Anthropic: Claude traced the NSA-supplied NIST elliptic-curve seeds (P-192 to P-521) to the old lrand48 random generator seeded with 1997–98 Unix timestamps, in under half an hour; not a weakness, code reproducible

Why it matters

【Key points】

Anthropic's research page posted "Claude reveals ECDSA curve origins". An employee asked an internal research model (called only Claude; no model name given) to work out, with no hints, where the NIST elliptic-curve seeds came from. It cracked it in under half an hour. The NSA supplied the seeds to NIST in the 1990s with no explanation, feeding years of backdoor suspicion. The popular story was a hash of a joke phrase, and a $36,864 bounty was open.

Finding: the seeds for P-192, P-224, P-256, P-384, P-521 and five ANSI X9.62 example curves are not hashes. They are output of the old C library generator lrand48, seeded with Unix timestamps from May 1997 to April 1998 (P-256 is candidate 1,842). Four binary-curve seeds also reproduce (the clock seems halved), and base points for six curves including P-192 are explained. B-163, the P-224/256/384/521 base points and why some viable candidates were skipped remain open. Anthropic stresses this is no break or new attack; it makes a planted backdoor less plausible. The bounty goes to ISRG, the group behind Let's Encrypt.

【Verifiable】

Post with reproduction code (CC0): https://www.anthropic.com/research/ecdsa-curve-origins

Co-author Henry de Valence: https://x.com/hdevalence/status/2111170616112132273

We ran the published code: the P-256 seed matches the standard value C49D3608…819F7E90 exactly.

【Our read】

1. A real decades-old mystery solved by AI, checkable by anyone with a few dozen lines of code. The methods are standard (spotting a weak PRNG, LLL lattice reduction); the new part is the model choosing a fresh angle instead of chasing the wrong clue.

2. Practical security impact is nil: nothing needs changing. The point is that AI can now audit foundations long taken on trust.

3. Open pieces remain (B-163, most base points, skipped candidates); independent review by cryptographers is still to come.