The Pulse
Claude Traces NIST’s Prime-Curve Seeds to Unix Timestamps
Anthropic says Claude traced the origins of NIST’s five prime-field ECDSA curve seeds to a 1990s random-number generator initialized with Unix timestamps. The finding explains those seeds’ provenance but leaves the B-163 seed and several cu
AI.info Team · Written with AI ·
“I believe there was a counter rather than multiple hashing, but I don’t know details.”
Jerry Solinas, 2015
That recollection pointed cryptographers toward a passphrase. Anthropic says Claude instead traced the origins of NIST’s five prime-field ECDSA curve seeds to a much less elaborate source: the lrand48 pseudorandom-number generator, initialized with Unix timestamps. The finding, published October 16, 2026, addresses a question left open since the curve parameters appeared in NIST’s 2000 Digital Signature Standard.
The result explains how those seeds were generated; it does not show that ECDSA was compromised. Anthropic says there is no action users need to take, and that the evidence makes intentional backdoors in the curves less plausible. But the work does not account for every related seed or parameter.
The passphrase theory led nowhere
NIST published seed values for elliptic curves in its standard without explaining how they were chosen. The values help define the curves’ parameters, and their undocumented origins fueled speculation that the NSA might have selected them to create a hidden weakness. Jerry Solinas, who worked on the curves and died in 2023, had recalled a possible humorous phrase involving “Bob and Jerry,” but neither he nor colleagues could recover the exact wording.
The unanswered question became a public challenge. In 2023, cryptographer Filippo Valsorda announced a $12,288 cash bounty for finding the inputs behind five prime-curve seeds; the award could rise to $36,864 if the recipient donated it to charity. Anthropic says the full $36,864 will go to the Internet Security Research Group.
Claude recognized a 1990s generator
Rather than continue guessing phrases, Claude considered what software from the period might have produced the values. Anthropic says it wrote a scanner to test adjacent chunks of the published seeds against output from 34 combinations of older random-number generators and output slices. A pattern in the top bits of some values pointed to lrand48, a linear congruential generator whose output exposes only 31 bits of its 48-bit internal state.
Claude recovered that state and checked whether it generated the published values. For the prime-field seeds, the matching output used the same pattern—lrand48() >> 23—across five NIST curves and five additional curves from the ANSI X9.62 standard. Each recovered 48-bit state reproduced all 160 bits of its seed, Anthropic says.
Working backward through the generator brought the states to initializations in the form produced by srand48. The ten prime-curve timestamps fall between May 1997 and April 1998. For four binary-field seeds, the recovered values point to April 17, 1998, if the clock readings were halved; Anthropic says the fifth, B-163, remains unexplained.
The result does not reveal a cryptographic break
NIST’s 2000 standard included ECDSA among its approved digital-signature algorithms and listed recommended elliptic curves. The provenance question mattered because the curves’ published parameters arrived without a documented generation process, not because the seed values themselves gave anyone a way to forge signatures. Anthropic characterizes its result as a historical explanation, not a new attack or weakness.
The discovery also reaches beyond the seeds. Anthropic says Claude traced the base points of six curves—including P-192 and five ANSI example curves—to a separate random-number generator in FreeLIP, an arithmetic package. That recipe uses small integer seeds, discards seven outputs, and tests candidate coordinates until one lies on the curve.
Some choices still have no explanation
The researchers could not reproduce the base points for P-224, P-256, P-384 or P-521 with the FreeLIP method, and say the NIST binary-curve base points also remain unexplained. They also found that some candidate seeds that could have produced viable curves were skipped, including an earlier candidate in the P-256 run. Anthropic says it does not know why those candidates were passed over or whether the pattern was unintentional.
The company argues that the small number of skipped candidates does not make intentional selection of weakened curves plausible. Its results instead narrow the uncertainty: timestamps and a familiar C-library generator explain the prime-curve seeds, while B-163 and several base-point choices remain open questions. The bounty’s charitable payout is the concrete end to the search for the five prime-curve seed origins.