Anthropic Says Claude Traced NIST P-256's Seed to a 1997 Timestamp

Anthropic's Frontier Red Team says the seeds NIST published for five elliptic curves (P-192, P-224, P-256, P-384 and P-521) came from a 1990s C library random number generator seeded with a Unix timestamp. They were not hashes of an English phrase. The post, dated Oct. 16, says an internal research model recovered the method in under half an hour.

The post, titled "Claude reveals ECDSA curve origins", lists 10 authors, among them Nicholas Carlini and Steve Weis. It says the result is not a cryptographic break, a new attack or a weakness in the curves. It includes Python code under a CC0 licence that the authors say reproduces every seed; The Terminal has not run it.

Why the seeds were a question since 2000

NIST adopted ECDSA in 2000 in FIPS 186-2. Each curve's coefficient b was derived from a seed, and NIST published the seeds without saying where they came from. If b had been picked to weaken a curve, nobody outside the process could have told.

Suspicion grew after the NSA was found to have backdoored the Dual_EC_DRBG random number generator, according to John D. Cook's post of Oct. 17. Cook writes that Daniel J. Bernstein emailed the NSA's Jerry Solinas on Sept. 6, 2014 to ask. Solinas replied that the seeds came from hashing a humorous English message, but could not recall the message or the procedure.

On Oct. 5, 2023, Filippo Valsorda announced a bounty for the pre-seeds of the five prime curves: $12,288, tripled to $36,864 if the winner gave it to a U.S. charity. His post assumed the seeds were SHA-1 hashes of English phrases. Anthropic says an earlier rumour of a hashed passphrase went nowhere, and that Solinas died in 2023.

How the model found it

The model guessed that the seeds came from a weak 1990s C library generator whose output could be recognised. A scanner slid along each seed one bit at a time, testing 34 combinations of generator and slice. The top bit of each 32-bit word was zero for four of the seeds, which the post puts at a one-in-5,810 chance and which fits lrand48, a function that returns only the top 31 bits of a 48-bit state.

For the binary curves, trying all 131,072 values of the 17 hidden bits in the first word confirmed that the next four words followed. The prime-curve seeds keep fewer bits per output, so the post treats recovery as a truncated linear congruential generator problem and solves it with LLL lattice basis reduction. Each recovered state regenerated all 160 bits of its seed.

Stepping the states back gave timestamps. The prime curves fall between May 1997 and April 1998. The binary curves read as February 1984 and, doubled, April 17, 1998, so the program may have halved the clock.

Curve	Timestamp (UTC)	Candidate index
prime239v1	1997-05-15 15:49:03	2,185
P-192	1997-05-18 14:45:34	139
P-521	1997-08-08 01:12:04	1,136
P-256	1997-08-16 01:52:34	1,842
P-384	1997-08-30 14:50:08	2,688
P-224	1998-04-03 12:52:07	7,026
B-233	1998-04-17 15:24:18 (seed halved)	155

Source: Anthropic, Oct. 16, 2026.

What the finding leaves open

The procedure generates a stream of candidate seeds and the published seed is one of them, at the index in the table. Some candidates that would have produced a valid curve were passed over. For P-256, candidate 876 also gives a prime-order curve; P-224 skipped three, and the two ANSI X9.62 runs skipped seven more. The authors call deliberate weakening implausible given how few were skipped, and say the reason for skipping is unknown.

Gaps remain. The B-163 seed matches no hypothesis the model tried, and the base points for P-224, P-256, P-384 and P-521 do not fit the recipe that explains the others.

Independent confirmation is thin so far. Cook reports that Valsorda verified the result and awarded the prize, but the bounty page The Terminal read carries no update, so that rests on Cook's post and Anthropic's own. Anthropic is also the party that claimed the bounty; the code in the post is the way to check it. Anthropic also publishes research on its own workforce, and The Terminal covered a separate question of whether published artefacts match what was built.

Cook also reports that Valsorda would now personally recommend the NIST curves over Curve25519. The Terminal found that in Cook's summary and has not seen Valsorda say it directly. Anthropic's post gives no date for explaining the B-163 seed or the four missing base points.