Claude traces the origins of NIST ECDSA curve seeds

News

Anthropic says Claude identified the timestamp-based generation of NIST ECDSA curve seeds and partially explained several base points.

Anthropic says an internal research model, Claude, identified the origin of the long-debated seed values behind several NIST ECDSA curves, finding they were generated from a weak C library pseudorandom number generator seeded by Unix timestamps. The company said the finding closes a years-long mystery around a widely used cryptographic standard and does not indicate a cryptographic break or new weakness in ECDSA.

Evidence and context

In a post published Friday, 16 October 2026, Anthropic said the NIST P-192, P-224, P-256, P-384 and P-521 seeds were not hashes of hidden phrases, as some researchers had suspected, but outputs of the C library's lrand48 generator. According to the post, the generator was initialized with a Unix timestamp and sampled to produce 20-byte candidates, with the published seed corresponding to one candidate in the sequence. Anthropic said Claude recovered the seeds in under half an hour after an employee asked the model to explain how they were generated.

The company said the P-256 seed matched candidate 1842 from a run starting on 1997-08-16 01:52:34 UTC, while the other prime-curve seeds matched timestamps between May 1997 and April 1998. Anthropic also said the four binary-curve initializations read as February 1984 when recovered directly, and as April 17, 1998 when the timestamp was doubled, suggesting the software may have halved the clock. The company said that for the ten prime-curve seeds, each recovered srand48 initialization corresponded to a Unix timestamp in that 1997-1998 window.

Anthropic described the method as a search for signatures of a 1990s-vintage PRNG. It said Claude scanned combinations of generator and output slices, noticed that some seeds had all top bits clear, and identified lrand48, which returns the top 31 bits of a 48-bit state. For the prime curves, the company said Claude recovered the internal 48-bit state and then ran it backward to the srand48 form. Anthropic said the result does not support claims of a deliberate backdoor and instead makes such concerns less plausible.

Base points and remaining gaps

Beyond the seeds, Anthropic said Claude also traced the base points for six curves generated in May 1997: P-192 and the five ANSI X9.62 example curves prime192v2, prime192v3 and prime239v1 to v3. According to the post, those base points came from the random number generator in FreeLIP, using small integer seeds including 20000, 20420, 20507, 20509, 20512 and 20517. The company said the recipe was to seed the generator, discard seven outputs, generate candidate x-coordinates from 26-bit outputs reduced mod p, and repeat until the x-value lay on the curve.

Anthropic said several questions remain unresolved. It reported that P-256 had another viable candidate at iteration 876, while P-224 and the ANSI example runs also skipped other viable curves. The company said it does not know what criteria were used, if any, to select among candidates, and it was unable to explain the base points for P-224, P-256, P-384 and P-521, or for the NIST binary curves. It also said the fifth binary seed, B-163, remains unexplained.

The post said the bounty for finding the seeds, valued at $36,864, will be donated to the Internet Security Research Group. Anthropic credited several employees for the work and acknowledged the late Jerry Solinas, whose earlier remarks had helped shape speculation around the seeds.