Anthropic’s Claude Traces a 26-Year NIST Curve-Seed Riddle

Anthropic said on 16 October 2026 that Claude traced the seeds behind NIST’s standard elliptic curves, used by the ECDSA signature standard, to an ordinary random-number generator: “None of them were the results of any hash algorithm at all, but rather the output of the C library’s lrand48 random-number generator, seeded with a Unix timestamp!”

The seeds were published when NIST adopted ECDSA in 2000 as part of FIPS 186-2, Anthropic says, which makes the question 26 years old by our arithmetic. According to the post, Claude found the origins of the P-192, P-224, P-256, P-384 and P-521 seeds “In under half an hour”, and Anthropic says the finding “makes us more confident the curves were chosen without any backdoors or intentional weaknesses.”

Business Pill · THE AI AUDIT PROBLEM

A one-minute explainer of the AI audit problem: what happens when making work becomes cheaper than checking it. It teaches the general idea only and says nothing about any company in this story.

What Anthropic Reported

For curves over prime and binary fields, the standard published a “seed” parameter whose hash defines one of the curve’s coefficients, Anthropic explains. “The provenance of these seeds has been a long-standing question, as they were provided by the NSA with no explanation or justification.”

The best-known account came from Jerry Solinas, a longtime NSA employee, who said in 2015 that the seeds were hashes of a humorous phrase, “along the lines of ‘Give Bob and Jerry a raise’ or ‘Bob and Jerry rule’ or something like that.” Anthropic notes that Solinas died in 2023 and that colleagues from the time were not responsive.

Several Anthropic employees had chased that tip without success, the post says. “In October 2026, a curious Anthropic employee asked an internal research model if it could figure out how those seeds were generated without pointing at the clue.”

What Was Posted on X

Yuchen Jin posted on 16 October that Claude solved a 25-year-old cryptography mystery in under 30 minutes, and argued that problems with huge search spaces but cheap verification suit AI agents. The 25-year framing is his; our count above runs from the 2000 adoption of FIPS 186-2.

How Claude Found the Seeds

Claude guessed the software used a pseudorandom number generator that shipped with 1990s C libraries, Anthropic says, because such generators are weak enough that their output can be recognised. It wrote a scanner that tested whether adjacent chunks of each seed were consecutive outputs of one, covering 34 combinations of generator and output slices.

Four of the ten seeds showed a zero in the top bit of all 20 words, which Anthropic says “would happen by chance with probability 1/5810” and is a signature of lrand48. For the prime-curve seeds, which kept fewer bits of each output, Claude recovered the generator’s state with a lattice method, the LLL algorithm, according to the post.

Stepping each recovered state back to where srand48 would have initialised it gave the clock time it was seeded with, the post says. “However, for the ten prime-curve seeds, every srand48 initialization was a Unix timestamp representing a date between May 1997 and April 1998.” The post adds that P-256 required 1842 iterations to output the standardized seed.

What It Does and Does Not Mean

Anthropic is explicit about the scope: “This is not a cryptographic break, new attack, or weakness in the ECDSA curves.” On the backdoor suspicion, it says “These findings make that much less plausible”, because the seeds came from a common generator initialised from the clock, “which anyone can now reproduce.”

The post also lists what remains open. For P-256, it says the published seed is candidate 1842, but candidate 876 of the same run also gives a viable curve, and “We do not know what criteria may have been used, or whether this was an unintentional artifact.” The binary seed B-163 “remains unexplained”, as do the base points of P-224, P-256, P-384 and P-521.

Anthropic says it also traced the base points of six curves generated in May 1997 to the random-number generator in FreeLIP, Arjen Lenstra’s long-integer arithmetic package. “As far as we know, no NIST base point has been explained before.”

The Bounty and the Team

Filippo Valsorda announced a bounty for the seeds on 5 October 2023, offering $12,288, “tripled to $36,864 if the recipient chooses to donate it to a 501(c)(3) charity of their choice.” Anthropic says “The $36,864 for finding the seeds will be donated to the Internet Security Research Group.”

The post lists ten Anthropic authors, among them Nicholas Carlini and Steve Weis. Valsorda’s announcement thanked Weis for the research that inspired the bounty. Earlier today we wrote about Claude designing more efficient quantum circuits, and earlier this month about OpenAI’s internal model producing 722 math manuscripts.

The Structural Read

As we read it, the clue that had stalled people was the wrong one: Anthropic says several of its employees had chased the humorous-phrase tip without success, and Claude instead anticipated how 1990s software would have generated the numbers.

As we read it, the evidence is checkable by anyone: Anthropic says each recovered 48-bit state regenerates all 160 bits of its seed, and the post publishes the timestamps and candidate numbers for each curve.

As we read it, the post keeps the open questions in view: Anthropic says it does not know why candidate 1842 was published for P-256 when candidate 876 also gives a viable curve, and B-163 and four base points remain unexplained.

Three Implications

SECURITY TEAMS USING P-256 AND P-384 Anthropic says readers should take this as a fun closing chapter and that there is no action to be taken or things to do differently.

CRYPTOGRAPHY STANDARDS BODIES Anthropic says the seeds were provided by the NSA with no explanation or justification; the post now shows they came from a common generator initialised from the clock, which anyone can reproduce.

AI LABS AND RESEARCH GROUPS Anthropic says Claude found the five NIST prime-curve seed origins in under half an hour after a staff member asked without pointing at the clue; the $36,864 bounty goes to the Internet Security Research Group.

The Business Engineer Lens

This story maps onto the Business Engineer framework The Agentic Harness War.

The framework argues: “Universal harnesses are likely to dominate highly digital, modular, and verifiable work”.

As we read it, this result fits that description: the seeds are numbers, the hypothesis can be written as code, and a 160-bit match settles each one. The framework predates the announcement and does not discuss cryptography.

What Is Not Established

Anthropic says it does not know what criteria were used to pick the published seeds from the viable candidates, and that nothing in the numbers shows how many runs there were.

We read Anthropic’s research post and Valsorda’s bounty announcement on 16 October 2026 and ran the reproduction code Anthropic published, which outputs the published P-256 seed. We did not contact Anthropic, NIST or the NSA.

The Bottom Line

Anthropic said on 16 October 2026 that Claude traced the NIST elliptic-curve seeds, published with the ECDSA standard in 2000, to the lrand48 random-number generator seeded with Unix timestamps from 1997 and 1998, a search the post says took under half an hour.

Anthropic says this is not an attack on the curves and makes a deliberate backdoor much less plausible; it lists the B-163 seed, some base points and the choice among viable candidates as still unexplained.