Anthropic researchers report that Claude traced the origins of most NIST elliptic curve seeds to a simple random-number process, resolving a mystery that had prompted years of speculation. The work found that the seeds for NIST P-192, P-224, P-256, P-384 and P-521 came from the C library generator lrand48, initialized with Unix timestamps. Anthropic says this finding does not reveal a cryptographic break, attack or weakness in the ECDSA curves; the researchers say it makes deliberate backdoors less plausible.

In October 2026, an Anthropic employee asked an internal research model to investigate the seeds without giving it the rumored passphrase clue. Claude found their origins in under half an hour. NIST adopted ECDSA as part of the FIPS 186-2 Digital Signature Standard in 2000; the NSA had supplied the seed values without explaining how they were produced.

The process drew 20-byte candidates from lrand48, initialized using a Unix timestamp, until a candidate produced the standardized seed. P-256's published seed was candidate 1842. Claude scanned the published values one bit at a time, testing 34 combinations of generator and output slices. Four of ten seeds had a zero in the top bit of all 20 words, a pattern with a stated chance of 1/5810; Claude used it to identify lrand48 and recover hidden state bits.

For prime-curve seeds, the team used a lattice method called LLL to recover the generator's internal state from truncated outputs. Five NIST prime-curve seeds and five ANSI X9.62 example seeds matched lrand48() >> 23; each recovered 48-bit state regenerated all 160 bits of its seed. The ten prime-curve initialization times fell between May 1997 and April 1998. Four binary-curve initializations pointed to February 1984; doubling those timestamps mapped them to April 17, 1998, suggesting the program may have halved the clock.

Claude also traced the base points of six curves generated in May 1997 to the generator in FreeLIP, a long-integer arithmetic package. It identified seeds 20000 for P-192, 20420, 20507 and 20509 for prime239v1 to v3, and 20512 and 20517 for prime192v2 and v3. The researchers could not explain the base points for P-224, P-256, P-384, P-521 or the NIST binary curves.

Some viable candidate curves were skipped: one for P-256, three in P-224's run and seven across two ANSI X9.62 runs. The team said the small number does not make selection of weakened curves plausible, while acknowledging that timestamp searches could theoretically have selected a property; the data do not show how many runs occurred. The B-163 seed also remains unexplained. Anthropic said the $36,864 bounty for finding the seeds will go to the Internet Security Research Group.

Anthropic researchers report that Claude traced the origins of most NIST elliptic curve seeds to a simple random-number process, resolving a mystery that had prompted years of speculation. The work found that the seeds for NIST P-192, P-224, P-256, P-384 and P-521 came from the C library generator lrand48, initialized with Unix timestamps. Anthropic says this finding does not reveal a cryptographic break, attack or weakness in the ECDSA curves; the researchers say it makes deliberate backdoors less plausible.

In October 2026, an Anthropic employee asked an internal research model to investigate the seeds without giving it the rumored passphrase clue. Claude found their origins in under half an hour. NIST adopted ECDSA as part of the FIPS 186-2 Digital Signature Standard in 2000; the NSA had supplied the seed values without explaining how they were produced.

The process drew 20-byte candidates from lrand48, initialized using a Unix timestamp, until a candidate produced the standardized seed. P-256's published seed was candidate 1842. Claude scanned the published values one bit at a time, testing 34 combinations of generator and output slices. Four of ten seeds had a zero in the top bit of all 20 words, a pattern with a stated chance of 1/5810; Claude used it to identify lrand48 and recover hidden state bits.

For prime-curve seeds, the team used a lattice method called LLL to recover the generator's internal state from truncated outputs. Five NIST prime-curve seeds and five ANSI X9.62 example seeds matched lrand48() >> 23; each recovered 48-bit state regenerated all 160 bits of its seed. The ten prime-curve initialization times fell between May 1997 and April 1998. Four binary-curve initializations pointed to February 1984; doubling those timestamps mapped them to April 17, 1998, suggesting the program may have halved the clock.

Claude also traced the base points of six curves generated in May 1997 to the generator in FreeLIP, a long-integer arithmetic package. It identified seeds 20000 for P-192, 20420, 20507 and 20509 for prime239v1 to v3, and 20512 and 20517 for prime192v2 and v3. The researchers could not explain the base points for P-224, P-256, P-384, P-521 or the NIST binary curves.

Some viable candidate curves were skipped: one for P-256, three in P-224's run and seven across two ANSI X9.62 runs. The team said the small number does not make selection of weakened curves plausible, while acknowledging that timestamp searches could theoretically have selected a property; the data do not show how many runs occurred. The B-163 seed also remains unexplained. Anthropic said the $36,864 bounty for finding the seeds will go to the Internet Security Research Group.