✓ Official source
Anthropic’s Claude solves the 25-year mystery of the NSA-supplied NIST curve seeds: they were just timestamps
Summary
Anthropic said on Oct. 16 that an internal research version of its Claude model worked out, in under half an hour, how the unexplained seeds behind the NIST P-192, P-224, P-256, P-384 and P-521 elliptic curves were generated, a question open since the NSA supplied them in the late 1990s, according to Anthropic’s write-up, cryptographer Filippo Valsorda and CoinDesk.
The seeds were not hashes of a forgotten phrase, as long rumored, but output from a standard C random-number generator seeded with Unix timestamps from May 1997 to April 1998; Anthropic names the generator lrand48 while Valsorda calls it drand48, from the same POSIX family, and both say the P-256 seed came from a run started Aug. 16, 1997.
Anthropic says this is not a cryptographic break or new attack and that no one needs to change anything, and Valsorda wrote that the findings completely rule out a seed-selection technique described by Daniel Bernstein and Tanja Lange, leaving barely 30 bits of freedom, which he said is not enough to embed any kind of backdoor.
Some questions remain open: the program skipped some usable candidate curves for reasons no one has explained, the seed for the B-163 binary curve is still unexplained, and so are the base points of P-224, P-256, P-384 and P-521.
CoinDesk noted Bitcoin was never part of this mystery because its wallets use the secp256k1 curve, defined by two small fixed numbers that leave little room to hide a weakness, though a powerful quantum computer would pose a separate threat.
Key facts
- Valsorda wrote that the Anthropic team claimed his bounty on Oct. 15, 2026, at 01:07:51 UTC and chose to donate it to ISRG, the nonprofit that operates Let’s Encrypt, tripling its value to $36,864.
- Anthropic said the P-256 seed is the 1,842nd 20-byte candidate from a generator run seeded with a timestamp of Aug. 16, 1997, 01:52:34 UTC, and published code that reproduces the seeds.
- Anthropic said Claude noticed that in four of the ten seeds the top bit of every 32-bit word was zero, a pattern it put at a 1-in-5,810 chance and identified as a signature of lrand48.
- Anthropic said candidate 876 of the same P-256 run also yields a valid prime-order curve, and that it does not know what criteria were used to skip such candidates or whether it was an unintentional artifact.
- Anthropic said Claude also traced the base points of six curves generated in May 1997, including P-192, to the random-number generator in Arjen Lenstra’s FreeLIP package, which it said had not been explained before.
- CoinDesk said suspicion of the NSA-supplied numbers grew after the Snowden disclosures linked the agency to efforts to weaken cryptographic standards, and that NIST later dropped the Dual EC random-number generator from its recommendations.
- CoinDesk said the 2023 bounty started at $12,288 and rose to over $36,000 if the winner donated it to charity, and that NSA mathematician Jerry Solinas, who handed over the seeds in 1997, died earlier in 2023.