On October 16, Anthropic published that Claude, in internal use, worked out how the "seeds" of the NIST elliptic curves used in ECDSA were produced, a mystery open since the FIPS 186-2 standard released them in 2000. According to the company, the seeds came from a pseudorandom number generator common in the 1990s, started with a Unix timestamp, and not from the hash of a phrase, as an old account suggested. Anthropic itself stresses that this is not a flaw in the curves.

Why these seeds were a mystery

Curves such as P-256 are defined by parameters and a seed that, in theory, shows they were not hand-picked. The NIST curve seeds came from the NSA with no explanation, which fed years of suspicion about possible hidden backdoors. Anthropic recalls the 2015 paper by Koblitz and Menezes on the subject and the account of Jerry Solinas, who suggested a hash of a humorous phrase. Solinas died in 2023, and the question stayed unanswered, with a bounty open for whoever solved it.

How Claude got there

According to Anthropic, an employee asked an internal model to find the origin of the seeds, without pointing to the phrase clue. Claude hypothesized a random number generator shipped with 1990s C libraries and wrote a scanner that tested 34 combinations of generator and output slices. It noticed that the top bits of some seeds were zero, which pointed to lrand48, a linear congruential generator.

For the prime curves, which keep fewer bits per output, the model recovered the generator's internal state with the LLL lattice reduction algorithm, stepped the state back to the initial srand48 call and read off the timestamps. The company also examined how the base points were generated.

What was found

  • Prime curves: the seeds for P-192, P-224, P-256, P-384 and P-521 came from lrand48 started with a timestamp. Ten prime-curve seeds map to dates between May 1997 and April 1998.
  • Binary curves: the four seeds initialize at February 1984 timestamps. Doubled, they reach April 17, 1998, two weeks after the P-224 run; Anthropic treats the idea that the program halved the clock value as a hypothesis.
  • Base points: six points (P-192 and five ANSI X9.62 example curves) come from the generator in FreeLIP, Arjen Lenstra's long-integer package, which early versions of Victor Shoup's NTL library also shipped.

Anthropic published Python code that regenerates the listed seeds and some base points, with output matching the published values. Secondary coverage reports that the result was checked by Filippo Valsorda, who organized the bounty; that verification does not appear in the official summary we reviewed.

What Anthropic says this is not

The company states that "this is not a cryptographic break, new attack, or weakness in the ECDSA curves." Its argument runs the other way: because the seeds came from a simple, reproducible process, the backdoor theory becomes less plausible. The $36,864 bounty will be donated to the Internet Security Research Group. The work involved John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini and Steve Weis.

What is still unknown

  • The seed of the binary curve B-163 remains unexplained.
  • The base points of P-224, P-256, P-384, P-521 and the NIST binary curves still have no known origin.
  • Some valid candidates were skipped during generation (for example, candidate 876 for P-256), for an unknown reason. The authors say the number of skipped candidates is too small to suggest deliberately weakened curves.
  • Nothing in the numbers shows how many generation runs took place.

Why it matters for the portal

The story is a cousin of the AI reverse-engineering projects Portal GTA 6 follows, such as the complete decompilation of Super Smash Bros. Melee: a model starts from partial clues, tests hypotheses and validates the result against something verifiable. Here the validation is the exact regeneration of values published more than 25 years ago. Since the account comes from Anthropic itself, it is worth reading the open code and independent analyses too.