Claude Solves the 25 Year Mystery of the NIST Curve Seeds: It Was Just Timestamps

For more than 25 years, cryptographers have wondered where the NIST curve seeds came from. These short strings of hex digits define some of the most widely used elliptic curves on the internet, including P-256, and the NSA supplied them in the late 1990s without ever explaining how they were made. On October 16, Anthropic said its Claude model had finally cracked the puzzle, and the answer turned out to be surprisingly ordinary: the seeds came from a basic C random number generator started with a Unix timestamp.

The finding, published by Anthropic's Frontier Red Team, is not a security break. But it closes one of the longest running open questions in applied cryptography, and it is a striking example of what AI models can now do when pointed at hard technical mysteries.

What happened

ECDSA, the Elliptic Curve Digital Signature Algorithm, is the most common elliptic curve signature standard in use. NIST adopted it in 2000 as part of FIPS 186-2, a standard that also published a set of recommended curves. For the prime and binary curves, the standard includes a "seed." Hashing that seed produces one of the curve's key coefficients.

The catch was that nobody outside the NSA knew where the seeds themselves came from. The P-256 seed, for example, is a 160-bit value that starts with C49D3608. It looked random, but there was no public record of how it was chosen.

According to Anthropic, an employee asked an internal research model to figure out how the seeds were generated, without feeding it any of the earlier theories. The company says Claude found the origin of the seeds in under half an hour.

The answer: timestamps and lrand48

Anthropic reports that the seeds for the NIST P-192, P-224, P-256, P-384 and P-521 curves are outputs of lrand48, a pseudorandom number generator found in the standard C library. The generator was initialized from a Unix timestamp, which is simply a count of seconds since January 1, 1970.

Crypto Briefing, which covered the research, reports that the P-256 run was seeded with timestamp 871696354. That works out to August 16, 1997, at 01:52:34 UTC. The published P-256 seed was candidate number 1,842 from that run. Anthropic says the prime curve timestamps fall between May 1997 and April 1998, and that the binary curves (B-233, B-283, B-409 and B-571) used the same family of generator, with timestamps pointing to April 17, 1998.

How Claude solved the NIST curve seeds puzzle

The method is worth walking through, because it shows the model did real detective work rather than guessing.

First, Claude wrote a scanner that slid across each published seed one bit at a time. It checked whether neighboring chunks looked like consecutive outputs from generators common in the 1990s, testing 34 combinations of generator type and output slice.

Next, it noticed something small. The top bits of several seeds were all zero. Anthropic says that pattern matches lrand48, which keeps a 48-bit internal state but only returns the top 31 bits. For the four seeds with the clearest pattern, Claude brute forced the 17 hidden bits (about 131,000 candidates) and confirmed the following words lined up.

The prime curve seeds were harder because they kept fewer bits from each output. For those, Claude treated the problem as a lattice puzzle and used LLL basis reduction, a well known math technique, to recover the generator's internal state. Five NIST prime seeds and five seeds from the related ANSI X9.62 standard showed the same pattern.

Finally, Claude stepped each recovered state backward to the point where the generator was first started. The low bits matched the fixed constant that the srand48 setup function always uses, and the remaining bits decoded to plausible Unix timestamps from 1997 and 1998.

Checking the work

Anthropic says the recovered states regenerate all 160 bits of each seed, which would not happen by chance. The company estimates the odds of the zero bit pattern showing up in four seeds by accident at about 1 in 5,810, and the odds of a related 20-bit pattern at roughly one in a million. The team also published its reproduction code into the public domain so anyone can rerun it.

Claude also explained the base points (the fixed starting point on each curve) for P-192 and five ANSI example curves. Those came from the random number generator in FreeLIP, a long integer math library written by Arjen Lenstra. Anthropic says no NIST base point had been explained publicly before.

Why it matters

The seeds have been a sore spot for years. After the 2013 revelations about Dual_EC_DRBG, a random number standard widely believed to contain an NSA backdoor, many people became wary of any NSA supplied value that came without an explanation. Researchers Neal Koblitz and Alfred Menezes summed up the worry in a paper titled "A Riddle Wrapped in an Enigma."

The best guess until now came from Jerry Solinas, a longtime NSA mathematician, who suggested the seeds were hashes of a humorous passphrase. Solinas died in 2023, and nobody could reproduce that theory. Anthropic says several of its own employees chased the passphrase idea before the model showed it was wrong.

The new result makes a backdoor look less likely, not more. Anthropic argues that seeds pulled from a simple, public, reproducible process leave very little room for hidden manipulation. If someone had wanted to plant a weak curve, a clock seeded run of a stock C function is an odd way to do it.

It also says something about AI. We have covered how Claude is showing up in serious engineering work, such as when Linus Torvalds used Claude Code on the Linux page cache. Solving a puzzle that stumped human experts for decades is a different level of result, even if it took a well framed question from a person to get there.

Who is affected

In practical terms, almost nobody needs to change anything. Anthropic states plainly that this is "not a cryptographic break, new attack, or weakness in the ECDSA curves," and says no action is required.

That matters because P-256 is everywhere. It secures a large share of HTTPS connections, passkeys and hardware security keys. If you have followed our guide on how to protect your online accounts in 10 minutes, the passkeys you set up very likely rely on it. They are just as safe today as they were last week.

Crypto users can also relax. Bitcoin and Ethereum use a different curve, secp256k1, which was not part of this research. If you want a refresher on how those keys work, see our explainer on how crypto wallets work. The bigger long term threat to those systems is quantum computing, which is why projects like Coinbase's Bitcoin quantum upgrade plan are getting attention.

What is still unknown

The research does not answer everything, and Anthropic is upfront about the gaps.

Some valid candidates were skipped. For P-256, candidate 876 from the same run would also have produced a suitable curve, yet the published seed is candidate 1,842. P-224 skipped three such curves, and the ANSI runs skipped seven more. The authors say they do not know what selection rules were used. They consider it implausible that the skipping hid deliberately weak curves, because such curves would need to be common for that trick to work.

A few items remain unexplained, including the B-163 seed and the base points for P-224, P-256, P-384, P-521 and the NIST binary curves. The data also cannot reveal how many generation runs took place in total.

The bounty

The work claims a $36,864 bounty organized by cryptographer Filippo Valsorda for anyone who could explain the seeds. Anthropic says the money will go to the Internet Security Research Group, the nonprofit behind Let's Encrypt. The paper also posthumously credits Jerry Solinas.

What to watch next

Expect outside cryptographers to rerun the published code over the coming days. Independent confirmation will carry more weight than any company blog post. Crypto Briefing also suggests that other undocumented legacy parameters could be re-examined with similar AI tools, which could become its own small field.

There is a safety angle too. A model that can reverse engineer the inner state of a random number generator in minutes is useful for defenders, and it could be useful to attackers hunting for weak randomness in older systems. Anthropic has warned about offensive AI capabilities before, including its recent caution about AI worms targeting smart devices. For more coverage like this, visit our AI news section.

Frequently asked questions

Are NIST P-256 and other ECDSA curves still safe to use?

Yes. Anthropic says the finding is not an attack or a weakness, and no action is needed. If anything, it lowers suspicion that the curves were secretly rigged.

What are NIST curve seeds?

They are 160-bit values published in the FIPS 186-2 standard. Hashing a seed produces a key coefficient of the curve, so the seed shows how the curve was supposed to be generated.

Did Claude solve this on its own?

An Anthropic employee posed the question to an internal research model, which worked out the method in under 30 minutes, according to the company. Anthropic researchers then verified the results and published reproduction code.

Does this affect Bitcoin?

Not directly. Bitcoin uses the secp256k1 curve, which was not part of this research. The work concerns the NIST and ANSI curves that the NSA seeded in the 1990s.