Claude Traced NIST’s Mysterious ECDSA Curve Seeds to a 1997 Random Number Generator

For 26 years, cryptographers have wondered where the seeds for NIST’s widely-deployed elliptic curve parameters came from — and whether the unexplained origins concealed a backdoor. On October 16, 2026, Anthropic published a research post revealing that Claude had answered the question in under half an hour: the seeds came from a Unix timestamp-seeded C pseudorandom number generator called lrand48, run in the late 1990s.

The NIST prime curves — P-192, P-224, P-256, P-384, and P-521 — underpin a significant share of the world’s encrypted internet traffic, from TLS connections to code-signing certificates. Their seeds, generated by NIST in the mid-to-late 1990s, had never been explained. That silence fueled years of speculation, with some researchers suspecting the NSA had engineered a hidden weakness into the parameters before handing them to NIST for standardization.

What Claude Found

Claude’s approach was direct: it hypothesized that the seeds came from a weak 1990s-era pseudorandom number generator and wrote a scanner to search for consecutive PRNG outputs matching the seed values. A critical clue was that the top bits of multiple seeds were consistently zero — a statistically unlikely pattern that matches the 31-bit output range of lrand48.

For the prime curves, Claude used the LLL lattice reduction algorithm to recover generator states from the seeds, even where only a fraction of the bits were retained. Each recovered state regenerated the full 160-bit seed, ruling out coincidence. The timestamps embedded in the generator state fall between May 1997 and April 1998.

The P-256 seed, for instance, corresponds to candidate #1842 from a generator run that started on August 16, 1997, at 01:52:34 UTC. Claude also traced the base points for P-192 and five ANSI X9.62 example curves to the random number generator in FreeLIP, an early cryptography library also shipped with early versions of NTL.

What This Means for Security

Anthropic is careful about the implications. “This is not a cryptographic break, new attack, or weakness” in ECDSA, the post states. The finding does not compromise the security of existing implementations. P-256 and its siblings remain the standard recommendation for elliptic curve cryptography.

What the finding does change is the plausibility of the backdoor theory. A deliberate backdoor would require an attacker to have picked parameters with hidden mathematical structure — not parameters generated by typing lrand48() seeded with the current clock time. Anthropic argues this makes intentional manipulation “much less plausible,” though it stops short of ruling it out entirely.

Some questions remain open. The seed for binary curve B-163 is still unexplained. The base points for P-224, P-256, P-384, and P-521 remain unknown, as does the total number of generation runs conducted. Most notably, at least one valid candidate was skipped during selection — candidate 876 for P-256 was passed over in favor of candidate 1842 — and NIST has never disclosed what criteria governed that choice.

AI as Cryptographic Sleuth

The secondary story here is the method. A cryptographic mystery that stumped human researchers for a quarter-century was resolved by an AI in less than 30 minutes of directed work. Anthropic notes that the right approach — searching for PRNG outputs rather than hash preimages — took an internal research model almost no time once it was pointed at the problem without prior hints.

The $36,864 bounty that had been offered for solving the curve seed mystery will be donated to the Internet Security Research Group, which operates Let’s Encrypt.

Anthropic published the Python code that reproduces the full derivation. As first reported on Anthropic’s research blog, the post includes the recovered generator states and timestamps for verification.