Anthropic Says Claude Traced NIST's Five Elliptic-Curve Seeds to a 1990s Unix Random-Number Generator

Anthropic says an internal Claude research model has traced the origin of the five seeds that the National Security Agency (NSA) supplied for the NIST elliptic curves, a question cryptographers had left unresolved for about 25 years. The National Institute of Standards and Technology (NIST) adopted the Elliptic Curve Digital Signature Algorithm (ECDSA) in Federal Information Processing Standard (FIPS) 186-2 in 2000. That standard published the seeds fed into a SHA-1-based procedure to derive curve parameters, but it never said where the seeds came from.

According to the report Anthropic published on October 16, the seeds for P-192, P-224, P-256, P-384 and P-521 came from lrand48, the 48-bit linear congruential generator in the C standard library, initialized with Unix timestamps. Running the generator backward recovered initialization times between May 1997 and April 1998. For P-256, the published seed was the 1,842nd candidate from a run started on August 16, 1997, at 01:52:34 UTC. Anthropic says the model reached the answer in under 30 minutes.

The claim is unusually easy to check. lrand48 is deterministic, so anyone can seed it with the stated timestamp, step forward 1,842 outputs and compare the result with the seed in the standard. That sets it apart from a benchmark score, which outsiders cannot independently verify in the same way. CoinDesk's headline quotes a reaction calling it "a real discovery." The question had stood as an open challenge: in 2023 a public bounty was offered for recovering the seeds after Jerry Solinas, the NSA mathematician believed to have generated them, died. Popular guesses held that the seeds were SHA-1 hashes of phrases. A system generator seeded with timestamps was not among the leading hypotheses in the public discussion.

The finding does not break ECDSA and does not expose keys. Reports on the work state plainly that it identifies no weakness in the curves. Bitcoin and Ethereum sign with secp256k1, which was not derived from these seeds. The practical effect is on auditability. A seed process built on a timestamp-seeded generator can be checked against a bounded search, so cryptographers can now ask whether the number of discarded candidates matches an honest generation procedure.