Claude Solves the NIST Curve Seed Mystery: It Was Timestamps

§ 01The 25-year mystery#

ECDSA is the most widely used elliptic-curve signature standard. NIST adopted it in 2000 in FIPS 186-2, which lists a set of standard curves. For each curve it publishes a 160-bit seed, and the SHA-1 hash of that seed defines the curve’s coefficient b. The NSA supplied the seeds without saying how it made them. P-256’s seed is C49D3608 86E70493 6A6678E1 139D26B7 819F7E90.

That gap fed years of suspicion that the curves might hide a backdoor. Neal Koblitz and Alfred Menezes summed up the debate in A Riddle Wrapped in an Enigma. The best-known story came from Jerry Solinas, a longtime NSA employee. In 2015 he said the seeds were hashes of a joke phrase along the lines of “Give Bob and Jerry a raise”, but nobody could find the details. Solinas died in 2023. A public bounty of $36,864 stayed open for anyone who found the real origin, and Anthropic says several of its own employees chased the phrase theory without success.

§ 02What Claude found#

Each seed is one 20-byte candidate drawn from lrand48 after the generator was seeded with srand48(timestamp). The program drew 20 bytes at a time: candidate 1 is the first 20 bytes, candidate 2 the next 20, and so on. P-256’s published seed is candidate 1,842 of the run started at 01:52:34 UTC on August 16, 1997.

The four binary-curve times are a reading, not a certainty. Their starting values decode as February 1984, and only with the clock doubled do they land on April 17, 1998, two weeks after the P-224 run, so Anthropic suggests the program may have halved the clock. The same lrand48 runs also produced five example curves in the ANSI X9.62 standard (prime192v2, prime192v3 and prime239v1 to v3). We did not have that standard’s text, so we did not check those five.

§ 03How it was found#

Searches built on the joke-phrase rumor had come up empty, so Claude worked from the other end: what software would a 1990s team have used to make random bytes? Old C-library generators are weak enough that their output can be recognized. Claude wrote a scanner that slid along each published seed one bit at a time and tested whether neighbouring chunks were consecutive outputs of a 1990s generator, across 34 combinations of generator and output slice.

The tell was in the top bits. Written as five 32-bit words, four of the ten seeds have a 0 in the top bit of all 20 words. “That would happen by chance with probability 1/5810.” It is exactly what lrand48 produces, because it returns only the top 31 bits of a 48-bit state.

From there it was arithmetic:

• For those four seeds, Claude tried all 131,072 values of the 17 hidden bits in the first word and checked that the next four words followed.
• The prime-curve seeds keep fewer bits of each output (lrand48() >> 23), so recovering the state is a textbook lattice problem. Claude solved it with LLL basis reduction, run over every possible window.
• lrand48 runs backwards as easily as forwards, so Claude stepped each state back to the form srand48 sets, with the low 16 bits equal to 0x330E. That form turns up once every 65,536 steps by chance, but for all ten prime-curve seeds the value it held was a Unix timestamp between May 1997 and April 1998.

Each recovered 48-bit state regenerates all 160 bits of its seed, which does not happen by coincidence. Anthropic published the model’s reaction at the moment it saw the match: “This is astonishing: it solves the 25-year-old mystery.” It then spent several lines asking whether it was inside a test before concluding the result was real.

§ 04The base points too#

Every curve also has a base point, G: the fixed point every ECDSA public key is a multiple of. The seed does not determine it. While checking the seeds, Claude found that the base points of six curves made in May 1997 come from the random-number generator in FreeLIP, Arjen Lenstra’s long-integer package. The recipe: seed it with a small integer, throw away seven outputs, then draw candidate x-coordinates until one lands on the curve. “As far as we know, no NIST base point has been explained before.”

The base points of P-224, P-256, P-384 and P-521 do not fit this recipe.

§ 05What it means for ECDSA#

Anthropic is direct: “This is not a cryptographic break, new attack, or weakness in the ECDSA curves.” A clock-seeded generator that anyone can now rerun leaves little room for a hidden choice, so the finding makes a deliberate backdoor much less plausible. For anyone running ECDSA today: “There is no action to be taken or things to do differently.”

Three questions stay open:

• Skipped candidates. For P-256, candidate 876 of the same run also gives a usable prime-order curve, yet candidate 1,842 was published. P-224’s run passed over three such curves, and the ANSI runs seven more. Anthropic does not know the criteria, and argues that the small number of skips makes deliberately weakened curves implausible.
• B-163. “The fifth binary seed, B-163, fits nothing Claude has tried and remains unexplained.”
• The other base points. How the base points of P-224, P-256, P-384, P-521 and the binary curves were chosen is still unknown.

The $36,864 bounty goes to the Internet Security Research Group, the nonprofit behind Let’s Encrypt. Filippo Valsorda organized the bounty, and Anthropic credits the work to ten of its researchers, including Nicholas Carlini and Steve Weis.

§ 06Why it matters past cryptography#

This is the second result Anthropic published on October 16 in which Claude settled an open technical question; the same morning it showed Claude designing cheaper quantum circuits. The shape is the interesting part. People chased the wrong lead for years by guessing phrases. The model reasoned about what code could have produced the numbers, built a scanner and a lattice solver to test that, and handed back a result anyone can check: the code is public domain, and our rerun matched the 2000 standard on the first try.

That last step is the one most teams skip. A finding is only as good as the check behind it, which is why we reran the code against the original standard before writing a word.