Anthropic Red Team Solves 25-Year Mystery of NIST ECDSA Elliptic Curve Seeds

The Three-Question Framework

What Happened?

On October 16, 2026, Anthropic's Frontier Red Team reported that Claude discovered the generation mechanism behind the standardized NIST elliptic curve seeds (including P-192, P-224, P-256, P-384, and P-521) in under half an hour, proving they were outputs of the standard C library pseudorandom number generator lrand48 seeded with Unix timestamps between May 1997 and April 1998 rather than cryptographic hashes of secret passphrases.

Why It Matters

For twenty-five years since FIPS 186-2 was published in 2000, cryptographers questioned whether unexplained NSA-supplied curve seed constants concealed deliberate mathematical backdoors; confirming their origin in clock-seeded pseudorandom outputs provides definitive public evidence that the foundational curves securing global Internet communications were chosen without covert subversion.

What Could Happen Next

The $36,864 community bounty organized by cryptographer Filippo Valsorda has been claimed and will be donated directly to the Internet Security Research Group (ISRG), while researchers note the B-163 binary curve seed and four prime-curve base points remain mathematically unexplained.

Executive Key Takeaways

Claude identified that published NIST seeds contained all top bits set to zero across 32-bit words, an unmistakable artifact of 48-bit linear congruential generator lrand48.

Stepping the internal generator states backward revealed that each prime-curve seed began with srand48 seeded by a standard Unix timestamp dating from May 15, 1997 to April 3, 1998.

The standardized NIST P-256 curve seed was candidate 1842 drawn from an RNG state initialized at 1997-08-16 01:52:34 UTC.

P-192's base point and five ANSI X9.62 example curves were traced to Arjen Lenstra's FreeLIP arbitrary-precision arithmetic library initialized with small integer seeds.

Source: Anthropic Frontier Red Team research disclosure 'Claude reveals ECDSA curve origins' by John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini, and Steve Weis, alongside verification notes from cryptographer Filippo Valsorda, published October 16, 2026.

When NIST standardized elliptic curve digital signature algorithms in the FIPS 186-2 standard in 2000, the specification included 160-bit hexadecimal seed constants—such as P-256's SEED value C49D3608 86E70493 6A6678E1 139D26B7 819F7E90—without disclosing their mathematical provenance. For decades, the cryptographic consensus followed a recollection by former NSA mathematician Jerry Solinas suggesting the seeds were derived by hashing a humorous office phrase, leading to unsuccessful automated passphrase brute-force attempts.

Rather than testing wordlists, Claude evaluated candidate pseudorandom number generators that shipped with 1990s Unix C runtimes. A scanning tool testing 34 generator and bit-slice combinations revealed that four out of ten standardized seeds showed top-bit zeroes across all five 32-bit words, a signature that occurs by chance with probability one in 5,810 due to lrand48 returning only the high 31 bits of its 48-bit state. Claude recovered the full internal state using Lenstra-Lenstra-Lovasz (LLL) lattice basis reduction across truncated bit windows.

Running the linear congruential recurrences backward to their srand48 initialization states—marked by the lower 16 bits matching 0x330E—yielded exact chronological timestamps. The candidate iteration count for P-256 reached 1,842 steps, while P-192 required 139 iterations, P-521 required 1,136, and P-224 took 7,026 steps. Binary curves B-233, B-283, B-409, and B-571 mapped to an eight-minute burst on April 17, 1998 when adjusting for a halved clock value.

Base point investigations further recovered the origins of six curves generated in May 1997, showing their generator values were produced by Arjen Lenstra's FreeLIP package seeded with small integers including 20000 for P-192 and 20512 for prime192v2. However, the exact selection criteria that caused the NSA software to skip earlier valid prime-order candidate curves during generation—such as candidate 876 in P-256—as well as the derivation of seed B-163, remain unresolved.

The Three-Question Framework

What Happened?

Why It Matters

What Could Happen Next

Executive Key Takeaways

Primary Sources & Citations