Claude cracks 25-year cryptography mystery in under 30 minutes: NIST curve seeds traced to timestamps and a random number generator
Artificial intelligence company Anthropic announced on October 16 a striking research result: its internal research model Claude traced the generation source of seeds for five NIST-standard elliptic curves in less than half an hour, solving a mystery that had puzzled the cryptography community for twenty-five years. The results show these seeds did not come from any carefully designed hash algorithm, but were produced by lrand48—an aging pseudorandom number generator in the C language library long deemed insufficiently secure—with its initial state determined by Unix timestamps.
The discovery does not break the ECDSA elliptic curve digital signature algorithm, nor does it introduce any new attack vector. On the contrary, Anthropic believes it further reduces the possibility that the curves were deliberately backdoored, because the entire generation process can now be publicly reproduced, leaving far less room for covert manipulation than previously imagined.
Origins of a 25-year-old mystery
Elliptic curve cryptography is one of the cornerstones of modern public-key encryption. In 2000, the U.S. National Institute of Standards and Technology (NIST) listed multiple standard curves at different security levels in the FIPS 186-2 standard, including P-192, P-224, P-256, P-384, and P-521. These curves are widely used in digital signatures, key exchange, and other applications, forming a critical part of internet security infrastructure.
Each standard curve carries a set of parameters known as "seeds." According to the generation procedure in the standard, the hash of a seed participates in determining the curve coefficients. The problem: these seeds were provided by the U.S. National Security Agency (NSA), and public documents neither explained their origin nor the selection process. This fueled long-standing external concerns that designers might have screened large numbers of candidate curves and selected parameters with hidden properties, potentially leaving a backdoor for future attacks.
In 2015, NSA cryptographer Jerry Solinas, who had been involved in the work, recalled that the seeds might have come from a joke password, such as "give Bob and Jerry a raise," but he could no longer remember the specifics, and relevant archived files were never found. Solinas passed away in 2023, and this lead was never verified.
Claude's research approach
Several Anthropic employees had previously searched for the seed origins along the "humorous password" direction, but none succeeded—and it later turned out that lead was itself wrong.
In October of this year, an employee posed a question to the internal research model Claude, hoping it could figure out how those seeds were generated. This time, he did not reveal the earlier password clue to the model, nor did he provide any key hints.
Claude took a different angle, speculating about how the software used to generate the curves back then might have worked. It guessed that the software used pseudorandom number generators built into 1990s C language libraries—early generators with weak security whose outputs typically carry identifiable characteristics. Once output patterns are identified, it becomes possible to determine which generator the software used and further recover its initial state.
The model wrote a scanning program that slid across each public seed bit by bit, checking whether adjacent data blocks could have come from a 1990s random number generator. The scan covered 34 combinations of random number generators and output truncation methods.
Claude then discovered a pattern in the high bits of some seeds: these positions were all zero. If each seed is written as five 32-bit words, 4 of the 10 seeds fit this pattern—across the 20 total 32-bit words in these 4 seeds, the highest bit was zero in every case. The probability of this happening randomly is about 1 in 5,800. This is a classic signature of the linear congruential generator lrand48: it returns only the high 31 bits of its 48-bit internal state.
To recover the generator state, Claude took the first 32-bit word, exhaustively tested all 2¹⁷ possibilities for the 17 hidden bits, and then checked whether the next four words matched consecutively. This method worked for all four of those seeds.
The prime-curve seeds also came from lrand48, but they retained fewer output bits. Claude needed to recover the pseudorandom number generator's internal state from limited bits—a classic lattice problem solvable with the LLL lattice basis reduction algorithm. The model initially did not know which bits of the internal state were preserved in the seeds, so it ran the solver across all possible bit windows.
Ultimately, all five NIST prime-curve seeds and the five seeds in the ANSI X9.62 standard exhibited the same pattern. Every recovered 48-bit internal state could regenerate all 160 bits of its corresponding seed—an exact match that could not be attributed to chance.
Timestamps reveal the generation era
Linear congruential generators can run both forward and backward. Claude worked backward from each seed's state until it found a state matching the srand48 initialization format—which requires the low 16 bits to equal 0x330E.
The key insight: all ten prime-curve seeds' srand48 initial values can be interpreted as Unix timestamps, with dates concentrated between May 1997 and April 1998. This indicates the original program used Unix timestamps to seed the pseudorandom number generator.
The four binary-curve initial values, when read directly, correspond to February 1984; but if these timestamp values are multiplied by 2, they point to April 17, 1998—about two weeks from the generation time of the P-224 curve. The original program may therefore have divided the system clock by 2.
Claude also traced the origin of base points for six curves, including P-192. The results show these base points were produced by the random number generator in FreeLIP, a big-integer arithmetic software package. Anthropic noted that no NIST curve base point generation process had previously received such an explanation.
Implications and remaining questions
Timestamps themselves carry no cryptographic security, and lrand48 has long been considered a weak random number generator. However, their role here was generating public curve parameters, not protecting private keys. More importantly, the generation process can now be publicly reproduced. Compared with passwords of unknown origin or manually specified parameters, the explanation of an ordinary random number generator plus timestamps leaves even less room for covert curve manipulation.
Anthropic emphasized that this finding constitutes no security vulnerability, and users need not take any countermeasures or change their operations.
But some questions remain unresolved. In the P-256 generation process, the 876th candidate value also appeared to meet the requirements, yet the 1,842nd was ultimately adopted; other runs similarly skipped small numbers of usable curves, and the specific screening criteria remain unclear. The seed for the B-163 curve has still not been traced, and the base point generation methods for P-224, P-256, P-384, and P-521 also remain unexplained.
Anthropic believes the small number of skipped candidates is insufficient to support the hypothesis of "deliberately selecting weak curves." This discovery increases external confidence in the relevant parameters, but it cannot yet be considered a complete reconstruction of the entire design process.
The $36,864 prize previously offered for finding the seed origins will be donated to the Internet Security Research Group. Anthropic has also released the Python code used to reproduce the seeds under a CC0 public domain license.
This research also demonstrates another way frontier models can participate in real research. Claude completed hypothesis generation, code writing, pattern recognition, mathematical algorithm invocation, and result verification in a single task. Because the generator states can be recomputed, the 160-bit seeds can be precisely reproduced, making the conclusion highly verifiable. It still relies on humans to pose questions, provide public data, and confirm results through reproducible computation—but when problem boundaries are clear, data is public, and results can be rigorously verified, frontier models are becoming a highly efficient research tool.