Claude Traces the Origin of Five NIST Curve Seeds in Half an Hour

On October 16, Anthropic published an unusual result. An employee gave an internal Claude research model a question that cryptographers have debated for more than twenty years: how the initial values (seeds) for five NIST elliptic curves were obtained. There were no key hints. The model solved it in under half an hour. According to Jiqizhixin, the seeds can be reproduced as the output of an old pseudorandom number generator from a C library.

An old mystery in the standard

The NIST curves (P-192, P-224, P-256, P-384 and P-521) were standardized around 1999–2000. Today they underpin TLS, signatures and a large share of enterprise cryptography. The parameters of each curve are derived from a short seed through hashing. The seeds themselves are published, but the standard does not explain where they came from.

For cryptography, that is an uncomfortable gap. A seed should be an unremarkable number. Otherwise, suspicion remains that someone tried many candidates to find a curve with a desired property. After the Dual_EC_DRBG affair, in which a NIST standard was suspected of containing a backdoor linked to the NSA, distrust of how parameters were chosen only grew. In more than twenty years, no public answer to the seed question has appeared.

What Claude did

According to Anthropic, the task was set without a hint about the key step. The model traced the generation of all five seeds and showed that their source is an outdated pseudorandom number generator from a C library. That answers "where from," not "why."

The portion of the material available does not give full technical details. It is unknown which specific generator implementation was named, how many candidates the model tried, or how it arrived at the right class of algorithms. Those details are best sought in Anthropic's original publication.

Key parameters of the experiment:

• Subject: the seeds of five NIST curves, which are more than 20 years old.
• Performer: an internal Claude research model, not a public release.
• Time: under 30 minutes.
• Hints: no key pointers were given.
• Conclusion: the seeds were produced by an old pseudorandom number generator from a C library.

How to read the result

First, what this news does not imply. The origin of the seeds says nothing about a break of the curves or a weakness in their mathematics. It concerns the procedure for choosing parameters, not the strength of the schemes. If the seeds really came from an ordinary generator, the argument that they were deliberately selected for a hidden property gets weaker, but formally it does not disappear. The conclusions here are for the cryptographic community to draw.

The result has a useful property: it is easy to check. The generators are deterministic, so any researcher can repeat the chain from the input data to the seeds and compare it with the published values. That sets it apart from loud "AI made a discovery" claims that cannot be independently verified.

For the AI industry, it is also an example of a new type of task: digital archaeology. The work means sifting through outdated tools, old libraries and conventions from the late 1990s to find the combination that yields a given result. This kind of work takes patience and broad reading, and models handle it well.

What to do in practice

There is no need to migrate away from NIST curves because of this news. With no reason yet to change production cryptography, it is enough to watch the reaction from NIST and leading cryptographers. Security teams should wait for independent reproduction of the result and a review of the methodology. Researchers should check similar "nameless" constants in other standards: if one question was closed in half an hour, neighboring ones will close too. And those building their own protocols should start documenting the origin of every constant, so that no one has to guess twenty years from now.