Claude Solves the 25-Year Mystery of Where the NIST Elliptic Curve Seeds Came From
Anthropic says an internal research model worked out, in under half an hour, that the unexplained seeds behind NIST’s P-curves were not hashed phrases but output from an old C random-number generator seeded with 1997–98 Unix timestamps. Cryptographer Filippo Valsorda independently verified it, and the team claimed his bounty.
By 1EyeAI Desk ·
In FIPS 186-2 (2000), NIST published standard elliptic curves whose parameters come from hashing a 20-byte “seed.” The NSA provided those seeds without saying how they were picked. The long-running story was that the late NSA mathematician Jerry Solinas hashed a joke phrase he later forgot.
Anthropic says that story was wrong. According to its Oct. 16 write-up, an employee asked an internal research model to figure out how the seeds were generated, without pointing it at the phrase rumor. Anthropic says Claude spotted a tell-tale pattern (top bits that were always zero), identified the 48-bit lrand48/drand48 family of C library generators, recovered the generator states (using the LLL lattice technique for the prime curves), and stepped them back to Unix-timestamp starting values from May 1997 to April 1998. That covers P-192, P-224, P-256, P-384 and P-521 plus ANSI X9.62 example curves. P-256, for example, is candidate 1,842 from a run started Aug. 16, 1997. Anthropic published code that regenerates the seeds; we ran it and it reproduced the published P-256 seed exactly.
Filippo Valsorda, who organized the bounty, says he reimplemented the algorithm in Go to verify it. The team claimed the bounty on Oct. 15 and is donating the $36,864 to ISRG, the nonprofit behind Let’s Encrypt. Anthropic says Claude also explained the base points of six curves, including P-192.
Open questions remain: the B-163 seed and most base points are still unexplained, and the runs skipped some valid-looking curves for reasons nobody has pinned down. Both Anthropic and Valsorda say this is not an attack or a weakness.
What this means for you: Nothing to change; Anthropic says there’s no action to take. If you rely on P-256 (most of the web does), the “NSA backdoor in the seeds” theory just lost most of its footing. Valsorda argues the leftover freedom was only about 30 bits, too little to plant a backdoor.