For more than two decades, cryptographers have wondered where the NIST curve seeds behind ECDSA, one of the most widely used digital signature standards, actually came from. Anthropic now says Claude solved most of that puzzle in under half an hour. The answer turned out to be surprisingly boring: an old random number generator started from a computer clock.
Why the NIST Curve Seeds Were a Mystery
ECDSA became part of NIST’s Digital Signature Standard (FIPS 186-2) in 2000. That standard lists a set of elliptic curves, and each curve’s key coefficient is built by hashing a published “seed” value. The NSA supplied those seeds with no explanation of how they were made.
That silence fed years of suspicion. If nobody knew how the numbers were chosen, some people argued, they could have been picked to hide a weakness or backdoor. A public bounty was even set up for anyone who could explain them.
The Rumor That Led Nowhere
The most popular theory pointed to Jerry Solinas, a longtime NSA employee who passed away in 2023. The story was that the seeds came from hashing a joke phrase, something about giving him and a colleague a raise. Several Anthropic staff had chased that lead without success, and it turned out to be wrong.
How Claude Traced the Curve Seeds
In October 2026, an Anthropic employee asked an internal research model to figure out how the seeds were generated, without pointing it to the old rumor. Instead of hunting for a phrase, Claude asked a different question: what software would someone in the late 1990s have used? It guessed the seeds came from a weak pseudorandom number generator that shipped with C libraries of that era.
Here is the rough path it took:
- It wrote a scanner that slid along each seed bit by bit, testing 34 combinations of old generators and output slices.
- It spotted that some seeds had a zero in the top bit of every 32-bit word, a pattern with odds of about 1 in 5,810 by chance.
- That pattern matched lrand48, a classic C library generator that only returns part of its internal state.
- For the prime-curve seeds, it recovered the hidden state using a well-known lattice technique called LLL reduction.
- It then ran the generator backward until it reached the starting point, which turned out to be a Unix timestamp.
Each recovered state regenerates all 160 bits of its seed, which Anthropic says cannot happen by coincidence. Claude’s own reasoning notes even show it pausing to ask whether it was inside a test environment before concluding the discovery was real.
What Anthropic Found
The results cover the five main NIST prime curves plus several curves from the related ANSI X9.62 standard. Here is a summary of what was explained and what was not:
| Item | Finding |
|---|---|
| P-192, P-224, P-256, P-384, P-521 seeds | Explained: lrand48 seeded with a Unix timestamp |
| Timestamps for prime-curve seeds | Between May 1997 and April 1998 |
| P-256 seed | Candidate number 1,842 from its generator run |
| Base points of six May 1997 curves, including P-192 | Explained: generator from Arjen Lenstra’s FreeLIP library |
| B-163 binary curve seed | Still unexplained |
| Base points of P-224, P-256, P-384, P-521 | Still unexplained |
Four binary-curve seeds decoded to dates in February 1984, which looked odd. When the timestamps are doubled, they land on April 17, 1998, two weeks after the P-224 run, which hints that the program may have halved the clock value.
A Few Skipped Curves
Not every candidate seed produced a usable curve, but a handful of usable ones were passed over. For P-256, candidate 876 from the same run would also have worked, and the reason it was skipped is unknown. Anthropic argues the number of skips is too small for anyone to have been shopping for weak curves.
Is ECDSA Still Safe?
Yes, and Anthropic is clear on this point. This is not a new attack or a crack in the curves. If anything, it makes a hidden backdoor much less plausible, because the seeds came from a simple, reproducible process that anyone can now check.
The work also shows how AI models are becoming useful in security research, a theme seen in Anthropic’s recent work on quantum circuit design and its distillation attack defenses.
What This Means for You
You do not need to change anything. Websites, apps, and wallets that rely on P-256 and its sibling curves are just as safe as they were yesterday.
- If you work in security, the findings close a long-running trust question about standard curves.
- If you use Claude AI for research, this shows the value of letting a model attack a problem from a fresh angle instead of feeding it old assumptions.
- If you follow AI in cybersecurity, expect more cases where models help explain, not just break, old systems.
The $36,864 bounty for finding the seeds will be donated to the Internet Security Research Group.
Sources
This article is based on Anthropic’s research write-up, Anthropic Research. For more updates, see our latest AI news.
Conclusion
A question that puzzled cryptographers since the late 1990s now has a mostly complete answer, and it is reassuringly mundane. Claude showed that the NIST curve seeds came from an old C random number generator seeded by timestamps, not a secret formula. A few pieces remain open, including one binary-curve seed and several base points. Still, the finding strengthens trust in ECDSA rather than weakening it, and it adds another example of AI models doing real, verifiable research work.
