# Anthropic Says Claude Traced NIST's Five Elliptic-Curve Seeds to a 1990s Unix Random-Number Generator

An internal Claude research model took under 30 minutes to link the seeds behind P-256 and four sibling curves to lrand48 runs seeded with Unix timestamps from 1997 and 1998, a claim anyone can check by rerunning the generator.

- Published: 2026-10-18T06:13:15.484Z
- Canonical: https://polylog.news/ai/2026-10-18/anthropic-says-claude-traced-nist-s-five-elliptic-curve-seed
- Publisher: Polylog (AI desk)
- Section: tech
- Sources: [Polylog editors](https://polylog.news), [Unite.AI](https://www.unite.ai/anthropic-says-claude-traced-nist-ecdsa-curve-seeds-to-a-1990s-rng/), [Cybersecurity News](https://cybersecuritynews.com/claude-ai-cryptography-mystery/), [CoinDesk](https://www.coindesk.com/tech/2026/10/17/wow-it-s-a-real-discovery-claude-cracks-a-25-year-nsa-number-mystery), [Schneier on Security](https://www.schneier.com/blog/archives/2023/10/bounty-to-recover-nists-elliptic-curve-seeds.html)

Anthropic [says an internal Claude research model](https://t.me/aipost/8514) has traced the origin of the five seeds that the National Security Agency (NSA) supplied for the NIST elliptic curves, a question cryptographers had left unresolved for about 25 years. The National Institute of Standards and Technology (NIST) adopted the Elliptic Curve Digital Signature Algorithm (ECDSA) in Federal Information Processing Standard (FIPS) 186-2 in 2000. That standard [published the seeds](https://cybersecuritynews.com/claude-ai-cryptography-mystery/) fed into a SHA-1-based procedure to derive curve parameters, but it never said where the seeds came from.

According to the report Anthropic published on October 16, the seeds for P-192, P-224, P-256, P-384 and P-521 [came from lrand48](https://www.unite.ai/anthropic-says-claude-traced-nist-ecdsa-curve-seeds-to-a-1990s-rng/), the 48-bit linear congruential generator in the C standard library, initialized with Unix timestamps. Running the generator backward recovered initialization times between May 1997 and April 1998. For P-256, the published seed was the 1,842nd candidate from a run started on August 16, 1997, at 01:52:34 UTC. Anthropic says the model reached the answer in under 30 minutes.

The claim is unusually easy to check. lrand48 is deterministic, so anyone can seed it with the stated timestamp, step forward 1,842 outputs and compare the result with the seed in the standard. That sets it apart from a benchmark score, which outsiders cannot independently verify in the same way. [CoinDesk's headline](https://www.coindesk.com/tech/2026/10/17/wow-it-s-a-real-discovery-claude-cracks-a-25-year-nsa-number-mystery) quotes a reaction calling it "a real discovery." The question had stood as an open challenge: in 2023 a public [bounty was offered for recovering the seeds](https://www.schneier.com/blog/archives/2023/10/bounty-to-recover-nists-elliptic-curve-seeds.html) after Jerry Solinas, the NSA mathematician believed to have generated them, died. Popular guesses held that the seeds were SHA-1 hashes of phrases. A system generator seeded with timestamps was not among the leading hypotheses in the public discussion.

The finding does not break ECDSA and does not expose keys. Reports on the work [state plainly](https://cybersecuritynews.com/claude-ai-cryptography-mystery/) that it identifies no weakness in the curves. Bitcoin and Ethereum sign with secp256k1, which was not derived from these seeds. The practical effect is on auditability. A seed process built on a timestamp-seeded generator can be checked against a bounded search, so cryptographers can now ask whether the number of discarded candidates matches an honest generation procedure.

## What this means

The capability on display is fast hypothesis search over a historical artifact: listing plausible 1990s generation methods, testing them against the published constants, and reversing a weak generator. The same skill applies to auditing legacy cryptographic constants, firmware and standards documents, and it can also be pointed at weakly seeded secrets in deployed systems. That second use connects this result to the agentic-cyber concern and to Anthropic's own cyber access program. Anthropic benefits from a verifiable win after a year of benchmark disputes, and this one is credible because outsiders can confirm it with a few lines of code. There is precedent for that kind of check: when researchers reverse-engineered the structure of Dual_EC_DRBG after the 2013 Snowden disclosures, the standard was withdrawn within months, though in that case the evidence pointed to a deliberate backdoor. Here the evidence points to an ordinary process. The likelier outcome is that independent cryptographers confirm the reconstruction within weeks, and that suspicion of P-256 declines in standards bodies. That depends on the candidate-skip counts matching the published FIPS procedure. The read is wrong if the skip counts imply a selection search much larger than an honest procedure would produce, which would reopen the question of whether the NSA chose among curves.

## What to watch

- Whether independent cryptographers publish a reproduction of all five seeds from the stated timestamps, because full reproduction turns an Anthropic claim into an established fact.
- Whether the number of rejected candidates per curve fits the documented FIPS 186-2 procedure, because an unexplained excess would revive concerns that the NSA picked among curves.
- Whether labs start offering models for audits of legacy standards and constants, because that would show verifiable scientific results being sold as a product.