Claude traced the origin of NIST's elliptic curve seeds

What did Anthropic find?

Anthropic says Claude found where the seeds of the NIST P-192, P-224, P-256, P-384 and P-521 curves came from, according to its research post. None of them were the result of a hash. They were the output of the C library's lrand48 random number generator, started with a Unix timestamp.

A Unix timestamp is a clock reading. For the five NIST prime curves, Anthropic says every starting time falls between May 1997 and April 1998.

Why did the seeds matter?

ECDSA is a widely used elliptic curve standard, adopted by NIST in 2000. Its curves come with a published seed, and the NSA supplied them with no explanation. For years, some people suspected a hidden backdoor.

The best-known story was that the seeds came from a hash of a joke phrase, such as 'Give Bob and Jerry a raise'. Anthropic says several of its employees chased that clue without success, and that it turned out to be wrong.

How did Claude do it?

In October 2026, Anthropic says, a curious employee asked an internal research model to work out how the seeds were made, without pointing it at the clue. Claude guessed that a 1990s random number generator was used, and wrote a scanner to test the idea.

It noticed that the top bit was zero in many of the seeds' words, which pointed to lrand48. It then used a standard maths technique to recover the generator's starting state, and stepped back to a timestamp.

Is this a security problem?

No, Anthropic says. In its words: "This is not a cryptographic break, new attack, or weakness in the ECDSA curves." It says the finding makes it more confident the curves were chosen without any backdoors or intentional weaknesses.

Anthropic tells readers there is no action to take, and says most researchers already trusted the curves.

What is still unexplained?

Anthropic could not explain how the base points of P-224, P-256, P-384 and P-521 were chosen, or the seed of the binary curve B-163. It also notes that some other possible curves were skipped in each run, and says it does not know why.

It says the number of skipped curves is small, so it does not think weakened curves were selected.

Why does it matter?

It is a case of an AI model solving a question that researchers had left open for years. It also removes one of the best-known reasons to doubt a standard that protects a lot of software. The work is Anthropic's own, and outside experts have not yet been quoted on it.

What's next?

Anthropic published code to reproduce the seeds. It says the $36,864 bounty for finding them will be donated to the Internet Security Research Group.