Anthropic reported on October 16, 2026 that an internal Claude research model worked out, in under half an hour, where the seed values behind five widely used NIST elliptic curves came from. According to the company's Frontier Red Team, the seeds are not hash outputs at all. They are plain output from lrand48, a random-number generator from 1990s C libraries, started from Unix timestamps dated between May 1997 and April 1998.
The seeds cover the NIST P-192, P-224, P-256, P-384 and P-521 curves, which belong to the ECDSA digital signature standard that NIST adopted in 2000. The NSA supplied them with no explanation, and for years that fueled speculation that they were chosen to hide a weakness. Anthropic says the new result makes that scenario much less plausible, while stressing it is not a mathematical proof.
Why the seeds mattered
ECDSA is the most widely used elliptic-curve signature standard. In the FIPS 186-2 standard, each curve over a prime or binary field is published with a "seed" whose hash defines the curve's coefficient b. The P-256 seed, for example, was published as C49D3608 86E70493 6A6678E1 139D26B7 819F7E90, with no note on where it came from.
Cryptographers Neal Koblitz and Alfred Menezes examined the controversy in a 2015 paper titled "A Riddle Wrapped in an Enigma." The long-favored explanation was that NSA mathematician Jerry Solinas had hashed a humorous passphrase. Researchers, including Anthropic staff, searched for that phrase without success. Solinas died in 2023. A public bounty, organized by cryptography engineer Filippo Valsorda, had also gone unclaimed.
How Claude found it
Anthropic says an employee asked an internal research model in October 2026 to work out how the seeds were generated, without mentioning the passphrase theory. Instead of guessing phrases, Claude reasoned that the generating software probably used a weak pseudorandom number generator (PRNG) of the kind shipped with 1990s C libraries, whose output can be recognized.
- Claude wrote a scanner that slid along each published seed one bit at a time and tested whether adjacent chunks looked like consecutive outputs of such a generator. It covered 34 combinations of generator and output slices.
- It noticed that for four of the ten seeds under review, the top bit was zero in all 20 words. Anthropic puts the odds of that happening by chance at 1 in 5,810. That is a signature of
lrand48, which returns only the top 31 bits of a 48-bit state. - For the prime-curve seeds, which keep fewer bits per output, Claude recovered the generator state using Lenstra–Lenstra–Lovász (LLL) lattice basis reduction, a textbook technique for truncated linear congruential generators.
- Because the generator runs backwards as easily as forwards, Claude stepped each state back to the form that
srand48would have set. For all ten prime-curve seeds, that starting value was a Unix timestamp.
The numbers
The five NIST prime-curve seeds and five more from the ANSI X9.62 standard all follow the same pattern, lrand48() >> 23. Anthropic says each recovered 48-bit state regenerates all 160 bits of its seed, which it notes does not happen by chance. The P-256 seed corresponds to a timestamp of August 16, 1997 and appears as the 1,842nd 20-byte candidate in that run. The P-192 seed required 139 iterations from a May 18, 1997 timestamp.
The four binary-curve seeds that were recovered read as February 1984 when interpreted directly. With the timestamps doubled, they map to April 17, 1998, so Anthropic suggests the generating program may have halved the clock value.
Claude also traced the base points of six curves created in May 1997 to the random-number generator in FreeLIP, Arjen Lenstra's long-integer arithmetic package. Those curves are P-192 and the ANSI X9.62 example curves prime192v2, prime192v3 and prime239v1 to v3. The generator seeds are 20000 for P-192, 20420, 20507 and 20509 for prime239v1 to v3, and 20512 and 20517 for prime192v2 and v3. Anthropic says that, as far as it knows, no NIST base point had been explained before.
The company published Python code that regenerates the seeds and selected base points, released under CC0 1.0. The work is credited to ten Anthropic researchers.
What is still unexplained
- The seed for the binary curve B-163 fits nothing Claude tried and remains unexplained.
- The base points for P-224, P-256, P-384 and P-521 do not fit the FreeLIP recipe, and Anthropic could not explain how they were selected. The same applies to the NIST binary curves.
- Some potentially viable candidate seeds were skipped. For P-256, candidate 876 of the same run would also have produced a prime-order curve. Anthropic says it does not know what criteria were used or whether this was an unintentional artifact.
Anthropic argues that because few candidates were skipped, selecting a weakened curve is not plausible, since that would mean weak curves are common and easy to find. It concedes it is still conceivable that someone searched over timestamps for a curve with a specific property, and notes that nothing in the numbers shows how many runs there were.
Reaction and implications
Anthropic describes the finding as neither a break nor a new attack. In its post, it says the result makes it "more confident the curves were chosen without any backdoors or intentional weaknesses." It adds:
Readers should take this as a fun closing chapter and the end of years of speculation. There is no action to be taken or things to do differently.
CoinDesk reported that the finding does not affect Bitcoin, which uses the secp256k1 curve rather than any of the NIST curves covered here. The outlet also noted that a separate, long-term threat from sufficiently powerful quantum computers is unrelated to how the curves were chosen.
The post also records Claude's own reasoning during the run. After it matched the seeds, the model wrote that the result "solves the 25-year-old mystery," then paused to ask whether it might be inside a simulated test. It then checked the chance of the pattern occurring randomly and concluded it was a real discovery.
The $36,864 bounty tied to the seed question will be donated to the Internet Security Research Group, the nonprofit behind Let's Encrypt. The findings were published on Anthropic's own site rather than in a peer-reviewed venue, so the open questions above remain the main items for outside cryptographers to examine.
Sources: Anthropic, "Claude reveals ECDSA curve origins" and CoinDesk, "'Wow, it's a real discovery': Claude cracks a 25-year NSA number mystery".
