Claude Traces NIST P-256 Seed to a 1997 Timestamp

Where the NIST Curve Seeds Came From

At 01:52:34 UTC on August 16, 1997, a computer clock started a random-number generator. Its 1,842nd output, which was 20 bytes long, became the seed for NIST's P-256 elliptic curve. This curve is one of the most widely used building blocks of internet security. These are the findings of a research post from Anthropic's Frontier Red Team. The team says Claude solved the long-running mystery of where the NIST curve seeds came from in less than half an hour.

Key Takeaways

• Anthropic says Claude traced the seeds for five NIST curves—P-192, P-224, P-256, P-384 and P-521—to a random-number generator called lrand48 in the C library. The generator was started using Unix timestamps from 1997 and 1998.
• The company stresses that this discovery does not break the cryptography. It also makes it much less likely that the curves were deliberately designed to be weak.
• The seed for the B-163 curve and the starting points for P-224, P-256, P-384 and P-521 are still unexplained. The $36,864 reward for solving the mystery will go to the Internet Security Research Group.

A Mystery Left by the NSA

In 2000, NIST adopted the Elliptic Curve Digital Signature Algorithm (ECDSA) as part of the FIPS 186-2 Digital Signature Standard. Each standard curve came with a value called a seed. A hash of this value determines one of the curve's mathematical coefficients. The NSA provided the seeds but did not explain how they had been created.

This missing explanation led to years of suspicion that the curves might contain a hidden weakness, known as a backdoor. The most popular theory was that longtime NSA employee Jerry Solinas had hashed a joke phrase, perhaps something like “Give Bob and Jerry a raise.” In 2015, Solinas said the records were gone. “If they exist, they are no doubt sitting on a hard drive near the Ark of the Covenant,” he said. He died in 2023.

How Claude Found the Pattern

Several Anthropic employees had tried to solve the mystery using the joke-phrase theory, but they had not succeeded. In October 2026, one employee asked an internal research model to figure out how the seeds had been created. The employee did not direct the model toward that theory.

Claude guessed that the original software had used a weak random-number generator from a C library of the 1990s. It wrote a program to scan parts of each seed and check whether they matched consecutive outputs from these generators. It tested 34 combinations of generators and output sections.

One pattern revealed the answer. In four of the ten seeds being studied, every 32-bit word began with a zero bit. The chance of this happening was 1 in 5,810. This pattern is a sign of lrand48, which returns only the top 31 bits of its 48-bit internal state. Claude found the hidden bits in those seeds by testing every possible value. For the seeds of curves based on prime numbers, which kept fewer bits from each output, Claude treated the problem as a mathematical lattice problem and solved it using the Lenstra-Lenstra-Lovász algorithm.

Five seeds for NIST's prime-based curves and five more from the related ANSI X9.62 standard followed the same method. Running each generator backward led to starting values that matched Unix timestamps between May 1997 and April 1998.

Starting Points and Unanswered Questions

Claude also explained the origins of six starting points, which are fixed points on a curve used to build every ECDSA public key. The starting points for P-192 and five example curves from ANSI X9.62 came from the random-number generator in FreeLIP, a software package for large-number arithmetic written by Arjen Lenstra. Anthropic says that, as far as it knows, nobody had previously explained the origin of any NIST starting point.

Some questions remain unanswered. The seed for the binary curve B-163 does not match any method Claude tested. Nobody yet knows how the starting points for P-224, P-256, P-384, P-521 and the binary curves were chosen. The tests also skipped some possible candidates. For P-256, candidate 876 would also have produced a suitable curve, but the standard uses candidate 1,842.

Anthropic argues that these skipped candidates are too rare to suggest that anyone deliberately chose weak curves. “There is no action to be taken or things to do differently,” the research post says. The company has published code that can recreate the seeds, and the $36,864 reward for finding them will go to the Internet Security Research Group.

The discovery brings a long period of suspicion closer to an end. Cryptographers Neal Koblitz and Alfred Menezes described the controversy in their 2015 paper, “A Riddle Wrapped in an Enigma”, written when many people were questioning the NSA's influence over cryptographic standards. Now that the seeds have been linked to a common random-number generator and a computer clock, anyone can check the results. The discovery also shows how quickly AI systems are learning real cryptanalysis skills. This trend has led scientists to call for an international body to control AI systems capable of carrying out cyberattacks.

The curves also face another challenge in the future. Large quantum computers could one day solve the mathematical problem that protects ECDSA. This is one reason NIST completed its first post-quantum encryption standards in 2024. Anthropic's related research on quantum circuit design shows that the estimated computing resources needed for such attacks keep getting smaller. The origins of P-256 can now be checked and understood, but its replacement is already available.

Written by Alius Noreika