Claude NIST ECDSA Curve Seeds Mystery Explained: The 1997 Clock Behind the Internet's Most-Used Curves (World Tech)

Image: Anthropic — Claude reveals ECDSA curve origins (official research illustration)

TL;DR: Claude NIST ECDSA curve seeds mystery explained: Anthropic's internal research model traced the NSA's unexplained NIST curve seeds — a 25-year-old cryptography puzzle — to the C library's lrand48 generator seeded with plain Unix timestamps from 1997–1998. It is not a hack, not a backdoor, and nothing needs to change.

📌 KEY HIGHLIGHTS

• The mystery, closed in under 30 minutes: an Anthropic employee asked an internal Claude research model to work out how the NIST curve seeds were generated, without pointing it at the old passphrase rumour — and it found the answer.
• The answer was a 1990s clock, not a secret phrase: the seeds are outputs of the C library's lrand48 generator, seeded with Unix timestamps between May 1997 and April 1998.
• P-256, the internet's workhorse curve: its published seed is candidate 1,842 from a generator run started on 16 August 1997 at 01:52:34 UTC.
• Not a break: Anthropic stresses this is no attack and no weakness — if anything, it makes a deliberately planted backdoor much less plausible.
• Loose ends remain: one binary-curve seed (B-163) and the base points of P-224, P-256, P-384 and P-521 are still unexplained.

Claude NIST ECDSA Curve Seeds Mystery Explained: What Actually Happened

ECDSA is the most widely used elliptic-curve cryptography standard, adopted by NIST in 2000 as part of FIPS 186-2. For curves over prime and binary fields, the specification published a "seed" value whose hash defines part of the curve — and those seeds arrived from the NSA with no explanation of how they were chosen. The P-256 seed, for example, was published as C49D3608 86E70493 6A6678E1 139D26B7 819F7E90, with no record of where it came from.

For 25 years, cryptographers wondered whether the unexplained seeds hid a backdoor. The best story came from Jerry Solinas, a longtime NSA employee, who recalled in 2015 that the seeds might have been a hash of a humorous passphrase along the lines of "Give Bob and Jerry a raise". Solinas died in 2023, colleagues could not fill the gaps, and cryptography engineer Filippo Valsorda put up a bounty — originally $12,288, tripled to $36,864 for charity — for anyone who could find the real answer. Anthropic published the solution on 16 October 2026 (and updated its write-up on 23 October): the seeds were never hashes at all.

How Claude Found It in Under 30 Minutes

Claude tried a different angle from the passphrase hunters: it reasoned about what software a 1990s government team would actually have used, and guessed a pseudorandom number generator (PRNG) from 1990s C libraries. Old PRNGs are weak enough that their output can be recognised — and recognising it can reveal both the generator and its starting state.

Claude wrote a scanner that slid along each published seed one bit at a time, testing 34 combinations of generator and output slices. Then the fingerprint jumped out: written as five 32-bit words, four of the ten seeds have a zero in the top bit of all 20 words — something that would happen by chance with probability 1 in 5,810. That is the signature of lrand48, which returns only the top 31 bits of a 48-bit internal state. From there, Claude recovered the hidden bits, used the textbook Lenstra–Lenstra–Lovász (LLL) lattice algorithm to rebuild the generator's full state from the truncated outputs, and ran the generator backwards to its starting point.

Every starting point turned out to be a Unix timestamp from 1997 or 1998. The generator would draw 20 bytes per iteration as a candidate seed, so the published seed is simply candidate N of one dated run. The model even doubted itself mid-task — its recorded reasoning reads: "This is astonishing: it solves the 25-year-old mystery… All top bits clear — 20 bits, chance 1e-6. So indeed real-world. Wow, it's a real discovery."

Image: Anthropic — ECDSA curve origins research diagram (official research illustration)

The Seeds, Curve by Curve

Curve / group	What Claude found	Status
P-256 (most widely used)	Run started 16 Aug 1997, 01:52:34 UTC; published seed is candidate 1,842	Explained
P-192, P-384, P-521	Same lrand48 generator, runs dated May–August 1997	Explained
P-224	Run dated 3 April 1998	Explained
Binary curves (B-233 to B-571)	Clock value apparently halved; doubled timestamps point to 17 April 1998	Explained, with a quirk
B-163 seed	Fits nothing Claude tried	Still unexplained
Base points of P-224, P-256, P-384, P-521	Do not fit the FreeLIP recipe that explains six May-1997 base points	Still unexplained

Claude also explained six base points — the fixed point G that every ECDSA public key is a multiple of — for the curves generated in May 1997 (P-192 plus five ANSI X9.62 example curves). They came from the random-number generator in Arjen Lenstra's FreeLIP long-integer package: seed it with a small integer (20000 for P-192; 20420, 20507, 20509, 20512, 20517 for the others), throw away seven outputs, and test candidate x-coordinates until one lands on the curve. Anthropic notes that, as far as it knows, no NIST base point had ever been explained before.

One detail keeps the story honest: not every candidate seed could make a viable curve, and some viable ones were skipped — candidate 876 of the P-256 run would also have worked, P-224's run passed over three viable curves, and the ANSI example runs passed over seven more. Anthropic argues the skipped count is too small to suggest weakened curves were deliberately picked.

Why It Matters for World Tech Readers

This is not a story about your passwords being at risk — it is a story about trust in the invisible plumbing of the internet. ECDSA signs a huge share of the web's secure traffic, and for decades its most important parameters carried an unexplained provenance that fuelled backdoor speculation. A simple, reproducible, clock-seeded generator leaves far less room for subversion: anyone can now rerun the program and reproduce the exact byte strings in the standard. Anthropic's own verdict is blunt: "There is no action to be taken or things to do differently. Most researchers trusted the curves already."

There is a second story here, about AI doing research. A model solved in half an hour a puzzle that had defeated years of human investigation and a public bounty — not by guessing, but by forming a hypothesis about 1990s tooling, writing a scanner, spotting a statistical fingerprint, and applying a textbook lattice algorithm. That is the "agents do research" thesis in its most concrete form yet, and it lands in the same week as fresh quantum-error-correction results that change what cryptographers must plan for next.

Should You Care?

✅ Yes — as a reader, not as a user with homework. Nothing you use needs to change, and no update is required. But if you have ever wondered whether the internet's cryptography rests on trusted maths or on unexplained numbers, this is the closest thing to a satisfying answer: a 1997 clock, a standard library function, and a record nobody kept. Read it as the closing chapter of a 25-year argument — and as a preview of AI research agents that can now close chapters humans could not.

FAQs

What are the NIST elliptic curve seeds?
They are 20-byte values published with the NIST elliptic curves in 2000. Each seed's hash defines part of its curve. The NSA supplied them without explaining how they were generated, which left a 25-year question about whether they could hide a weakness.

Did Claude break ECDSA or find a backdoor?
No. Anthropic is explicit: this is not a cryptographic break, a new attack, or a weakness in the curves. The seeds turn out to come from an ordinary, weak-by-modern-standards random generator seeded by the computer's clock — which makes a deliberately planted backdoor much less plausible, not more.

What is lrand48, and why did a clock seed give it away?
lrand48 is a random-number function from older C libraries that returns only the top 31 bits of a 48-bit internal state. That leaves a visible fingerprint: the top bits of the seed words are all zero. Once Claude spotted it, the generator's state could be recovered with lattice maths and rewound to the Unix timestamp that started the run.

Are the NIST curves safe to keep using?
Yes. Anthropic says researchers can be confident the parameters are secure, and no action is needed. The one caveat cryptographers still watch is separate: future quantum computers, not these seeds, are the long-term threat to elliptic-curve cryptography.

Takeaway: A 25-year cryptography mystery ended not with a secret phrase but with a 1997 timestamp. The curves were never broken — they were just never explained, until an AI agent asked how 1990s software actually worked.

Follow World Tech on TechByCountry for tomorrow's update.

📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.

Sources

• Claude reveals ECDSA curve origins — Anthropic Research, 16 Oct 2026 (updated 23 Oct 2026) (primary source)
• Claude cracks a 25-year NSA curve mystery — CoinDesk, 17 Oct 2026

Related reading on TechByCountry: Correlated Decoding Flaw Explained — the Leiden & Riverlane quantum error-correction finding; C-DAC Bank of India Quantum Banking MoU Explained — why India is preparing for post-quantum cryptography now; Iceberg Quantum Pinnacle 1.2 Crevasse Decoder RSA-2048 Explained — the other side of the quantum-cryptography race.