Anthropic Traces NIST Curve Seeds to a 1990s Random Generator

Anthropic researchers have traced the origins of cryptographic parameters published by the National Institute of Standards and Technology (NIST) to a 1990s C library random-number generator. In a research publication dated October 16, 2026, Anthropic's Frontier Red Team said an internal Claude model identified the method behind five standardized elliptic curves in less than half an hour, addressing a historical question about parameters originally supplied by the National Security Agency (NSA).

The discovery links the seeds for the NIST P-192, P-224, P-256, P-384 and P-521 curves to lrand48, a pseudorandom number generator initialized using Unix timestamps. According to Anthropic, the timestamps for the five prime-curve seeds fell between May 1997 and April 1998.

The seeds appeared in NIST's 2000 adoption of the Digital Signature Standard, designated FIPS 186-2. The NSA had provided the values without publishing an explanation of their origins, prompting years of speculation among cryptographers.

A long-standing theory attributed the seeds to Jerry Solinas, a longtime NSA employee, who reportedly generated them by hashing a humorous passphrase. In a 2015 statement reproduced in Anthropic's publication, Solinas recalled: "The message was along the lines of 'Give Bob and Jerry a raise' or 'Bob and Jerry rule' or something like that."

Solinas said Bob Reiter wrote the code, but historical archives could not be located. Solinas died in 2023, and the derivation remained unresolved. Anthropic said its employees had also pursued the passphrase theory before an employee asked Claude to investigate the seeds without directing the model toward that explanation.

Claude instead examined whether a random-number generator commonly available in 1990s C libraries could explain the published values. Anthropic said the model scanned the seeds for patterns consistent with consecutive outputs from older generators, testing 34 combinations of generators and output slices.

The model identified a distinctive pattern consistent with lrand48, which maintains a 48-bit internal state but returns only 31 bits per output. Claude reconstructed the generator state for several seeds by testing possible hidden bits, then used lattice-based calculations to recover the states associated with the prime-curve seeds.

According to Anthropic, all five NIST prime-curve seeds and five additional seeds from the ANSI X9.62 standard matched the same output pattern, lrand48() >> 23. Each recovered 48-bit state reproduced all 160 bits of its corresponding seed, providing a computational check of the proposed derivation.

Anthropic also reported that reversing the generator's sequence revealed initialization states corresponding to Unix timestamps. The ten prime-curve seeds traced to dates between May 1997 and April 1998, while four binary-curve initializations pointed to February 1984. Doubling those earlier timestamps placed them on April 17, 1998, two weeks after the P-224 run, leading researchers to suggest that the original program may have halved the clock value.

The investigation also identified a possible origin for the base points of six curves generated in May 1997: P-192 and the ANSI X9.62 curves prime192v2, prime192v3, and prime239v1 through v3. Anthropic traced those points to the random-number generator in FreeLIP, an arithmetic package by Arjen Lenstra whose code also appeared in early versions of Victor Shoup's NTL library.

Under the reconstructed procedure, the generator used small integer seeds, discarded seven outputs, and generated candidate x-coordinates from 26-bit outputs reduced modulo the prime field's modulus. The process continued until a candidate lay on the curve. Anthropic identified generator seeds of 20000 for P-192; 20420, 20507 and 20509 for prime239v1 through v3; and 20512 and 20517 for prime192v2 and v3.

Anthropic said it was unaware of any previous explanation for a NIST base point. The base points for P-224, P-256, P-384 and P-521 did not match the identified FreeLIP procedure. The company also stated that the findings do not constitute a cryptographic break, introduce a new attack, or demonstrate a weakness in the ECDSA curves.

Follow suaragarut.id Add to preferred sources on Google

• Artificial Intelligence
• Cybersecurity
• Cryptography