Anthropic’s Frontier Red Team reported in a research publication on October 16, 2026, that an internal Claude research model had traced the origins of the NIST ECDSA curve seeds to the C library’s lrand48 random-number generator seeded with Unix timestamps, answering a provenance question that had been open since the NSA supplied the values without explanation.
The Unexplained NSA Seeds
ECDSA is the most widely used elliptic curve cryptography standard. NIST adopted it in 2000 as part of the FIPS 186-2 Digital Signature Standard, which lists standard elliptic curves of varying sizes and security levels. For curves over prime and binary fields, the specification published a seed parameter whose hash value defines the coefficient b of the curve. The NSA provided those seeds with no explanation or justification, and the post reproduces the P-256 seed, C49D3608 86E70493 6A6678E1 139D26B7 819F7E90, as an example of a value published with no information about where it came from.
Neal Koblitz and Alfred Menezes summarized the controversy in the paper “A Riddle Wrapped in an Enigma,” and the question later drew an amateur investigation into the seeds’ origins and a bounty for whoever could find them. The leading account held that longtime NSA employee Jerry Solinas had generated the seeds as the hash of a humorous passphrase. In a 2015 statement reproduced in the post, Solinas recalled: “The message was along the lines of ‘Give Bob and Jerry a raise’ or ‘Bob and Jerry rule’ or something like that.” He said Bob Reiter wrote the code and that no archives from the period could be found. Solinas died in 2023, and other colleagues were not responsive, leaving the derivation question open.
How Claude Recovered the Seeds
Several Anthropic employees had unsuccessfully chased the seeds following the humorous-passphrase tip, which the post says turned out to be wrong. In October 2026, an Anthropic employee asked an internal research model whether it could figure out how the seeds were generated without pointing at the rumored clue. In under half an hour, Anthropic reports, Claude identified the origins of the NIST P-192, P-224, P-256, P-384, and P-521 seeds: outputs of the C library’s lrand48 random-number generator seeded with a Unix timestamp, with no hash algorithm involved. The generating program drew 20 bytes per iteration as a candidate seed, and the published P-256 seed was candidate 1842 of its run.
With phrase-based searches exhausted, Claude approached the problem from the generator side, hypothesizing software built on a pseudorandom number generator that shipped with 1990s C libraries, output weak enough to be recognizable. Its scanner advanced bit by bit along each published seed, testing adjacent chunks as potential consecutive outputs of a 1990s-vintage generator across 34 combinations of generator and output slices. Across the seeds, one pattern stood out: written as five 32-bit words, four of the ten have a zero in the top bit of all 20 words, an arrangement occurring by chance with probability 1/5810. That pointed to lrand48, a linear congruential generator that returns only the top 31 bits of a 48-bit state. For those four seeds, Claude recovered the generator state by trying every one of the 2^17 possible values of the first word’s 17 hidden bits and verifying that the next four words followed, which succeeded for all four.
The prime-curve seeds had been produced by the same lrand48 generator, though each output retained fewer bits. Reconstructing the internal state of a truncated linear congruential generator is a textbook lattice problem, which Claude solved with Lenstra–Lenstra–Lovász (LLL) basis reduction, applying the solver to every possible window. All five NIST prime-curve seeds, plus five more from the ANSI X9.62 standard, matched the same pattern, lrand48() >> 23, and each recovered 48-bit state regenerates all 160 bits of its seed.
The post also reproduces Claude’s recorded internal reasoning from the session, in which the model checked whether it might be operating inside a simulated test environment before concluding: “It’s verified by direct computation on my side: 160-bit match from a 32-bit seed + small index: no chance coincidences (10 × 160 bits). It’s real.”
Timestamps and Base Points
Because the generator runs backward as easily as forward, Claude ran each seed’s state back until it reached an srand48 initialization state, recognizable by low 16 bits equal to 0x330E, a form that arises once every 65,536 steps. For all ten prime-curve seeds, the initializations were Unix timestamps falling between May 1997 and April 1998. The four binary-curve initializations instead read as February 1984; doubling those timestamps maps them to April 17, 1998, two weeks after the P-224 run, which led the team to suggest the program may have halved the clock.
Claude also identified where some curve base points came from. Each curve specifies a base point G, the fixed point of which every ECDSA public key is a multiple, and the recovered seed does not determine it. For the six curves generated in May 1997 — P-192 plus the ANSI X9.62 example curves prime192v2, prime192v3, and prime239v1 through v3 — the base points trace to the random number generator in FreeLIP, Arjen Lenstra’s long-integer arithmetic package, whose code also shipped in early versions of Victor Shoup’s NTL library. Under that recipe, the generator is seeded with a small integer, seven outputs are discarded, candidate x-coordinates are drawn from 26-bit outputs reduced mod p, and the draw repeats until x falls on the curve. The generator seeds Claude identified are 20000 for P-192; 20420, 20507, and 20509 for prime239v1 through v3; and 20512 and 20517 for prime192v2 and v3. Anthropic states that, as far as it knows, no NIST base point has been explained before, and the base points of P-224, P-256, P-384, and P-521 do not fit this recipe.
Security Assessment and Open Questions
Anthropic states that the findings do not represent a cryptographic break, a new attack, or any weakness in the ECDSA curves. The team said the seeds had been produced by a common pseudorandom number generator initialized from the clock, a method anyone can now reproduce, which in its view leaves much less room for subversion and increases confidence that the parameters are secure. The post frames the result as a closing chapter and the end of years of speculation, telling readers there is no action to take because most researchers already trusted the curves.
Some questions remain open. Not every 20-byte candidate seed could produce a viable curve, and the team observed that some potentially viable candidates were skipped. P-256’s published seed is candidate 1842, but candidate 876 from the same run also produces a prime-order curve of the right size, with parameters chosen the same way as the published curve’s. P-224’s run skipped three such candidates, and the two runs behind the ANSI X9.62 example curves skipped seven more. Because the number of skipped candidates is small, the team said it does not consider the selection of weakened curves plausible, though it remains conceivable in principle that curves with a specific property could have been chosen by searching over timestamps. One seed resisted recovery entirely: the fifth binary seed, B-163, matches nothing Claude tried. The base points of P-224, P-256, P-384, and P-521, along with those of the NIST binary curves, are still unknown.
The $36,864 bounty for finding the seeds will be donated to the Internet Security Research Group, and the post thanks Filippo Valsorda for organizing the bounty while posthumously recognizing Solinas. The work is credited to John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini, and Steve Weis. The reproduction code on the page is dedicated to the public domain under CC0 1.0 Universal.