One of the most widely used elliptic-curve signature standards, ECDSA, has carried an open question for a quarter century: where did the "seed" constants behind the NIST standard curves come from? In October 2026, Anthropic's research page finally answered it — Claude found the answer in under half an hour, and it is almost embarrassingly ordinary: a 1997-era machine running the C library's lrand48 random number generator, seeded with a Unix timestamp.
A 25-Year-Old Question
ECDSA was adopted by NIST in 2000 as part of the FIPS 186-2 Digital Signature Standard. For each curve, the specification published a "seed" parameter whose hash defines the curve's coefficient. The problem: those seeds were provided by the NSA with no explanation of how they were generated. For P-256, the seed is C49D3608 86E70493 6A6678E1 139D26B7 819F7E90, and nobody knew its origin.
Cryptographers suspected for decades that the NSA might have deliberately chosen curves with backdoors. NSA employee Jerry Solinas said in 2015 that the seeds came from the hash of a humorous passphrase along the lines of "Give Bob and Jerry a raise." He died in 2023, no archives could be found, and the trail went cold. The community even posted a $36,864 bounty. Anthropic employees had chased the passphrase idea and came up empty.
Claude Took a Different Angle
In October 2026, an Anthropic employee asked an internal research model to work it out without being pointed at any clue. Claude's move was to stop guessing phrases and instead reason about how 1990s curve-generation software would have been written: programs of that era almost certainly used the pseudo-random number generator shipped with C libraries, and old PRNGs are weak enough that their output is statistically recognizable.
Claude wrote a scanner that slid along each published seed one bit at a time, testing whether adjacent chunks were consecutive outputs of a 1990s-vintage generator — 34 combinations in total. The breakthrough was a pattern visible by eye: the top bits of some seeds were all zero, which would happen by chance with probability 1/5,810. That is the signature of lrand48, which only returns the top 31 bits of a 48-bit state. Claude then brute-forced all 2^17 values of the 17 hidden bits for the first word and checked that the next four words followed — it worked for all four seeds. The prime-curve seeds kept even fewer bits, and recovering the internal state became a textbook lattice problem, solved with LLL basis reduction.
The decisive step was running the generator backwards: lrand48 inverts as easily as it advances. When each state stepped back to the form srand48 would initialize, all ten prime-curve seeds decoded to Unix timestamps between May 1997 and April 1998. P-256's seed was candidate number 1,842 under its timestamp, 20 bytes per candidate — and today anyone can reproduce it byte-for-byte with the few dozen lines of Python Anthropic published.
Not a Break — an Acquittal
To be clear: this is not a cryptographic break, and the ECDSA curves are unharmed. If anything, it weakens the NSA-backdoor theory considerably — the seeds came from a weak, reproducible PRNG initialized from the system clock, leaving far less room for subversion. The team also explained half of the base-point mystery: the base points of the six curves generated in May 1997 (P-192 plus five ANSI X9.62 example curves) came from the random number generator inside FreeLIP, Arjen Lenstra's big-integer library, with generator seeds as small as 20000 and 20420.
Loose ends remain: the base points of P-224/256/384/521 are still unexplained, the binary seed B-163 fits nothing tried so far, and P-256's run skipped candidate 876, which would also have produced a viable curve — the selection criteria are unknown. The $36,864 bounty will be donated to the Internet Security Research Group.
So What
The real story here is not a cryptography incident but a display of research taste by an AI model: knowing to abandon the rumor-driven direction, reasoning from the engineering context of the era, and — in its own internal thinking — first suspecting it might be inside a simulated test environment, then convincing itself with the 160-bit match. When models start doubting results that look too good, 25-year-old open questions may just start falling one by one.
Reference: Anthropic research page