Claude Solves a 1997 Crypto Mystery: NIST’s Curve Seeds Were Just Timestamps

For almost three decades, nobody could explain where a handful of long numbers handed from the NSA to NIST came from. According to Anthropic, Claude cracked it in under half an hour.

AI Desk · Published October 17, 2026
First look: this story is based on Anthropic’s official post. Maitz ran the published code and got the P-256 seed back out of it, but did not check the rest of the findings.

What was the mystery behind ECDSA curve seeds?

ECDSA is a digital signature standard built on elliptic curves. NIST adopted it in 2000 in FIPS 186-2, along with a list of ready-made curves. Each curve came with a published “seed”: a 160-bit value that one of the curve’s parameters is derived from.

The NSA supplied those seeds and never said how it picked them. That left room for an old suspicion: maybe they were chosen on purpose to hide a backdoor. The best-known explanation was that Jerry Solinas at the NSA had hashed a joke phrase, something like “Give Bob and Jerry a raise.” Solinas died in 2023, nobody ever recovered the phrase, and the question was open enough that someone put a cash bounty on it.

What did Claude find?

Anthropic says several of its employees had already chased the joke-phrase lead and gotten nowhere. This month, another employee asked an internal research model to figure out how the seeds were made, without mentioning the rumor. In less than 30 minutes it had the answer for P-192, P-224, P-256, P-384 and P-521.

None of the seeds came from a hash. They were raw output from lrand48, a pseudorandom number generator that shipped with 1990s C libraries, started from a Unix timestamp. The program pulled 20 bytes at a time, and each batch was a candidate seed. The P-256 seed in the standard is candidate number 1,842.

How it got there is the fun part. Claude guessed the original software leaned on an old, weak generator whose output can be recognized. It wrote a scanner and tested 34 combinations of generators and output slices. Then it spotted something odd: in four of the ten seeds, the top bit of every one of the 20 words was zero. The odds of that happening by chance are about 1 in 5,810. That pattern is a fingerprint of lrand48.

From there it rebuilt the generator’s internal state, using the LLL lattice algorithm for some of the curves, and ran it backwards to the moment it was started. Every timestamp for those curves landed between May 1997 and April 1998.

So is the crypto broken?

No. Anthropic is blunt about it: this is not a break, not a new attack and not a flaw in the curves. If anything, the company says, it makes a backdoor less plausible. A plain generator seeded from the clock, which anyone can now reproduce, leaves very little room for anyone to steer the result.

There was a bonus, too. Claude also explained the base points of six curves from 1997, including P-192. Anthropic says they came from the random-number generator in FreeLIP, a library written by cryptographer Arjen Lenstra. As far as the company knows, no NIST base point had ever been explained before.