Anthropic says Claude traced the NIST curve seeds to 1997 clocks

On 16 October 2026, Anthropic published Claude reveals ECDSA curve origins. The page timestamp is 17:02 UTC. It says an employee asked an internal research model how the seeds behind the NIST elliptic curves were generated, without the old theory. The post then calls that model Claude. In under half an hour, it says, Claude traced the seeds for P-192, P-224, P-256, P-384 and P-521.

NIST adopted the curves in 2000, in FIPS 186-2. Anthropic says the National Security Agency supplied the seeds and did not explain them. The post prints the P-256 seed as C49D3608 86E70493 6A6678E1 139D26B7 819F7E90. The leading account, quoted from Jerry Solinas in 2015, was a hash of a forgotten humorous passphrase. Anthropic says that account was wrong.

What the writeup says the generator was

Anthropic says the seeds are output from the C library generator lrand48, started by srand48 with a Unix timestamp. The recipe it describes draws 20-byte candidates from that generator. Python on the page, which the authors dedicate to the public domain under CC0, lists each prime-curve seed with a timestamp and a candidate index. For P-256 the listing is 1997-08-16 01:52:34 UTC, candidate 1842, and the seed it prints matches the seed in the prose. The same listing covers five NIST prime curves and five ANSI X9.62 example curves. Anthropic says every one of those ten srand48 states is a timestamp from May 1997 through April 1998.

Filippo Valsorda, who organized the public bounty, writes that the team claimed it on 15 October 2026 at 01:07:51 UTC, and that he reimplemented the algorithm in Go. He names a different function in the same POSIX family: srand48 on the timestamp, then one byte at a time from drand48. The research post says lrand48. The two writeups agree on the result and do not print the same call.

Anthropic names John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini and Steve Weis. Valsorda lists the same people.

What this changes, and what it does not

Anthropic says this is not a cryptographic break, a new attack, or a weakness in the curves, and that users of the NIST curves have nothing to do differently. The change is reproducibility. The seed is now a program on the page, under CC0, which anyone can rerun. Anthropic says that makes a deliberate backdoor much less plausible, because a common generator started from a clock leaves less room for a secret weak curve.

Valsorda writes that Daniel Bernstein and Tanja Lange described, in 2017, a technique that could have used 70 bits of freedom in the seed to aim at a hypothetical class of weak prime-order curves. He writes that this week’s findings rule that technique out. Even if the NSA could pick any timestamp in 1997 or 1998 and any of the first 16 prime-order candidates, “they would have had barely 30 bits of freedom.” Those 16 candidates are his allowance, which he calls a generous reading of rejections the search does not explain. The 30-bit figure is his. Anthropic’s post does not state it.

Anthropic’s limit is the one this account uses. The published P-256 seed is candidate 1842, and Anthropic says candidate 876 of the same run also gives a prime-order curve of the right size. It says P-224’s run passed over three such curves, and the two ANSI X9.62 runs passed over seven more. It does not know why. It says so few skips make a hunt for weakened curves implausible to the authors, and that a search over timestamps is still conceivable, because the numbers do not show how many runs there were. The backdoor claim Anthropic is willing to make is that one is much less plausible.

What the primaries still leave open

Anthropic says the binary-field seed B-163 matches nothing it tried. Four other binary seeds read as February 1984 unless the timestamps are doubled, which lands them on 17 April 1998, two weeks after the P-224 run. Anthropic says the program may have halved the clock. Valsorda’s postscript says the binary-curve seeds were figured out. B-163 is still open in the research post, and this account follows that post.

The seed does not set the base point, the fixed point every public key is a multiple of. Anthropic says six base points from May 1997, P-192 and five ANSI X9.62 examples, match Arjen Lenstra’s FreeLIP generator, and that no NIST base point had been explained before, as far as the authors know. The base points of P-224, P-256, P-384 and P-521 do not fit that recipe. Neither do the base points of the NIST binary curves.

The bounty

Anthropic says the $36,864 for finding the seeds will be donated to the Internet Security Research Group. Valsorda writes that the team donated the prize to ISRG, the nonprofit that operates Let’s Encrypt, tripling its value to $36,864. He thanks the contributors to the bounty.

A separate Anthropic report, on a phage enzyme system Claude agents flagged, is covered in its own post.