Claude Cracks the 1997 Origin of the NIST Curve Seeds

One of cryptography’s longest-running small mysteries has an answer, and an AI model found it. In a post dated 16 October, Anthropic’s Frontier Red Team says an internal research model, which it calls Claude without naming a version, worked out how the seeds behind the NIST elliptic curves P-192, P-224, P-256, P-384 and P-521 were made. They are not the output of a hash, as long assumed, but of lrand48, the pseudorandom generator in the C library, seeded with a Unix timestamp from between May 1997 and April 1998. According to the post, Claude got there in under half an hour.

The curves were standardised in FIPS 186-2 in 2000 and still secure much of the web. Each one’s key coefficient is derived from a published 20-byte seed, which the NSA supplied without explaining. That gap fed years of suspicion that the agency might have chosen seeds to hide a weakness, summed up in Neal Koblitz and Alfred Menezes’s 2015 paper “A Riddle Wrapped in an Enigma”. The standing explanation was that NSA mathematician Jerry Solinas had hashed English sentences he later forgot; Solinas died in 2023, the year Filippo Valsorda put up a bounty for anyone who could reproduce the seeds.

How Claude found it

The employee gave the model no hint. Claude guessed that the seeds came from a weak 1990s generator and wrote a scanner to test 34 combinations of generator and output slice against them. It noticed that in four of the ten seeds the top bit of every 32-bit word was zero, a pattern the post puts at about 1 in 5,810 by chance, and one that fits lrand48, which returns only the top 31 bits of its 48-bit state. For those four it brute-forced the 17 hidden bits; for the prime-curve seeds, which kept fewer bits per output, it recovered the state with the LLL lattice-reduction algorithm. Running the generator backwards led to the starting form that srand48 sets, and from there to the timestamps. P-256’s published seed came after 1,842 iterations of its run. The binary-curve seeds decode to February 1984, which Anthropic reads as a halved clock value: doubled, it gives 17 April 1998, two weeks after the P-224 run.

The model also explained the base points of six curves from May 1997, P-192 and five ANSI curves, as coming from the random generator in Arjen Lenstra’s FreeLIP library, seeded with small integers such as 20000. The base points of P-224, P-256, P-384 and P-521 remain unexplained, as does the seed of the binary curve B-163.

What it means for the curves

Valsorda confirmed the result by reimplementing the procedure in Go. He records the claim at 01:07 UTC on 15 October and names the generator as drand48, a member of the same POSIX family. His conclusion goes further than Anthropic’s: with only about 30 bits of freedom in how the seeds were chosen, he says the findings “completely rule out” the technique described by Daniel Bernstein and Tanja Lange, which needed about 70 bits to steer a curve into a weak class. Anthropic is careful to call it neither a break nor a weakness in ECDSA, and says nothing needs to change.

Some of the puzzle is still open. The procedure turns up about twice as many valid curves as were published, Valsorda has identified one undocumented rule for rejecting candidates and says another still escapes him, and nobody yet knows why some runs skipped curves that would have qualified. The prize, tripled to $36,864, goes to the Internet Security Research Group, the nonprofit behind Let’s Encrypt. It was not Anthropic’s only elliptic-curve result that day: the company also published work in which Claude Mythos 5 designed cheaper quantum circuits for the curve arithmetic a quantum attack on this kind of cryptography would need.