Anthropic reports that Claude, an internal research model, worked out in under half an hour how the "seed" values behind the NIST elliptic curves were generated, a question open since ECDSA was adopted in FIPS 186-2 in 2000. None of the seeds came from a hash. They are output of the C library's lrand48 random number generator, initialized with a Unix timestamp. Anthropic calls this "a fun closing chapter," with no action for anyone to take: it is not a cryptographic break, new attack or weakness.
The mystery
For curves over prime and binary fields, the standard publishes a seed whose hash defines the coefficient b. The NSA supplied the seeds without explanation, for example P-256's C49D3608 86E70493 6A6678E1 139D26B7 819F7E90, which fed suspicions of a backdoor. The best story, from longtime NSA employee Jerry Solinas in 2015, was a hash of a joke passphrase like "Give Bob and Jerry a raise". Solinas died in 2023, and several Anthropic employees who chased that tip found nothing. A bounty for finding the seeds had stood open, organized by Filippo Valsorda, and Koblitz and Menezes' "A Riddle Wrapped in an Enigma" summarizes the controversy.
How Claude found it
An Anthropic employee asked an internal research model to work out the origin without the passphrase clue. Claude guessed the software used a weak 1990s C library generator whose output can be recognized, and wrote a scanner testing each seed, shifted one bit at a time, for consecutive outputs of such generators, across 34 combinations of generator and output slice.
- The tell: in four of the ten seeds, the top bit of all 20 32-bit words was zero, which happens by chance with probability 1 in 5,810. That matches
lrand48, which returns only the top 31 bits of a 48-bit state. Trying the 2^17 hidden bit values of the first word and checking that the next four followed recovered the state. - The prime curves: these keep fewer bits of each output (
lrand48() >> 23). Recovering the state of a truncated linear congruential generator is a textbook lattice problem, solved with LLL basis reduction. Claude ran it over every bit window, and all five NIST prime-curve seeds and five from ANSI X9.62 matched. Each recovered state regenerates all 160 bits of its seed. - The timestamps: stepping each state backwards to the form
srand48sets (low 16 bits0x330E) gave Unix timestamps between May 1997 and April 1998, such as P-256 at 16 August 1997 01:52:34 UTC. The binary-curve states read as February 1984, but doubled they land on 17 April 1998, two weeks after the P-224 run, so the program may have halved the clock. - Iterations: each iteration draws 20 bytes as a candidate seed. P-256's published seed is candidate 1,842 of its run.
The reproduction code in the post prints all 14 seeds; the P-256 value matches the published seed exactly. Claude's reasoning log includes a moment of doubt, wondering whether it was in a test environment, before concluding the 160-bit matches across ten seeds could not be coincidence.
Base points
The seed does not fix each curve's base point G. Claude also traced the six curves generated in May 1997 (P-192 and ANSI's prime192v2, prime192v3, prime239v1, v2 and v3) to the random number generator in Arjen Lenstra's FreeLIP package, also shipped in early Victor Shoup NTL versions. The recipe: seed with a small integer (20000 for P-192, 20420, 20507 and 20509 for the 239-bit curves, 20512 and 20517 for the other 192-bit ones), discard seven outputs, build candidate x-coordinates from 26-bit outputs reduced mod p, and repeat until x lies on the curve. The published code reproduces all six, in one to five tries. These are the first NIST-related base points explained.
What it means
Anthropic argues this raises confidence in the curves: the seeds came from a simple, reproducible generator seeded by the clock, which leaves little room for subversion. It also notes that nothing in the numbers shows how many runs the NSA made, and that some viable curves were skipped: P-256's run also passed over candidate 876, P-224's run three, and the two ANSI runs seven more. The criteria, or whether it was accidental, are unknown. Because few candidates were skipped, Anthropic does not find weakened curves plausible, since that would imply they are common and easy to find.
Unexplained: B-163's seed fits nothing Claude tried, and the base points of P-224, P-256, P-384, P-521 and the NIST binary curves are still unexplained.
The $36,864 bounty will be donated to the Internet Security Research Group. The work is credited to John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini and Steve Weis, with a nod to Solinas, who took being labeled an "evil Internet meme" with good humor. It adds to this blog's coverage of Claude in science, such as the nine-loop amplitude computation and the CRISPR-like enzyme discovery.