For 25 years, some of the most important numbers in cryptography came with no explanation. This week, an AI model supplied one in under half an hour. Anthropic’s Frontier Red Team reported on October 16 that an internal Claude research model had traced the origins of the seeds behind the National Institute of Standards and Technology’s ECDSA curves to lrand48, a pseudorandom number generator from the C standard library, seeded with nothing more exotic than the time on a 1990s clock.
The finding is not a break of ECDSA, and Anthropic is explicit that readers have nothing to patch or change. It is something rarer: the closing of a provenance question that had fed backdoor suspicions since the standard was published.
Why the seeds were suspect
NIST adopted ECDSA in its FIPS 186-2 digital signature standard in 2000. For each standard curve, the specification published a seed — a string of bytes whose hash defines a coefficient of the curve. The seeds were supplied by the National Security Agency, with no explanation of where they came from.
That silence mattered. A seed generated by quietly searching for a weak curve would look much like any other seed, so the unexplained values left room for doubt. The leading account came from longtime NSA mathematician Jerry Solinas, who said in a 2015 statement that the seeds were probably the hash of a humorous passphrase along the lines of “Give Bob and Jerry a raise.” Solinas died in 2023, no archives from the period were found, and, according to Anthropic, the passphrase account turned out to be wrong.
Attacking the generator, not the phrase
Anthropic says several of its employees had chased the seeds without success. In October, an employee instead asked an internal Claude research model to work out how the seeds were generated, without pointing it at the rumored clue. In under 30 minutes, the model identified the origins of the seeds for the P-192, P-224, P-256, P-384 and P-521 curves.
The model’s approach started from the software of the era. It tested 34 combinations of period pseudorandom generators and output slices against the published seeds. One pattern stood out: written as five 32-bit words, four of the ten prime-curve seeds have a zero in the top bit of every word — an arrangement Anthropic puts at roughly 1-in-5,810 odds by chance. That is the fingerprint of lrand48, which returns only the top 31 bits of a 48-bit internal state.
For those four seeds, Claude recovered the generator state by trying all 217 possible values of the hidden bits and checking that the following words matched. The prime-curve seeds retained fewer bits from each call — the construction took lrand48() shifted right by 23 — so reconstructing their states became a lattice problem, which the model solved with Lenstra–Lenstra–Lovász reduction. Each recovered state, Anthropic says, regenerates all 160 bits of its seed.
Running the generator backward reached the initialization: a Unix timestamp. The P-256 seed — C49D3608 86E70493 6A6678E1 139D26B7 819F7E90 — was candidate 1,842 in a run that began on August 16, 1997. All ten prime-curve initializations, covering the five NIST curves and five ANSI X9.62 example curves, fall between May 1997 and April 1998. No hash algorithm was involved.
A second mystery, partly solved
The same work explained some curve base points — the fixed reference points from which every ECDSA public key is derived — which the recovered seeds do not determine. For P-192 and five ANSI X9.62 example curves generated in May 1997, Anthropic says the base points trace to the random generator in FreeLIP, Arjen Lenstra’s long-integer arithmetic package, seeded with small integers such as 20000 for P-192, with seven outputs discarded before drawing candidate coordinates. Anthropic says no NIST base point had been explained before. The base points of P-224, P-256, P-384 and P-521 remain unknown.
What remains open
Anthropic’s assessment is that a common generator initialized from the clock — a process anyone can now rerun, using reproduction code the team published — leaves much less room for a deliberately planted weakness. Cryptographer Filippo Valsorda, who organized the bounty for the seeds, reported separately reproducing the generation process, and Anthropic says the $36,864 bounty will be donated to the Internet Security Research Group, the nonprofit behind Let’s Encrypt.
Loose ends remain. Some candidates that would have produced usable curves were skipped: P-256’s candidate 876, from the same run, also yields a prime-order curve of the right size, and Anthropic says it does not know why the later candidate was used — though with so few skips, it considers deliberate selection of weakened curves implausible. And one seed, for the binary curve B-163, matched nothing the model tried. The 25-year question, though, finally has an answer mundane enough to check for yourself.
