Claude Found the Source of NIST’s Undisclosed ECDSA Curve Seeds

Anthropic’s Frontier Red Team announced in a research post published on October 16, 2026 that Claude, the company’s internal research model, had found the source of the seed values used in NIST’s ECDSA curves. The seeds were generated with lrand48, a pseudorandom number generator common in C libraries in the 1990s, and a Unix timestamp. This question had remained open ever since NSA published the values without any explanation.

The Seeds NSA Never Explained

ECDSA is the most widely used standard in elliptic-curve cryptography. In 2000, NIST published standard curves at different security levels alongside the FIPS 186-2 Digital Signature Standard. The specification also included a seed parameter that determined the curve’s b coefficient. NSA provided these values and did not explain where they came from; the C49D3608 86E70493 6A6678E1 139D26B7 819F7E90 sequence published for P-256 was debated for years.

Neal Koblitz and Alfred Menezes addressed this ambiguity in an article titled “A Riddle Wrapped in an Enigma”. The prevailing view was that NSA employee Jerry Solinas had derived the seeds from a jokey sentence. In 2015, Solinas said he remembered a phrase like “Give Bob and Jerry a raise,” and noted that the code was written by Bob Reiter but that no archive from the period had been found. Solinas died in 2023, and the question remained open.

Claude solved the problem in under half an hour

Anthropic employees had tried to find the seeds by following this clue-like phrase but had not succeeded. In October 2026, an employee asked the internal research model how the seeds were generated without giving it any hints. In under half an hour, Claude determined that the seeds for the P-192, P-224, P-256, P-384, and P-521 curves were lrand48 output, and that no hash function had been used.

Because phrase-based searches had been exhausted, the model approached the problem from the other direction: it looked for a weak-output pseudorandom generator found in 1990s C libraries. By scanning the published seeds piece by piece, it tried 34 generator and output-slice combinations. When written as five 32-bit words, it was notable that in four of the ten seeds, the top bit of all 20 words was zero; the probability of this happening by chance was 1/5810. This pattern pointed to lrand48, which returns only the top 31 bits of a 48-bit state.

Claude recovered the generator’s state by trying 2^17 possible values for the first word’s 17 hidden bits. For prime-field curve seeds, reconstructing the internal state of a truncated linear congruential generator is a classic lattice problem; the model solved it with Lenstra-Lenstra-Lovasz (LLL) basis reduction. Five NIST seeds and five more seeds in the ANSI X9.62 standard matched the same pattern. The seed for P-256 was the generator’s 1842nd candidate.

Timestamps point to 1997 and 1998

Because the generator also runs backward, Claude rewound each seed’s state to its starting point. All ten prime-field curve seeds were based on Unix timestamps falling between May 1997 and April 1998. The binary curves’ initial values read as February 1984; the team noted that when doubled, this corresponded to April 17, 1998, and that the program may have halved the clock.

The model also found the source of the base points for some curves. The base points of six curves generated in May 1997 match the generator in Arjen Lenstra’s FreeLIP library; the initial values used were 20000, 20420, 20507, 20509, 20512, and 20517. According to Anthropic, no NIST base point had previously been disclosed.

What changes from a security perspective

Anthropic stresses that the findings do not mean a cryptographic break, a new attack, or a weakness in the ECDSA curves. The seeds being generated by a common clock-seeded generator means anyone can rerun the process; the team interprets this as a finding that reduces the likelihood of covert tampering. According to the post, most researchers already trusted the curves, and there is nothing to do.

Still, some questions remain unanswered. Because not every 20-byte candidate produced a valid curve, some candidates were skipped; in the P-224 run, three suitable candidates were passed over, and in the two runs behind the ANSI example curves, seven suitable candidates were skipped. The team does not consider it likely that a weakened curve was chosen because the number of skipped candidates is small. The fifth binary seed, B-163, did not match any attempt and could not be solved. The base points for P-224, P-256, P-384, and P-521 are still unknown.

The $36,864 prize promised to those who found the seeds will be donated to the Internet Security Research Group. The work is credited to John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini, and Steve Weis; the published code was released to the public under CC0 1.0.

Source: Unite.AI