Anthropic says Claude traced the NSA's mystery NIST curve seeds to a 1997 clock

The NSA's unexplained numbers behind the web's most common signature curves turn out to be a 1990s random generator and the time of day.

By Think Facility · October 17, 2026 · Anthropic AI safety

On October 16, 2026, Anthropic said one of its internal research models had worked out where the seeds behind the NIST elliptic curves came from. NIST published those curves in 2000, and the seeds the NSA supplied for them came with no explanation at all.

The answer is a clock. Anthropic's Frontier Red Team says each seed is plain output from lrand48, a random number generator in the standard C library, started from a Unix timestamp between May 1997 and April 1998. The model found it "In under half an hour", according to the team's post.

Who: John Wood, Nicholas Carlini, Steve Weis and seven other Anthropic staff
Curves: NIST P-192, P-224, P-256, P-384 and P-521
Generator: lrand48, seeded with a Unix timestamp
Timestamps: between May 1997 and April 1998
Bounty: $36,864, donated to the Internet Security Research Group

What was the mystery?

ECDSA runs on a short list of standard curves. Part of each curve is made by hashing a 20-byte seed, which was supposed to show that nobody hand-picked it. But the seeds themselves arrived from the NSA with no account of how they were made, and some people suspected they hid a backdoor.

The story told for years was that Jerry Solinas, a longtime NSA employee, had hashed a joke sentence and then lost it. He died in 2023. That October, Filippo Valsorda put up a bounty for anyone who could recover the inputs, and a group of cryptographers chipped in to fund it.

How did Claude find it?

Anthropic says several of its own employees had already chased the joke-sentence lead and got nowhere. Then, in October 2026, one of them asked the model how the seeds were made, without pointing it at that clue.

It went after the software instead. It guessed the 1990s program used a weak generator that shipped with C libraries, whose output can be recognized, and wrote a scanner to look for one. Four of the seeds had a zero in the top bit of every 32-bit word, which fits lrand48 (it only hands back 31 bits of its state). Recovering the rest was a textbook lattice problem. Since this generator runs backwards as easily as forwards, stepping each state back landed on a timestamp.

Anthropic printed what the model was thinking at the moment the numbers matched. This is the line I'd point people to: it stopped to ask whether the result was real.

Let me be skeptical: am I in some sort of simulated/test environment?

From Claude reveals ECDSA curve origins \ Anthropic

It settled that by computation. Each recovered state regenerates all 160 bits of its seed, and the post includes a few dozen lines of Python that print every seed from its timestamp, so anyone can rerun it. The model also traced the base points of six curves made in May 1997 to the random generator in FreeLIP, Arjen Lenstra's arithmetic package. Anthropic says no NIST base point had been explained before.

What the bounty's organizer said

Valsorda wrote on his own blog on October 16 that the Anthropic team claimed the full bounty on October 15. They gave it to ISRG, the non-profit behind Let's Encrypt, which tripled it to $36,864. He reimplemented the algorithm in Go to check the claim. (His post calls the generator drand48 where Anthropic's says lrand48; both have it started by passing the time to srand48.)

The part that matters to him is the math on freedom. In 2017, Daniel Bernstein and Tanja Lange described a way an agency with 70 bits of choice over a seed could aim at a hypothetical class of weak curves. Valsorda says that even allowing any timestamp in 1997 and 1998 and any of the first 16 candidates, the NSA had barely 30 bits.

Not enough to intentionally target a hypothetical small class of weak curves, not enough to embed any kind of NOBUS backdoor.

From The NIST Elliptic Curves Seeds Bounty Has Been Claimed

He now says he'd personally recommend the NIST curves over Curve25519, then adds that this comes "Just in time for them to be retired in favor of post-quantum signatures."

What's still unexplained

Not every viable candidate was used. P-256's published seed is candidate 1842 from its run, but candidate 876 would have made a valid curve too. Valsorda counts roughly twice as many valid seeds as were published and says he found no good fit for why. Anthropic says the skips are too few to make picking a weak curve plausible.

One binary-curve seed, B-163, fits nothing Claude tried. Nobody has explained the base points of P-224, P-256, P-384 and P-521 yet either.

Who uses these curves

These aren't obscure curves. In his 2023 bounty post, Valsorda wrote that P-256 and P-384 are in the US government's Commercial National Security Algorithm Suite and are the curves in the ECDSA certificates "that secure much of the web". So the question was never academic. It was about whether the certificates behind ordinary websites rested on numbers an intelligence agency could have chosen.

Nothing changes for anyone running them, and Anthropic is plain about that: "There is no action to be taken or things to do differently." Nobody needs to rotate a key or replace a certificate. What changes is the argument. A suspicion that sat on the web's signatures for 25 years now has a reproducible answer that anyone with Python can check.

It also says something about where AI research help is landing. Human cryptographers had an open bounty on this for three years, and Anthropic's team got the answer from a model in one sitting. A different story this week ran the same direction: PostgreSQL developers pulled 8 to 10 features after AI-assisted review turned up defects faster than they could fix them.

Valsorda says he's making stickers of the srand48() seeds, and T-shirts for the Anthropic team and the people who funded the bounty.