Anthropic’s Claude AI Solves 25-Year-Old NSA Cryptography Mystery in Under 30 Minutes
Anthropic’s Claude AI Solves 25-Year-Old NSA Cryptography Mystery in Under 30 Minutes
Anthropic says an internal Claude research model identified how the NSA generated seeds for five prominent NIST elliptic curves in under 30 minutes, resolving a cryptographic provenance mystery.
According to the supplied October 16 report, the answer was not a secret passphrase: it was a standard C pseudorandom number generator initialized with Unix timestamps.
The discovery concerns public curve parameters, not private keys or signature secrets. Anthropic describes it as a historical reconstruction rather than a cryptographic break, reporting no new attack or reason to change deployments.
Anthropic’s Claude AI Solves 25-Year-Old NSA Cryptography Mystery
NIST incorporated ECDSA and recommended elliptic curves into its FIPS 186-2 Digital Signature Standard in 2000. Its curve-generation procedures used published seeds and SHA-1 to derive curve parameters, allowing verification of the derivation without explaining the seeds’ origin.
That missing provenance fueled speculation about whether the NSA could have influenced curve selection.
A 2023 bounty organized by cryptographer Filippo Valsorda targeted the five prime-curve seeds, following accounts suggesting they were hashes of humorous English phrases associated with NSA mathematician Jerry Solinas.
Anthropic says Claude instead traced P-192, P-224, P-256, P-384, and P-521 to lrand48, a legacy linear congruential generator with a 48-bit internal state.
Rather than guessing phrases, Claude investigated software patterns typical of 1990s C libraries. It scanned published seeds for relationships between adjacent output fragments and tested 34 generator-and-output-slice combinations.
Four binary-curve seeds displayed a revealing pattern: their five 32-bit words consistently had zero top bits. That matched lrand48’s 31-bit output. Claude recovered candidate internal states by enumerating the 17 hidden state bits and checking subsequent outputs.
The prime-curve seeds exposed less information per generator call. Claude applied the Lenstra–Lenstra–Lovász lattice basis reduction algorithm to recover states from truncated outputs. Five NIST seeds and five ANSI X9.62 example seeds matched a shared construction: collecting bytes from lrand48() >> 23.
Running the generator backward revealed initialization states corresponding to timestamps between May 1997 and April 1998. For P-256, the published seed appeared as candidate 1,842 in a sequence initialized on August 16, 1997.
Claude also reconstructed base-point generation for P-192 and five ANSI example curves using the FreeLIP arithmetic package’s generator. However, several other base points remain unexplained, as does the B-163 seed.
Researchers also identified skipped candidates that apparently produced suitable curves, leaving the original selection criteria unresolved.
Anthropic argues the reproducible timestamp-based construction reduces concerns about deliberate manipulation, although it does not establish every historical decision.
The company says the $36,864 charitable bounty will go to the Internet Security Research Group. The practical outcome is greater transparency about public parameters, not recovery of cryptographic secrets or a demonstrated weakness in ECDSA itself.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
