Anthropic Claude solves 25-year-old mystery of NIST ECDSA curve origins

The decades-old mystery surrounding the origins of NIST elliptic curve seeds has been resolved. Anthropic researchers have determined that the seeds for the P-192, P-224, P-256, P-384, and P-521 curves were not derived from complex hashes or malicious backdoors, but were instead generated using the lrand48 pseudorandom number generator (PRNG) found in 1990s C libraries, initialized with simple Unix timestamps.

Discovery via AI-Driven Analysis

In October 2026, an internal Anthropic research model successfully identified the generation method in under 30 minutes. Rather than pursuing the long-standing rumor that the seeds were hashes of a humorous passphrase, the model hypothesized that the software used a common 1990s-era PRNG. By scanning for signatures of the lrand48 generator—specifically identifying patterns in the top bits of the seeds—the model was able to recover the initialization states.

These states mapped directly to Unix timestamps from 1997 and 1998. The model further confirmed its findings by reproducing the published seeds exactly using the recovered timestamps and the lrand48 algorithm. This discovery provides a definitive, non-malicious explanation for the provenance of these parameters, which have been the subject of intense scrutiny and conspiracy theories since their adoption in FIPS 186-2.

Implications for Cryptographic Security

This finding confirms that the NIST curves were likely chosen without intentional backdoors, strengthening confidence in their security. For years, the lack of transparency regarding how these seeds were chosen led to speculation that the NSA might have embedded weaknesses into the standards. The revelation that the process relied on a simple, reproducible PRNG approach—rather than a hidden, sophisticated selection process—renders these theories largely obsolete.

Anthropic emphasizes that this is not a cryptographic break or a vulnerability. Users should continue to use the curves as they have, as the findings confirm the parameters are secure and were not the result of subversion.

Unresolved Questions

While the primary seeds were identified, some aspects of the NIST curve generation remain unexplained:

• Skipped Candidates: The generation process skipped several potentially viable curves. It remains unclear if this was an intentional selection process or an artifact of the generation script.
• B-163 Seed: The fifth binary curve seed, B-163, does not match the identified pattern and remains an open question.
• Base Point Origins: While the model successfully identified the source of base points for several curves (using the FreeLIP library), the origins of the base points for P-224, P-256, P-384, and P-521 remain unknown.

Community and Industry Reaction

The cryptographic community has largely viewed this as a definitive end to a long-standing debate. Commenters on Hacker News noted that the discovery effectively "devastates" a generation of conspiracy theories.

"This is devastating news... for an entire generation of NIST cryptography conspiracy theories." — @tptacek

Others reflected on the irony of the "tinfoil hat" theories compared to the mundane reality of the implementation.

"13 years of tinfoil hats for srand48(time(NULL)" — @sweis

Anthropic has donated the $36,864 bounty, originally established by Filippo Valsorda and others to solve this mystery, to the Internet Security Research Group (ISRG). The code used to reproduce the seeds and base points has been released into the public domain under a CC0 1.0 license.