Claude traces the NSA-supplied seeds behind NIST's P-256 curve to a timestamp-seeded generator run in 1997

The elliptic curves standardized by the National Institute of Standards and Technology (NIST) were generated in the late 1990s by hashing seed values that the National Security Agency (NSA) supplied. For 25 years nobody could say where those seeds came from. Jerry Solinas, the NSA mathematician who chose them, died in 2023 and left no explanation. In 2023 cryptographer Filippo Valsorda offered a bounty of $12,288 to anyone who could work out their origin, and he promised to triple it to $36,864 if the winner gave it to charity.

On October 16, Anthropic's Frontier Red Team said its model Claude had traced the seeds of P-192, P-224, P-256, P-384 and P-521 to lrand48, a simple and predictable random-number function from the Unix standard library, seeded with a Unix timestamp, Crypto Briefing reported. According to Mad Robot's account, the P-256 seed came from a run that began at 01:52:34 UTC on 16 August 1997 and was the 1,842nd 20-byte candidate that run produced. Every prime-curve seed traced back to a timestamp between May 1997 and April 1998. An employee asked an internal research model how the seeds were generated without pointing it toward the answer, and the model found it in under half an hour. The team claimed Valsorda's bounty on October 15 and donated it to the Internet Security Research Group (ISRG), the nonprofit that runs Let's Encrypt.

CoinDesk quoted a reaction that "it's a real discovery," and it noted that bitcoin's secp256k1 curve was never on the NIST list. Cointelegraph's Telegram channel described the result as solving a "25-year-old crypto mystery." The finding matters most outside bitcoin. P-256 secures most web traffic and hardware security keys, and the passkey-based smart-account wallets now spreading across Ethereum and its rollups use it as well.

The long-standing worry was that the NSA could have tried many seeds until it reached a curve with a weakness only it knew. A seed produced by a common generator from a clock reading gives an ordinary, reproducible explanation. It does not mathematically prove that nobody threw away unwanted outputs before keeping the 1,842nd. It does replace an input nobody could explain with one that anyone can now recompute.