Claude Traced the Origin of the NIST ECDSA Curve Seeds in Half an Hour

On October 16, 2026, Anthropic's Frontier Red Team announced that it had closed one of the oldest open questions in applied cryptography. Anthropic's internal research model Claude determined in under half an hour how the 20-byte seed values for the standard NIST curves P-192, P-224, P-256, P-384 and P-521 were produced. There was no hash. The seeds came from the C library's pseudorandom number generator lrand48, initialized with Unix time.

Twenty years without an explanation

ECDSA is the most widely used elliptic-curve cryptography standard. NIST adopted it in 2000 as part of FIPS 186-2, along with a set of standard curves of different strengths. The coefficient b of each curve is derived from the hash of a published seed. The NSA supplied the seeds themselves and never said where they came from. For P-256, the seed is C49D3608 86E70493 6A6678E1 139D26B7 819F7E90.

The lack of an explanation fed suspicion that the parameters might have been picked to build in a weakness. Neal Koblitz and Alfred Menezes examined the story in a paper titled "A Riddle Wrapped in an Enigma". Hobbyists even offered a bounty for anyone who could find the origin of the seeds.

The most popular theory was a joke. In 2015, Jerry Solinas, a longtime NSA employee, wrote that the seeds were probably produced by hashing a phrase like "Give Bob and Jerry a raise", along with some kind of counter. Bob Reiter wrote the code, but he did not remember the details. No archives were found, and Solinas himself died in 2023.

How Claude got past the dead end

Several Anthropic employees had already tried searching for the hash of that very phrase and found nothing. The theory turned out to be wrong. In October 2026, one of them asked the internal model a question with no hints: could it work out how these seeds were generated?

Claude worked backwards, reasoning about how the program that created the curves must have worked. It assumed the program used a PRNG from a 1990s C library. Such generators are weak enough that their output can be recognized, and once recognized, their initial state can be recovered.

The model wrote a scanner that slid bit by bit across each seed and checked whether adjacent fragments were consecutive outputs of a generator from that era. In total, it tested 34 combinations of generator and output slices. Then Claude noticed a pattern: some of the seeds had zero high bits. If you write a seed as five 32-bit words, four of the ten have the top bit equal to zero in all 20 words. The probability of that happening by chance is 1/5810. That is the signature of the lrand48 linear congruential generator.

What they found

According to Anthropic, the algorithm looked like this: a PRNG was initialized with Unix time t, then ran n iterations, and at each one 20 bytes were taken as a seed candidate. The first 20 bytes are candidate 1, the next are candidate 2, and so on.

• Affected curves: NIST P-192, P-224, P-256, P-384, P-521.
• Source: lrand48 seeded with Unix time.
• Candidate size: 20 bytes per iteration.
• P-256: 1842 iterations to reach the standard seed.
• Model run time: under half an hour.
• The theory of a hashed joke phrase: not confirmed.

What this means in practice

Anthropic states explicitly that this is not a cryptographic break, not a new attack and not a weakness in the curves. Developers and administrators do not need to take any action: most researchers already trusted these curves. There is no need to change libraries, TLS configurations or signature schemes because of this news.

For assessing trust, the result counts in the curves' favor. The seeds were produced in a simple way, with a common PRNG started from the clock, and anyone can now reproduce it. That leaves far less room for hidden tuning of the parameters than the mysterious-hash theory did.

The method itself is also worth remembering. The model did not look for confirmation of a well-known legend. It rebuilt the picture from the technical constraints of the era and found a statistical fingerprint. For auditing old standards whose documentation has been lost, this is a workable template: first a hypothesis about what the tool might have been, then a check against the traces in the data.