The joke was the dead end
For 25 years, the working theory about the NIST curve seeds was a sentence. The NSA mathematician behind the curves, Jerry Solinas, recalled in 2015 that the seeds were hashes of a humorous phrase about a pay raise, written by a colleague who no longer remembered the details. Solinas died in 2023. A public bounty, $12,288 and tripled if donated to charity, sat unclaimed while people tried variations of the phrase.
Anthropic says several of its own staff tried that route too, and failed, because the premise was wrong. In October, an employee put the question to an internal research model without mentioning the phrase at all. The model ignored sentences and asked a different question: what software, in 1997, would have produced numbers that look like this?
A clock, not a cipher
The answer it reached is mundane, which is the point. The seeds are output from lrand48, a pseudorandom generator that shipped with C libraries of the era, started with srand48 using the system time. Each prime-curve run began at a Unix timestamp between May 1997 and April 1998. P-256's run began at 01:52:34 UTC on 16 August 1997, and the seed the standard published was the 1,842nd candidate that run produced.
One distinction matters for careful readers. This explains where the seeds came from, not how the curves were then built from them. The standard's construction is unchanged: FIPS 186-2 still derives the curve coefficient by hashing the seed with SHA-1. What collapses is the story about the seed itself — that it was the hash of a memorable phrase. The seeds were never hashes of anything. They were generator output, fed into the standard's hash step like any other arbitrary seed.
The tell was statistical. Written as five 32-bit words, four of the ten prime-curve seeds examined had a zero in the top bit of every word, a pattern Anthropic puts at about 1 in 5,810 by chance. That is the fingerprint of lrand48, which returns only the top 31 bits of its 48-bit internal state, leaving the top bit of every word clear. Recovering the internal state of a truncated linear congruential generator from partial outputs is a textbook lattice problem, and the model solved it with LLL basis reduction, running the solver over every window of bits. It then stepped each generator backwards to its starting state, and found a clock reading every time. Anthropic's reported time for the whole investigation: under half an hour.
What would settle it, and what does
A claim like this lives or dies on reproduction — and the reproduction has now been done twice, in two different codebases. Anthropic published Python code that regenerates all five NIST prime-curve seeds, the five ANSI example seeds, and the four binary-curve seeds that fit the halved-clock reading. On 16 October, Filippo Valsorda, the cryptographer who organised the seeds bounty, said he had reimplemented the algorithm in Go to verify the claim, and confirmed it. That independently supports the reconstruction of the published seeds. It does not establish every historical selection criterion, and it does not explain the curves' base points. Checking the arithmetic is the easy part; recovering the full 1997 decision process is harder.
Two limits belong in the same paragraph as the result. The model is internal and unnamed, so this is a demonstration of what a research system did on a checkable problem, not a capability a customer can buy today. And the cleanest version of the story — that a boring generator leaves no room for a hidden weakness — is an argument, not a proof. Anthropic's version of it is arithmetic: so few viable candidates were skipped that picking deliberately weakened curves that way would require weak curves to be common and easy to find, which 25 years of scrutiny have not shown. Valsorda goes further. A technique described by Daniel Bernstein and Tanja Lange in 2017 would have needed roughly 70 bits of freedom in seed selection to target a hypothetical class of weak curves; the reconstructed process, he calculates, offers barely 30 bits even on generous assumptions — not enough to target such a class or embed a backdoor. Both are technical arguments against specific suspicions. Neither is proof that every conceivable weakness has been ruled out.
The parts still missing
The post closes some questions and leaves a precise list of open ones. The B-163 binary-curve seed fits nothing the model tried. Four binary curves fit only if the clock was halved: their recovered starting values read directly as February 1984 timestamps, and doubling them lands on 17 April 1998. Anthropic proposes the original program may have halved the clock; that is an inference from the numbers, not a confirmed fact about the software.
Valsorda's independent pass narrowed the skipped-candidate question. He identified an additional apparent rejection rule: a candidate was discarded when the bit length of the resulting curve's order exceeded the bit length of the field it sits in. That accounts for some of the omissions that puzzled Anthropic. It does not account for all of them — a second undocumented criterion remains unidentified, leaving roughly twice as many acceptable seeds as were ever published. The reconstruction explains the generator and many accepted seeds. It does not recover the complete original selection procedure.
Claude also traced the base point of P-192, and of five older ANSI example curves, to the generator inside an arithmetic library called FreeLIP, seeded with small integers. The base points of P-224, P-256, P-384 and P-521, the points most of the web's signatures actually depend on, remain unexplained.
None of that changes what a user should do, which is nothing. Anthropic says so in plain terms, and on this point the finding supports it: learning how a parameter was generated in 1997 does not create an attack on the curve in 2026. What it removes is a specific, long-running suspicion, that unexplained numbers must have been chosen for a hidden reason. Sometimes the unexplained number is just what the clock said.
Sources
- [1] Anthropic, "Claude reveals ECDSA curve origins", Frontier Red Team research post, 16 October 2026 (primary: original research, reproduction code, open questions)Read source
- [2] Filippo Valsorda, "The NIST Elliptic Curves Seeds Bounty Has Been Claimed", 16 October 2026 (primary: independent Go reproduction, bounty confirmation, selection-rule analysis)Read source
- [3] Filippo Valsorda, "Announcing the $12k NIST Elliptic Curves Seeds Bounty" (bounty terms and background)Read source
- [4] NIST, FIPS 186-2 Digital Signature Standard, 27 January 2000 (curve list and seed parameters, referenced by Anthropic)Read source