For 25 years cryptographers have asked where the NIST curve seeds came from. The NSA handed them to the FIPS 186-2 signature standard without a word of explanation. P-256 ships with C49D3608 86E70493 6A6678E1 139D26B7 819F7E90, and nobody could say why that number and not another. On October 16 Anthropic published the answer. They are timestamps.
Not a hash, but a 1997 random number generator
In October a curious Anthropic employee asked an internal research model how the seeds might have been produced. He deliberately withheld the rumour that had been circulating. Inside half an hour Claude had the origin of the seeds for P-192, P-224, P-256, P-384 and P-521.
Behind them sits lrand48, the C library random number generator, initialised with a Unix timestamp. The program drew 20 bytes per candidate and kept going until something usable came out. For P-256 that was candidate 1842. All ten recovered start times for the prime curves fall between May 1997 and April 1998.
The best story until then said something else. Jerry Solinas, long of the NSA, recalled in 2015 that the seeds were the hash of a joke phrase, something like “Give Bob and Jerry a raise”. Solinas died in 2023 and no records turned up. Several people at Anthropic had chased that lead and found nothing. It was wrong.
The road ran through a lattice problem
Claude came at it backwards and asked which generator the software of the day would plausibly have used. Old generators are weak enough that you can recognise their output. A scanner slid along each seed one bit at a time, testing 34 combinations of generator and slice.
Then a pattern surfaced. In four of the ten seeds, every 32-bit word has a zero in the top bit. By chance that happens with probability 1 in 5810. It is exactly how lrand48 behaves, returning only 31 of its 48 state bits. The rest of the seeds showed fewer bits and needed more work: recovering the state of a truncated linear congruential generator is a lattice problem, and LLL basis reduction solves it. All ten prime-curve seeds followed the same shape, lrand48() >> 23.
Along the way Claude also explained a handful of base points nobody had explained before. They come from the generator in FreeLIP, Arjen Lenstra’s long-integer library. The base points of P-224, P-256, P-384 and P-521 are still open, as is the fifth binary seed, B-163.
The finding argues for the curves
This is not a break. Anyone who suspected a back door in the NIST parameters now has to picture the NSA planting it through a wall clock and a generator any undergraduate can reproduce. That leaves very little room to hide anything.
The route there interests me more than the result. The puzzle sat in the open for 25 years, people who know far more cryptography than I do had a go at it, and in the end it took pattern matching plus a lattice solver and half an hour. Filippo Valsorda, who put up the bounty, reimplemented the algorithm in Go and confirmed it. The $36,864 goes to the Internet Security Research Group, the nonprofit behind Let’s Encrypt.
If you want to see how Claude handles a structurally similar problem, look at the work on quantum circuits Anthropic published the same day.