Anthropic says an internal Claude research model has traced the origins of five NSA-supplied elliptic curve seeds in under 30 minutes, answering a cryptography question that remained open for roughly 25 years. The finding explains how important public security parameters were chosen, rather than exposing secret keys or breaking encryption.
In a report published October 16, 2026, researchers said the seeds behind NIST curves P-192, P-224, P-256, P-384 and P-521 came from lrand48, an older C library random-number generator initialized with Unix timestamps. The result challenges a long-running theory that the values were hashes of humorous phrases.
NSA Curve Seeds Raised Questions
NIST adopted ECDSA, the Elliptic Curve Digital Signature Algorithm, in its FIPS 186-2 standard in 2000. Digital signatures help verify who signed data and whether it has changed. The standard published seeds used by a SHA-1-based process to derive curve parameters, but did not explain where those seeds originated.
That missing history left room for claims that the NSA might have selected curves with hidden weaknesses. Researchers had no demonstrated attack against these curves, but lacked a clear account of their selection. Former NSA mathematician Jerry Solinas recalled phrases such as “Give Bob and Jerry a raise,” sending earlier searches toward possible hash inputs.
The stakes extend beyond academic debate. Cybersecurity News previously covered Apple’s PQ3 iMessage protocol, which uses ECDSA with P-256 for message authentication. Understanding the history of these shared parameters helps explain why trust in curve selection matters across widely used services.
Claude Rebuilt the Generation Process
Instead of following the phrase theory, Claude examined generators common in 1990s software. It built a scanner covering 34 combinations of generators and output slices, looking for patterns inside the published seeds.
Some binary-curve seeds showed a clear clue. Their 32-bit words consistently had a zero in the highest bit, matching lrand48, which returns 31 bits from a 48-bit internal state. Claude recovered candidate states by testing the 17 hidden bits and checking subsequent outputs.
The prime-curve seeds required another step because they retained only eight bits from each generator output. Claude used the Lenstra–Lenstra–Lovász lattice reduction algorithm, or LLL, to recover internal states from these partial values. Five NIST seeds and five ANSI X9.62 example seeds matched the same construction.
Running the generator backward revealed initialization values corresponding to dates between May 1997 and April 1998. For P-256, the published seed was the 1,842nd candidate from a run initialized on August 16, 1997, at 01:52:34 UTC. Each candidate contained 20 bytes.
Four binary-curve seeds also matched the generator. Their values suggest a clock value divided by two, although the researchers describe that interpretation as a possibility, not a confirmed fact.
Anthropic stressed that this is not a cryptographic break, new attack, or newly discovered ECDSA weakness. These are public curve-generation seeds, not private signing keys. Reconstructing them does not let an attacker forge signatures. The researchers say the simple, repeatable process makes deliberate manipulation less plausible.
The work adds another example of AI-assisted cryptography research, following Cybersecurity News coverage of Claude’s analysis of cryptographic weaknesses. Here, however, the outcome is historical clarity rather than an improved attack.
Claude also traced base-point generation for P-192 and five ANSI example curves to FreeLIP, a long-integer arithmetic package. Base points are fixed starting points used to calculate public keys, and their origins are separate from the curve seeds.
The account is not complete. B-163’s seed remains unexplained, as do several base points. Researchers also found skipped candidates that appeared suitable, including P-256 candidate 876, without knowing why they were rejected. The findings therefore strengthen confidence without proving every selection decision was harmless.
Anthropic published reproduction code so others can check the matches. The Internet Security Research Group will receive the $36,864 bounty. The report calls for no changes to deployed systems because of this discovery alone.
An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.
