Anthropic Says Claude Solved a 25-Year Mystery Over the NIST Elliptic Curve Seeds in Under 30 Minutes
The numbers behind the curves that secure much of the internet were never explained. Anthropic's red team says an AI traced them to a 1990s random generator, and that no backdoor is implied.
Outspoken Digest Technology Desk
Sunday, October 18, 2026/2 min read
Every time a browser shakes hands with a website, there is a good chance it leans on an elliptic curve whose defining numbers came from the US government in the late 1990s, with no explanation of where they came from. For a quarter of a century that silence fed suspicion that the National Security Agency had slipped in a weakness.
On 16 October Anthropic's Frontier Red Team published what it says is the answer, and says an AI model found it in under half an hour. The claim comes from Anthropic itself, in its own research post, and has not yet been checked by independent cryptographers.
What did Claude find about the NIST curve seeds?
NIST adopted ECDSA in 2000, and the NSA supplied the "seed" values for its curves without saying how they were produced. A 2015 theory held that they were hashes of a humorous passphrase. Anthropic says employees chased that lead without success.
This month an Anthropic employee asked an internal research model how the seeds were made, without mentioning the passphrase. Anthropic says Claude found that the seeds for P-192, P-224, P-256, P-384 and P-521 were not hash outputs but outputs of the C library function lrand48, seeded with a Unix timestamp. Each was a 20-byte candidate drawn from the generator, and P-256's published seed was candidate number 1,842. The ten prime-curve seeds map to timestamps between May 1997 and April 1998, the post says.
Crypto Briefing, which relays the findings and stresses that they are secondhand, gives the P-256 start time as 16 August 1997.
How did it work it out?
Claude guessed that the software used a weak 1990s random number generator and scanned the seeds for its fingerprint. It noticed that the top bits of some seeds were all zero, a pattern consistent with lrand48, which returns only the top 31 bits of a 48-bit state. For four seeds it recovered the hidden bits by brute force. For the prime-curve seeds it used a lattice-reduction algorithm called LLL to rebuild the generator state.
Does this mean the curves are safe?
Anthropic says this is not a cryptographic break and exposes no weakness in the curves. Its argument is that a backdoor looks less plausible if the parameters came from a simple, reproducible process tied to a single clock reading. That is an argument about probability, not proof.
Gaps remain. The post says some valid candidate seeds were skipped for reasons unknown, the seed for the binary curve B-163 is still unexplained, and no explanation was found for the base points of P-224, P-256, P-384 and P-521. The $36,864 bounty offered for the original puzzle, organised by cryptographer Filippo Valsorda, will go to the Internet Security Research Group.
Expect cryptographers to test the timestamps themselves. If they hold, a 25-year argument may finally end, with a verdict of carelessness, not conspiracy.
Published in The Outspoken Digest
Editorial desk
Outspoken Digest Technology DeskSoftware, hardware, artificial intelligence and what they change for everyone else.
Newsletter
The Digest, in your inbox
One edition, sent when it is ready. No noise, and your address is never passed on.
Read Next
More Technology →
Webb Caught a Probable Supernova From the Early Universe Only Days After It Exploded
Oct 18, 2026/2 min read
Webb Maps an Exoplanet's Atmosphere as Egg-Shaped, With a Puffed-Up Evening Side Hotter Than Its Morning Edge
Oct 18, 2026/2 min read
A Hole in a 75,000-Year-Old Shoulder Blade Points to a Wooden Spear, and Perhaps to Neanderthal Care
Oct 18, 2026/2 min read
Anthropic's Own Staff Data: Junior Technical Hires Fell From 27 to 9 Percent as Its AI Agents Outworked Humans
Oct 18, 2026/2 min read