> ## Content Index > Fetch the complete content index at: https://engineerpal.com/llms.txt > Use this file to discover other available public pages before exploring further. # How Claude traced the NIST curve seeds, and why it matters for HTTPS - URL: https://engineerpal.com/nist-ecdsa-curve-seeds/ - Published: 2026-10-17T15:42:31.000Z - Updated: 2026-10-17T15:50:49.000Z - Description: Anthropic says Claude traced them to a 1990s C random-number generator seeded with the clock, leaving little room for a hidden backdoor. - Author: Nina Park - Tags: AI, Anthropic, Claude, NIST, Cryptography A decades-old cryptography mystery got an anticlimactic answer on Friday (Oct. 16). [Anthropic said](https://www.anthropic.com/research/ecdsa-curve-origins?ref=engineerpal.com) an internal research version of its Claude model worked out how the NSA generated the "seeds" for five widely used NIST elliptic curves, the mathematical structures behind many digital signatures and encrypted web connections. The short answer: the seeds came from `lrand48`, the C library's ordinary random-number generator, started with Unix timestamps from May 1997 to April 1998\. Cryptographer Filippo Valsorda [independently confirmed it](https://words.filippo.io/seeds-solved/?ref=engineerpal.com). "This is not a cryptographic break, new attack, or weakness in the ECDSA curves," Anthropic said. ## Where the seeds came from NIST standardized the P-192, P-224, P-256, P-384 and P-521 curves in FIPS 186-2 in 2000, the standard for ECDSA, the Elliptic Curve Digital Signature Algorithm. Under the ANSI X9.62 standard, they were generated "[verifiably at random](https://words.filippo.io/seeds-bounty/?ref=engineerpal.com)": a 20-byte seed is run through the SHA-1 hash function, and the result sets one of the curve's coefficients. The NSA supplied those seeds without saying where they came from. A long-running rumor held that NSA mathematician Jerry Solinas had hashed a joke phrase along the lines of "Give Bob and Jerry a raise." In 2015, Solinas said a colleague, Bob Reiter, wrote the code and that neither of them remembered the details, [according to Anthropic](https://www.anthropic.com/research/ecdsa-curve-origins?ref=engineerpal.com). Solinas died in 2023. [Anthropic's writeup](https://www.anthropic.com/research/ecdsa-curve-origins?ref=engineerpal.com) describes a mundane process. Someone seeded `lrand48`, a simple 48-bit generator that computes each number from the last, with the current time. They drew 20-byte chunks as candidate seeds, tested each one under X9.62, and threw out the ones that didn't produce a valid curve. ![Flow diagram: a 1997 Unix timestamp feeds lrand48, which outputs a seed that SHA-1 turns into the P-256 curve parameters](https://engineerpal.com/content/images/2026/10/nist-seed-pipeline-diagram.png) Chart: EngineerPal, data from Anthropic For P-256, the published seed is candidate 1,842 from a run started at 9:52 p.m. ET on Aug. 15, 1997 (0152 UTC on Aug. 16). We ran [Anthropic's public-domain code](https://www.anthropic.com/research/ecdsa-curve-origins?ref=engineerpal.com), and it regenerated all 14 seeds it covers byte for byte. Here's a minimal Python version for P-256: ```python x = (871696354 << 16) | 0x330E # srand48(871696354) out = "" for i in range(20 * 1842): # 20 one-byte draws per candidate x = (0x5DEECE66D * x + 0xB) % 2**48 # one lrand48 step if i >= 20 * 1841: out += "%02X" % (x >> 40) # top byte of the state print(out) # C49D360886E704936A6678E1139D26B7819F7E90 ``` ## How Claude found the pattern [Anthropic says](https://www.anthropic.com/research/ecdsa-curve-origins?ref=engineerpal.com) Claude scanned the seeds for fingerprints of 1990s random-number generators, testing 34 combinations of generator and output format. It noticed that the top bit was zero in every 32-bit word of four seeds, a pattern with about a 1-in-5,810 chance of happening by accident. That zero bit is the `lrand48` signature, because the function returns 31 of its 48 internal bits. Claude then brute-forced the hidden bits, used a lattice-reduction technique called LLL for the trickier prime-curve outputs, and ran the generator backward to its starting state, which pointed to timestamps in 1997 and 1998. Anthropic says the work took under half an hour. It hasn't named the model or published the prompts, and that timing claim hasn't been independently checked. ## Why it rules out a known backdoor technique The suspicion came from the NSA's record. Snowden-era disclosures linked the NSA to efforts to weaken cryptographic standards, and NIST later withdrew one of them, the Dual\_EC\_DRBG random-number generator, [CoinDesk noted](https://www.coindesk.com/tech/2026/10/17/wow-it-s-a-real-discovery-claude-cracks-a-25-year-nsa-number-mystery?ref=engineerpal.com). Dual\_EC is not one of the NIST curves. Researchers had already argued against a seed-based weakness. Neal Koblitz and Alfred Menezes called it implausible in their 2015 paper "[A Riddle Wrapped in an Enigma](https://eprint.iacr.org/2015/1018?ref=engineerpal.com)." In 2017, Daniel Bernstein and Tanja Lange described a theoretical way to hide a weakness by choosing a seed, but it needed about 70 bits of freedom, [Valsorda wrote](https://words.filippo.io/seeds-solved/?ref=engineerpal.com). Valsorda, who organized a [bounty for the seeds](https://words.filippo.io/seeds-bounty/?ref=engineerpal.com) in 2023, said he "reimplemented the algorithm in Go to verify the claim." The timestamp method leaves "barely 30 bits" of freedom, which he said completely rules out that technique. That's "not enough to embed any kind of NOBUS backdoor," he [wrote](https://words.filippo.io/seeds-solved/?ref=engineerpal.com), meaning one that "nobody but us" can exploit. "We now know how the seeds of the NIST elliptic curves were generated: they're not the hash of some saucy sentence, but the output of drand48 seeded with the time," Valsorda said. (`drand48` and `lrand48` share the same underlying generator.) The result is "devastating news... for an entire generation of NIST cryptography conspiracy theories," Hacker News user tptacek said in a [thread](https://news.ycombinator.com/item?id=50122800&ref=engineerpal.com) about the finding. ## What's still unexplained Anthropic's code also reproduces five ANSI X9.62 example curves and four NIST binary curves, B-233, B-283, B-409 and B-571\. The binary-curve seeds fit a halved timestamp, which [Anthropic hedges](https://www.anthropic.com/research/ecdsa-curve-origins?ref=engineerpal.com) with "if that reading is right." The B-163 seed is still unexplained. So are the base points, the fixed starting point each curve uses, for P-224, P-256, P-384 and P-521\. [Anthropic says](https://www.anthropic.com/research/ecdsa-curve-origins?ref=engineerpal.com) it traced the P-192 base point and those of the five example curves to a random-number generator in Arjen Lenstra's FreeLIP library, a claim that hasn't been independently confirmed. There's also a selection question. [Valsorda's list](https://words.filippo.io/seeds-solved/?ref=engineerpal.com) shows about twice as many valid seeds as were published, including an earlier valid P-256 candidate, No. 876, that was skipped, and he found no good explanation. Hacker News user fidotron [noted](https://news.ycombinator.com/item?id=50122800&ref=engineerpal.com) that the method can't show which valid candidates were generated and discarded. ## What it means for HTTPS and Bitcoin Nobody needs to do anything. "There is no action to be taken or things to do differently," [Anthropic said](https://www.anthropic.com/research/ecdsa-curve-origins?ref=engineerpal.com). P-256 and P-384 are "[the curves used by the ECDSA X.509 certificates that secure much of the web](https://words.filippo.io/seeds-bounty/?ref=engineerpal.com)," and P-384 is the curve the NSA's Commercial National Security Algorithm Suite [requires](https://www.rfc-editor.org/rfc/rfc9151?ref=engineerpal.com) for national security systems. Ruling out a known way to plant a weakness through the seeds makes those curves more trustworthy, not less. A weak random-number generator would be a disaster for a private key, but these seeds were always public, so there was never a secret to steal, [CoinDesk noted](https://www.coindesk.com/tech/2026/10/17/wow-it-s-a-real-discovery-claude-cracks-a-25-year-nsa-number-mystery?ref=engineerpal.com). Bitcoin and Ethereum use a different curve, [secp256k1](https://en.bitcoin.it/wiki/Secp256k1?ref=engineerpal.com), defined by small fixed constants, so they were never part of this mystery. Their long-term threat is quantum computing, which applies regardless of how a curve was chosen, [CoinDesk noted](https://www.coindesk.com/tech/2026/10/17/wow-it-s-a-real-discovery-claude-cracks-a-25-year-nsa-number-mystery?ref=engineerpal.com). The Anthropic team [claimed the bounty](https://words.filippo.io/seeds-solved/?ref=engineerpal.com) at 9:07 p.m. ET on Oct. 14 and chose to donate the money, which tripled the payout to $36,864\. [Anthropic said](https://www.anthropic.com/research/ecdsa-curve-origins?ref=engineerpal.com) the money will go to the Internet Security Research Group, the nonprofit behind Let's Encrypt, which hasn't publicly confirmed receiving it.