Anthropic Traces NIST Curve Seeds to a 1990s Random Number Generator

Anthropic's Frontier Red Team said on Oct. 16 that it reproduced the seeds behind NIST's P-192, P-224, P-256, P-384 and P-521 curves, which came from a 1990s random number generator started with a Unix timestamp.

The post is not a cryptographic break. Anthropic's account says it found no weakness in ECDSA, the signature scheme that uses the curves, and that readers have nothing to do. The result matters because the NSA supplied the seeds in the late 1990s with no explanation, and that gap fed 25 years of suspicion about a backdoor. Cryptographer Filippo Valsorda, who organised the bounty for the seeds, confirmed the result on his own site. He wrote that the bounty was claimed on Oct. 15 at 01:07:51 UTC.

How Claude recovered the seeds in under 30 minutes

An Anthropic employee asked an internal research model to work out how the seeds were generated, without telling it the clue. Anthropic says the model finished in under half an hour. It guessed that the software used a weak 1990s pseudorandom number generator and wrote a scanner for the output pattern.

The scanner found that the top bits of some seeds were zero, a signature of lrand48, a linear congruential generator (a short formula that turns one number into the next). For the prime curves, where the seed is truncated output, Claude recovered the generator's internal state with the LLL lattice basis reduction algorithm.

Each 20-byte candidate seed is one iteration of the generator after srand48 is called with a timestamp. The published seed is the candidate at a given iteration count that yielded a valid curve under the ANSI X9.62 procedure. The popular story, that NSA employee Jerry Solinas hashed a humorous passphrase, was wrong, according to both posts. Solinas died in 2023.

The two posts name the generator differently, lrand48 in Anthropic's and drand48 in Valsorda's, though both describe a timestamp passed to srand48. The Terminal did not run either implementation.

The timestamps behind each prime curve

Curve	Timestamp used	Candidate number
P-192	May 18, 1997	139
P-224	April 3, 1998	7,026
P-256	Aug. 16, 1997	1,842
P-384	Aug. 30, 1997	2,688
P-521	Aug. 8, 1997	1,136

1. P-192139 candidates
2. P-5211136 candidates
3. P-2561842 candidates
4. P-3842688 candidates
5. P-2247026 candidates

Source: Anthropic Frontier Red Team, ECDSA curve origins, accessed 2026-10-17

The four NIST binary curves, B-233, B-283, B-409 and B-571, appear to use timestamps from April 17, 1998 with the clock value halved. Anthropic hedges that reading ("if that reading is right") and says B-163 remains unexplained.

Base points from a number library

The seeds fix each curve's coefficient. The base point is a separate constant, and Anthropic says no NIST base point had been accounted for before this work. For six curves, P-192 and five ANSI example curves, the base point comes from the random number generator in FreeLIP, a long-integer arithmetic package written by Arjen Lenstra. Early versions of Victor Shoup's NTL library shipped the same code.

The generator seeds are 20000 for P-192, 20420, 20507 and 20509 for the three prime239 curves, and 20512 and 20517 for prime192v2 and prime192v3. The base points for P-224, P-256, P-384 and P-521 do not fit this recipe and are still unexplained, as are those of the NIST binary curves.

Why the backdoor theory loses ground

In 2015 Neal Koblitz and Alfred Menezes argued in "A Riddle Wrapped in an Enigma" that the NSA picking seeds to exploit a weakness that survived decades of cryptanalysis was implausible. In 2017, Valsorda's post recalls, Daniel Bernstein and Tanja Lange described a technique that would use about 70 bits of freedom in the seed to target a hypothetical class of 2^61 weak curves.

Valsorda says the new findings rule that technique out. Even with generous assumptions, he wrote, the freedom in choosing a seed is barely 30 bits, too little to aim at a rare weak class. Anthropic makes a related argument: a weakened curve being chosen would imply weak curves are common and easy to find.

What is still unexplained

Anthropic found skipped candidates. P-256 candidate 876 also yields a valid curve, and the P-224 and ANSI runs passed over others. The company does not know the criteria used or whether the skips were accidental. Valsorda counts roughly twice as many valid seeds as were published and says no good explanation fits. He identified one undocumented rule, that a seed is rejected if the bit length of the group order n exceeds that of the base field p. A second rule has not been identified.

A timestamp could in principle have been searched until a harmless-looking seed appeared, Anthropic says, but the numbers do not show how many runs took place. That is the claim that would weaken the conclusion: evidence of a large number of discarded runs.

For related coverage, see how Linus Torvalds published a kernel branch built with Claude Code and Google's magic-state work on its Willow quantum chip.

The bounty and what remains open

Valsorda announced the bounty on Oct. 5, 2023. It paid $12,288, tripled to $36,864 if the winner gave it to a US charity. Ten Anthropic staff are named as claimants: John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini and Steve Weis. They donated the prize to the Internet Security Research Group, the nonprofit behind Let's Encrypt.

Open items are B-163's seed and the base points for the four NIST prime curves. Anthropic's post includes Python code that reproduces the seeds, so anyone can check the output against the published values.