Claude traces NIST curve seeds to a timestamp-based generator

Anthropic says an employee asked an internal research model to determine how the NIST curve seeds were generated, without giving it the rumored clue.[2] Claude identified the origins of seeds for P-192, P-224, P-256, P-384 and P-521 in under half an hour.[2] ECDSA is the most widely used elliptic-curve cryptography standard, according to Anthropic.[2] NIST adopted it in 2000 as part of the FIPS 186-2 Digital Signature Standard.[2] The seed origins had been a longstanding question because the NSA supplied them without explaining their selection.[2]

Anthropic says Claude searched the published seeds bit by bit for adjacent chunks matching consecutive outputs from a 1990s-era random-number generator.[2] Four seeds shared a top-bit pattern that Anthropic says would occur by chance with a probability of 1 in 5,810.[2] Claude then recovered the generator state for four seeds by testing all 2¹⁷ possibilities for the first word’s hidden bits and checking the next four words.[2] Anthropic says all ten seeds matched the output pattern lrand48() >> 23.[2] Each iteration drew 20 bytes as a candidate seed, and P-256’s standardized seed was produced after 1,842 iterations.[2]

Anthropic says the seeds came from the C library’s lrand48 random-number generator initialized with a Unix timestamp, not from a hash algorithm.[2] The ten prime-curve seeds trace to timestamps between May 1997 and April 1998.[2] The four binary-curve initializations point to February 1984, or to April 17, 1998 if the timestamps are doubled.[2] One earlier story held that Jerry Solinas generated the seeds by hashing a humorous passphrase.[2] Anthropic says its findings make an intentional backdoor less plausible.[2]

Anthropic says the discovery is not a cryptographic break, a new attack or a weakness in the ECDSA curves.[2] It also says users do not need to take action or change how they use the curves.[2] The explanation does not account for every related detail: The Injection’s account says the B-163 seed and several NIST curve base points remained unexplained.[1] Separately, the full bounty was claimed on October 15, 2026, at 01:07:51 UTC.[3] Valsorda said the bounty was donated to ISRG, which operates Let’s Encrypt, bringing its value to $36,864.[3]