combinations. A tell-tale pattern — the top bit of every word being zero, a coincidence with probability about 1 in 5,810 — matched lrand48, which returns only the top 31 bits of its 48-bit internal state. Claude then recovered the generator's hidden state with lattice reduction and a brute-force sweep over the missing bits, and stepped the generator backward to its starting values. All five prime-curve seeds decode to timestamps between May 1997 and April 1998; P-256 corresponds to August 16, 1997, where the standardized seed is the 1,842nd 20-byte candidate the generator produced.

The post also settles a related question that, as far as Anthropic knows, had never been explained: the base points. The generator point of P-192 and of five example curves in the ANSI X9.62 standard traces back to the random number generator in FreeLIP, Arjen Lenstra's long-integer arithmetic package — ordinary tooling of the era, not a hidden hand.

Anthropic is explicit about the limits. This is not a cryptographic break, a new attack, or a weakness in the curves, and nothing needs to change. But gaps remain: the seed of binary curve B-163 "fits nothing Claude has tried," most base points are still unexplained, and nobody knows why the 1997-98 run skipped candidates like number 876, which would also have produced a viable P-256. The company argues the findings make intentional backdoors "much less plausible" — a mundane clock-seeded generator leaves little room for subversion.

The result is also verifiable by anyone: Anthropic published reproduction code under CC0, and independent testers have confirmed it regenerates the published P-256 seed exactly. Filippo Valsorda, who organized the original seed bounty, said the $36,864 prize pool will go to the Internet Security Research Group. For a mystery that produced conspiracy theories, journal papers and a federal agency's silence, the ending is almost anticlimactic: the most scrutinized constants in public-key cryptography came from a 1990s C library and a workstation clock.