Claude traced the NIST P-256 curve seeds in 30 minutes — the answer was a 1997 computer clock
Anthropic said on October 16, 2026 that a Claude research model found, in under 30 minutes, that the NSA-supplied seeds for NIST curves P-192 through P-521 were outputs of the C library's lrand48 generator seeded with Unix timestamps from 1997–98, not hashes of a secret phrase. Filippo Valsorda reproduced the result, and Anthropic says it is not a cryptographic break
The three lines
- Finding — the seeds were clock-seeded lrand48 output from 1997–98, not hashed phrases
- Verification — Valsorda reimplemented it in Go; the $36,864 bounty goes to ISRG
- Meaning — backdoor suspicion weakens, users need do nothing; B-163 still unexplained
Key questions
- NIST curve seeds solved
- **The seeds for P-192, P-224, P-256, P-384 and P-521 have been explained.** | Item | Detail | |---|---| | Generator | C library lrand48 | | Initialization | Unix timestamps, May 1997–April 1998 | | P-256 | Published seed is candidate 1,842 | | Time taken | Under 30 minutes | | Independent check | Filippo Valsorda, in Go |
- Does P-256 have an NSA backdoor
- **Anthropic says the result makes deliberate weakness less likely**, because the process was simple and reproducible. | Question | Answer | |---|---| | Is ECDSA broken? | No | | New attack? | No | | Action for users | None | | Open question | Why some valid candidates were skipped |
- NIST elliptic curve seeds bounty
- **Filippo Valsorda's 2023 bounty: $12,288, tripled to $36,864 if donated.** | Item | Detail | |---|---| | Opened | October 2023 | | Base amount | $12,288 | | If donated | $36,864 | | Recipient | Internet Security Research Group (Let's Encrypt) |
Five numbers that underpin much of the internet's cryptography finally have an origin story. On October 16, 2026, Anthropic said an internal Claude research model had worked out, in less than half an hour, how the "seeds" behind NIST's elliptic curves were generated. The answer was not a secret phrase. It was a computer's clock in 1997 and 1998.
NIST put these curves into its digital signature standard, FIPS 186-2, in 2000. Each curve's key coefficient is derived by hashing a 20-byte seed — and the NSA supplied those seeds without explanation. Jerry Solinas, the NSA mathematician who produced them, died in 2023. HTTPS and digital signatures have run on numbers nobody could account for.
1. Why it was a 25-year question
| When | What happened |
|---|---|
| 1997 | Cryptographer Alfred Menezes receives the seeds from Solinas |
| 2000 | NIST adopts P-192 through P-521 |
| 2013 | Snowden documents fuel claims the NSA weakened the Dual_EC random generator; NIST withdraws Dual_EC |
| 2023 | Solinas dies; Filippo Valsorda opens a $12,288 bounty for the seeds' origin |
| Oct 16, 2026 | Anthropic publishes the explanation; Valsorda reproduces it |
Hashing a seed is meant to prove a designer didn't hand-pick a weak curve. But if the seed itself is unexplained, nothing rules out regenerating seeds until a weak curve appears. After Dual_EC, that suspicion stuck. A rumor that the seeds were hashes of jokes like "Give Jerry a raise" turned out to be wrong.
2. What Claude found
| Item | Detail |
|---|---|
| Curves | P-192, P-224, P-256, P-384, P-521 (+ five ANSI X9.62 curves) |
| Generator | C library lrand48, output shifted right by 23 bits |
| Seeding | Unix timestamps, May 1997–April 1998 |
| P-256 | The 1,842nd candidate matches the published seed |
| First clue | Top bit zero in each word of four of ten seeds — 1 in 5,810 by chance |
| Search | 34 1990s-era generator and slicing combinations |
| State recovery | LLL lattice reduction; 2¹⁷ guesses for 17 hidden bits |
| Time | Under 30 minutes |
Claude tested common 1990s random generators and spotted the zeroed high bits that truncated lrand48 output leaves behind. It then recovered the generator's internal state with a textbook lattice method and ran it backwards to its starting point — which landed on plausible Unix timestamps. Binary-curve timestamps read as 1984, but doubled they give April 17, 1998, two weeks after the P-224 run; the authors suggest the program "halved the clock."
The timestamps are what make it convincing. The generator's low bits at initialization (0x330E) recur every 65,536 steps, so they prove little on their own; consistent, sensible dates do. Valsorda reimplemented the solution in Go and confirmed it. The tripled $36,864 bounty goes to the Internet Security Research Group, which runs Let's Encrypt.
3. Is the cryptography safe?
Anthropic says plainly this is "not a cryptographic break, new attack, or weakness." If anything it cuts the other way: a simple, reproducible clock-seeded process is hard to square with someone trawling for weak curves.
| Question | Answer |
|---|---|
| What should services using P-256 do? | Nothing |
| Bitcoin? | Uses secp256k1, defined by small fixed constants; unaffected |
| Open puzzle | P-256 candidate 876 was also valid, yet 1,842 was published |
| Skipped curves | Three for P-224; seven across two ANSI runs |
The authors argue the small number of skips makes weak-curve selection implausible, though the selection rule is unknown. For background on how elliptic curves secure your connection, see "What is elliptic curve cryptography?"
4. What remains unexplained
- B-163: the fifth binary seed fits none of the hypotheses tried.
- Base points: six curves' base points trace to Arjen Lenstra's FreeLIP generator (seeds 20000, 20420, 20507, 20509, 20512, 20517), but those of P-224, P-256, P-384, P-521 and the binary curves are still unexplained.
- The dual-use angle: AI finding patterns that eluded human researchers for years is a capability attackers want too — see "What is API key theft?" on criminal forums' turn to stolen AI access.