# Claude traces the NSA-supplied seeds behind NIST's P-256 curve to a timestamp-seeded generator run in 1997

Anthropic's team claimed cryptographer Filippo Valsorda's three-year-old bounty and donated it, which removes one long-cited reason to distrust the curves but does not address bitcoin's separate quantum exposure.

- Published: 2026-10-18T05:40:05.953Z
- Canonical: https://polylog.news/crypto/2026-10-18/claude-traces-the-nsa-supplied-seeds-behind-nist-s-p-256-cur
- Publisher: Polylog (Crypto desk)
- Section: tech
- Sources: [CoinDesk](https://www.coindesk.com/tech/2026/10/17/wow-it-s-a-real-discovery-claude-cracks-a-25-year-nsa-number-mystery), [Polylog editors](https://polylog.news), [Crypto Briefing](https://cryptobriefing.com/claude-traces-nist-p256-seed-origins/), [Filippo Valsorda](https://words.filippo.io/seeds-bounty/), [Mad Robot](https://madrobot.blog/2026/10/16/claude-nist-ecdsa-curve-seeds-nsa-mystery-solved-lrand48/)

The elliptic curves standardized by the National Institute of Standards and Technology (NIST) were generated in the late 1990s by hashing seed values that the National Security Agency (NSA) supplied. For 25 years nobody could say where those seeds came from. Jerry Solinas, the NSA mathematician who chose them, died in 2023 and left no explanation. In 2023 cryptographer Filippo Valsorda [offered a bounty](https://words.filippo.io/seeds-bounty/) of $12,288 to anyone who could work out their origin, and he promised to triple it to $36,864 if the winner gave it to charity.

On October 16, Anthropic's Frontier Red Team said its model Claude had traced the seeds of P-192, P-224, P-256, P-384 and P-521 to lrand48, a simple and predictable random-number function from the Unix standard library, seeded with a Unix timestamp, [Crypto Briefing reported](https://cryptobriefing.com/claude-traces-nist-p256-seed-origins/). According to [Mad Robot's account](https://madrobot.blog/2026/10/16/claude-nist-ecdsa-curve-seeds-nsa-mystery-solved-lrand48/), the P-256 seed came from a run that began at 01:52:34 UTC on 16 August 1997 and was the 1,842nd 20-byte candidate that run produced. Every prime-curve seed traced back to a timestamp between May 1997 and April 1998. An employee asked an internal research model how the seeds were generated without pointing it toward the answer, and the model found it in under half an hour. The team claimed Valsorda's bounty on October 15 and donated it to the Internet Security Research Group (ISRG), the nonprofit that runs Let's Encrypt.

[CoinDesk quoted](https://www.coindesk.com/tech/2026/10/17/wow-it-s-a-real-discovery-claude-cracks-a-25-year-nsa-number-mystery) a reaction that "it's a real discovery," and it noted that bitcoin's secp256k1 curve was never on the NIST list. Cointelegraph's Telegram channel [described the result](https://t.me/cointelegraph/72717) as solving a "25-year-old crypto mystery." The finding matters most outside bitcoin. P-256 secures most web traffic and hardware security keys, and the passkey-based smart-account wallets now spreading across Ethereum and its rollups use it as well.

The long-standing worry was that the NSA could have tried many seeds until it reached a curve with a weakness only it knew. A seed produced by a common generator from a clock reading gives an ordinary, reproducible explanation. It does not mathematically prove that nobody threw away unwanted outputs before keeping the 1,842nd. It does replace an input nobody could explain with one that anyone can now recompute.

## What this means

The result mainly affects confidence in the curves' design rather than the security of any specific key. Designers who avoided NIST curves because the seeds were unexplained, including some wallet and protocol teams that chose other curves instead, now have a weaker reason for that choice. Passkey wallets and secure enclaves, which rely on P-256, gain a documented, ordinary explanation for their core curve at a time when they compete with seed-phrase wallets for users. The faster point is the speed of the discovery. A frontier model solved in minutes an origin question that human cryptographers had left open for decades, around the same time Aztec reported that AI-assisted audits found critical bugs its human auditors had missed. The consensus treats AI in cryptography mainly as a threat. The desk's read is that over the coming months AI-assisted analysis will keep producing disclosures in both directions, some removing old suspicions and others finding live defects, and that protocols will increasingly be judged on whether they have already run this kind of review. This read would be wrong if independent cryptographers fail to reproduce the derivation, or find a selection pattern showing that unwanted outputs were discarded before the chosen seed, which would reopen the backdoor question.

## What to watch

- Independent reproduction of the derivation by academic cryptographers, which would settle whether the result holds.
- Whether the same method is pointed at other unexplained constants in standards that wallets and blockchains use, which would test how general the technique is.