For nearly three decades, one of the most persistent questions in cryptography has been this: where exactly did the NSA get the numbers used to build the elliptic curves that secure the internet?
Those numbers — called seeds — underlie ECDSA, the digital signature standard that protects HTTPS connections, GitHub commits, Bitcoin wallets, and billions of other cryptographic operations worldwide. NIST published them in the year 2000. The NSA supplied them. Nobody said where they came from. And for 25 years, that silence fed one of the darkest theories in cryptography: that the NSA had deliberately chosen weak curves, backdoors hiding in plain sight, silently undermining the security of the entire internet.
On October 16, 2026, Anthropic’s research team published a blog post reporting that Claude had resolved the mystery — and done it in under 30 minutes.
The Problem With the Seeds
To understand why this mattered, it helps to understand what a seed is. When generating an elliptic curve for cryptographic use, you need to pick parameters that satisfy complex mathematical requirements. A common technique is to hash a phrase or number into a candidate parameter, check whether it satisfies the requirements, and repeat if not. The seed is the starting input. Crucially, if you publish the seed, anyone can verify that you followed the process honestly — that you didn’t cherry-pick parameters that happen to contain exploitable weaknesses.
NIST published the seeds for its five prime-field curves (P-192, P-224, P-256, P-384, and P-521) in its Digital Signature Standard in 2000. But it did not publish what the seeds were seeded from. The origin was opaque. And opacity, in cryptography, is always suspicious.
The NSA mathematician who reportedly chose the seeds, Jerry Solinas, died in 2023 — and by then, his memory had already faded. In one account, he recalled that the seeds might have come from hashing a phrase like “Give Bob and Jerry a raise,” in reference to himself and his colleague Bob Schlafly. But cryptographers who tried every variation of that phrase found nothing. The bounty offered by Filippo Valsorda — $36,864 in a nod to a classic cryptography figure — went uncollected for years.
What Claude Found
When Anthropic gave Claude the problem — reportedly framed as an internal question to the frontier red team — the model solved it in under 30 minutes using a combination of pattern recognition and mathematical reduction.
Claude’s first observation was subtle but decisive: the top bit of every 32-bit word in four of the seeds was systematically zero. That’s not what you’d expect from a random input or a cryptographic hash. It’s exactly what you’d expect from lrand48, a C standard library random number generator that dates to the 1970s. lrand48 returns non-negative integers — it only uses 31 bits of its 32-bit output space, leaving the top bit consistently zero.
With the generator identified, Claude then had to find the initial seed — the Unix timestamp that started the lrand48 run. For the binary-field curves, it used brute force across a plausible timestamp range. For the prime curves, it deployed the LLL algorithm — the Lenstra–Lenstra–Lovász lattice-reduction algorithm — to reconstruct the generator’s internal state from its truncated output and wind the clock backward.
The result: P-256’s seed matched the 1,842nd candidate from a run starting at 01:52:34 UTC on August 16, 1997. The other prime-field curves traced to timestamps spanning May 1997 to April 1998, consistent with when NIST would have been preparing the standard for its 2000 publication.
Anthropic also traced six related curves from the ANSI X9.62 standard — P-192, prime192v2, prime192v3, prime239v1, prime239v2, and prime239v3 — to the FreeLIP library’s random generator, seeded with small integers like 20,000. The team published CC0-licensed reproduction code that independently confirmed all 14 seed derivations and six base points. Anyone can verify it themselves.
What This Means — and What It Doesn’t
The finding does not reveal a mathematical weakness in ECDSA. The curves are still secure. The LLL attack Claude used recovered the generator’s internal state from the seeds themselves, not from information an attacker would have access to. You don’t need to replace your TLS certificates or your SSH keys.
What the finding does is shift the probability distribution on intent. For years, the fear was that the NSA had deliberately searched the space of possible seeds for curves with hidden weaknesses — the way it apparently did with the Dual_EC_DRBG pseudorandom number generator, whose suspicious structure wasn’t confirmed as an intentional backdoor until Edward Snowden’s documents surfaced in 2013.
The lrand48 explanation makes that scenario considerably less plausible. Someone generating curves through a targeted weakness search would use a cryptographically strong generator and hide the evidence. Using a C stdlib function seeded from the system clock, and generating only a few thousand candidates before accepting the first one that satisfied the requirements, doesn’t look like a cover story for a backdoor — it looks like a government mathematician writing code in 1997 and using whatever was in the standard library.
Anthropic notes that some questions remain. The selection criteria for which candidates to skip are not fully documented. The seed for B-163 (a binary-field curve) is still unexplained. The base points for P-224, P-256, P-384, and P-521 trace to a different method that the team has not yet accounted for. This is not a complete solution, but it is the most complete explanation anyone has produced in 25 years.
Why It Took an AI to Find It
The NIST curve seeds weren’t classified. The bounty had been public for years. Cryptographers as capable as anyone in the field had taken a run at them. So why did it take Claude to crack it?
Part of the answer is breadth. The solution required simultaneously knowing that lrand48 only returns 31-bit values, knowing what the statistical signature of that truncation looks like in a seed, knowing the LLL algorithm well enough to apply it, understanding the plausible timestamp range for 1990s NIST work, and executing a systematic search across generator variants. A human expert might know any one of these things deeply. Claude held all of them at once.
Part of the answer is also speed. Claude covered 34 generator-and-slice combinations and flagged the zero-top-bit pattern within minutes. A human searching the same space would have needed days to weeks of focused effort for what might have felt like a long shot.
Anthropic is donating the $36,864 bounty to the Internet Security Research Group — the nonprofit that runs Let’s Encrypt, which provides free TLS certificates to tens of millions of websites. It’s a fitting recipient. For 25 years, the integrity of internet cryptography rested partly on trust that the NIST curves didn’t contain a trap door. Now there’s a better reason than faith to believe they don’t.
The Bigger Picture
There’s a certain irony in the story. The thing that made the NSA seed generation suspicious — opacity, secrecy, a dead mathematician, an unexplained choice — turned out to have a mundanely human explanation: someone called lrand48(), let the clock set the seed, and didn’t write it down. The internet’s most foundational curves were generated, in part, by the same random-number function you’d use to shuffle a deck of cards in a C programming exercise.
The mystery wasn’t hidden. It was just waiting for a tool capable of recognizing it.
