Claude traces the NIST P-256 curve seeds to 1990s Unix timestamps

What Anthropic found

Anthropic's Frontier Red Team said on 16 October 2026 that one of its internal research models had explained a question cryptographers have argued about for more than 25 years: where the seed values behind the NIST elliptic curves came from. In a research post titled Claude reveals ECDSA curve origins, the team says the seeds for the P-192, P-224, P-256, P-384 and P-521 curves were not hashes of a secret phrase, as long rumoured, but raw output from lrand48, a pseudorandom number generator in the standard C library, started from a Unix timestamp in 1997 or 1998.

Anthropic says the model found the answer in under half an hour after an employee asked it how the seeds were generated, without pointing it to the old rumour. For P-256, the curve that secures a large share of web certificates, the post says the generator was initialised at 01:52:34 on 16 August 1997 in Anthropic's reproduction code, and the published seed was the 1,842nd 20-byte candidate it produced.

The headline for most readers is reassuring. Anthropic writes that this is not a cryptographic break, a new attack or a weakness in the curves, and that it makes the team more confident the curves were chosen without a backdoor. It calls the result a fun closing chapter and says nobody needs to change anything.

Why the NIST curve seeds were a mystery

NIST adopted the elliptic curve version of the Digital Signature Algorithm, ECDSA, in FIPS 186-2 in 2000. The standard lists recommended curves and, for each, a 160-bit seed whose SHA-1 hash defines the curve coefficient b. The idea was that hashing a seed makes the curve verifiably random: nobody could pick a special b without also finding a seed that hashes to it.

The weak point was that nobody explained the seeds themselves. They came from the NSA, and Jerry Solinas, the NSA mathematician who produced them, later said he had hashed a humorous English sentence such as a request for a raise for himself and a colleague, but could not remember it. Neal Koblitz and Alfred Menezes summarised the controversy in their 2015 paper A Riddle Wrapped in an Enigma, and Steve Weis, now one of the Anthropic authors, wrote an investigation of the seed history.

After Solinas died in 2023, cryptographer Filippo Valsorda announced the NIST Elliptic Curves Seeds Bounty: $12,288 for cracking the five prime-curve seeds, tripled to $36,864 if the winner donated it to charity. The bounty went unclaimed for three years. Valsorda wrote at the time that he did not think the backdoor fears were well founded, but that the doubt was worth clearing up.

How Claude worked out the seeds

Instead of guessing phrases, the model reasoned about the software that must have produced the seeds. Weak pseudorandom generators shipped with 1990s C libraries leave statistical fingerprints, so Claude wrote a scanner that slid along each published seed and tested whether neighbouring chunks looked like consecutive outputs of such a generator, across 34 combinations of generator and output slice.

The clue was in the top bits. Written as five 32-bit words, four of the ten seeds under examination had a zero in the top bit of every word, which Anthropic puts at a chance of about 1 in 5,810. That is the signature of lrand48, which keeps a 48-bit internal state and returns only its top 31 bits. Claude then tried all 2^17 possible values of the hidden bits and checked that the following words matched.

The prime-curve seeds kept fewer bits of each output, so recovering the generator state became a textbook lattice problem, which Claude solved with the Lenstra-Lenstra-Lovasz (LLL) basis reduction algorithm. Five NIST prime-curve seeds and five example seeds from the ANSI X9.62 standard all fitted the same pattern, lrand48 output shifted right by 23 bits. Because a 48-bit state regenerated all 160 bits of each seed, Anthropic argues this cannot be coincidence.

Finally, the generator runs backwards as easily as forwards. Stepping each state back to the form set by srand48 produced Unix timestamps between May 1997 and April 1998 for all ten prime-curve seeds. The four binary-curve seeds decode to February 1984, which Anthropic reads as a program that halved the clock: doubled, they land on 17 April 1998, two weeks after the P-224 run.

We re-ran the reproduction code

Anthropic published its reproduction code under a CC0 public-domain dedication, so AI Lookout ran it. On a standard Python 3 install it finished in well under a second and printed seeds for all ten prime curves. We compared the five NIST outputs with the seeds printed in the FIPS 186-2 PDF downloaded from NIST and with the list in Valsorda's bounty post. All five matched character for character, including C49D3608 86E70493 6A6678E1 139D26B7 819F7E90 for P-256.

That check confirms the arithmetic: given the stated timestamps and candidate counts, lrand48 really does produce the standardised seeds. It does not, on its own, prove that this is how the NSA program worked in 1997, but the odds of a 32-bit timestamp and a small index regenerating ten independent 160-bit values by accident are effectively zero, which is the same argument the model made when it questioned whether it was inside a test environment.

Claude's reasoning trace, quoted in the post, shows it doing exactly that, asking whether a 25-year-old mystery could really be this simple and concluding that a direct 160-bit match left no room for chance. Anthropic's red team has been publishing similar model-led work this week, including Claude Mythos 5 designing quantum circuits that beat published resource counts.

The base points and what is still unexplained

Each curve also has a fixed base point, G, which every ECDSA public key is a multiple of, and the seeds do not determine it. While checking the seeds, Claude found that the base points of six curves generated in May 1997, P-192 and the five ANSI X9.62 example curves prime192v2, prime192v3 and prime239v1 to v3, came from the random number generator in FreeLIP, Arjen Lenstra's long-integer arithmetic package, which early versions of Victor Shoup's NTL library also shipped.

The recipe is short: seed the generator with a small integer such as 20000 for P-192, throw away seven outputs, build candidate x-coordinates from 26-bit outputs reduced modulo p, and repeat until x lies on the curve. Anthropic says, as far as it knows, no NIST base point had been explained before. The base points of P-224, P-256, P-384 and P-521 do not fit this recipe and remain unexplained.

There are other loose ends. Not every candidate seed makes a usable curve, but some usable ones were skipped: for P-256 the published seed is candidate 1,842, yet candidate 876 from the same run also yields a prime-order curve of the right size. The P-224 run passed over three such curves and the ANSI runs over seven more. The binary seed for B-163 fits nothing Claude tried.

What it means for ECDSA, TLS and P-256 users

For anyone running TLS, code signing, passkeys or cryptocurrency wallets on P-256 or P-384, the practical advice is unchanged. Anthropic says there is no action to take, and most researchers already trusted the curves. The finding narrows the space for a hidden-weakness theory: a clock-seeded C library generator leaves little room to steer the outcome, and it is now fully reproducible.

The skipped candidates are the one place a sceptic could still push. Anthropic addresses that directly: because only a handful of usable curves were passed over, choosing a weak one would require weak curves to be common and easy to find, which decades of public research have not shown. It concedes that someone could in principle have searched over timestamps for a property, but notes that this would only make sense if the timestamp were going to be disclosed as evidence of innocence, and it never was.

The bounty money goes to a security cause. Anthropic says the $36,864 will be donated to the Internet Security Research Group, the nonprofit behind Let's Encrypt, a certificate authority that issues ECDSA certificates on the same NIST curves.

What it says about AI as a research tool

The striking part is method rather than cryptography. Several Anthropic employees had chased the seeds before, following the humorous-phrase tip, and failed. The model ignored the rumour, formed a hypothesis about 1990s software, wrote its own statistical scanner and lattice solver, and verified the result. This is the same mix of search and verification that has made AI systems effective at open-source vulnerability scanning and exploit research.

It also shows why reproducibility matters when a lab announces a model-made discovery. Anthropic released runnable code that anyone can check in seconds, rather than a benchmark score. That contrasts with harder-to-verify claims elsewhere in AI research, and it fits a week in which Google Quantum AI published magic state cultivation results on Willow alongside its data.

The post says the work was done by an internal research model, not a public product. It does not say which Claude model or how much compute was used, beyond the under-30-minute figure.

Limitations and open questions

The findings come from Anthropic and have not been through peer review, although the core result is easy for anyone to reproduce, as AI Lookout did. The timestamps in the published code are interpreted as UTC; the post does not say what time zone the original machine used, and the binary-curve dates depend on the halved-clock reading, which Anthropic presents as a possibility rather than a certainty.

Open questions remain on why particular candidates were picked over earlier valid ones, how the P-224, P-256, P-384 and P-521 base points were chosen, and what produced the B-163 seed. When AI Lookout checked, Valsorda's 2023 bounty page had not yet been updated with the result. None of that changes the security of the curves, but it leaves a few more pages of cryptographic history for someone to write.