A question left open since 2000
Anthropic said on 16 October that an internal Claude research model recovered the method used to generate the seeds behind five NIST elliptic curves — P-192, P-224, P-256, P-384 and P-521 — in under half an hour. The seeds are not hash outputs, as the best-known account held. According to Anthropic’s write-up, they are outputs of lrand48, the random number generator in the standard C library, seeded with a Unix timestamp.
The seeds matter because the curves built from them underpin ECDSA, the signature scheme used in TLS, code signing and cryptocurrency wallets. NIST adopted ECDSA in 2000 under FIPS 186-2, publishing for each curve a seed whose hash fixes one of the curve’s coefficients. The NSA supplied those seeds without explaining where they came from, which left room for the suspicion that someone had searched until they found a curve with a weakness only they knew about.
What the model did
Anthropic says the model began by testing whether the seeds looked like the output of generators available in the 1990s. Some of them had all-zero top bits, a signature of lrand48. It then recovered the generator’s internal state for the prime-curve seeds using lattice reduction.
The recovered initial states are clock readings. P-192 and two related curves trace to 1997-05-18 14:45:34; P-521 to 1997-08-08 01:12:04; P-256 to 1997-08-16 01:52:34, the 1,842nd candidate produced in that run; P-384 to 1997-08-30 14:50:08; and P-224 to 1998-04-03 12:52:07. The four NIST binary curves land on 17 April 1998, but only once the timestamp is halved, which suggests the software that produced them divided the clock value.
The model also found the source of six base points — for P-192 and five related curves — in the random number generator inside FreeLIP, Arjen Lenstra’s long-integer arithmetic package, with seeds 20000, 20420, 20507, 20509, 20512 and 20517.
What the old explanation said
The leading theory came from Jerry Solinas, the NSA mathematician who worked on the curves. In 2015 he said the seeds were hashes of a humorous passphrase, something along the lines of “Give Bob and Jerry a raise”, and that a colleague had written the code. No archives from the period could be found, and Solinas died in 2023. Anthropic says its own staff pursued that lead without success before putting the problem to a model.
What is still open
Anthropic’s post lists what the model did not resolve: the base points for P-224, P-256, P-384, P-521 and the NIST binary curves; the fifth binary seed, B-163; and why some viable candidate seeds were passed over, among them candidate 876 for P-256.
The company is explicit that this is “not a cryptographic break, new attack, or weakness in the ECDSA curves”, and says readers need do nothing. It argues the result makes a deliberate backdoor much less plausible, because the seeds were produced in a very simple way and few candidates were skipped — while adding that it cannot rule out that particular timestamps were chosen for some property of the resulting curve.
What to watch
Anthropic published Python code that reproduces the seeds and the six base points, released under CC0, so the claim is checkable by anyone who wants to run it. Its post describes no third-party verification of its own. The $36,864 bounty for the answer, organised by Filippo Valsorda, is going to the Internet Security Research Group. The remaining base points, and the B-163 seed, are the next things to fall or not.
