Claude solves the 25-year mystery of NIST curve seeds

What the mystery was

ECDSA is the most widely used elliptic-curve signature standard, adopted by NIST in FIPS 186-2 in 2000. Each standard curve came with a published seed whose hash defines the curve's coefficient b. The NSA supplied the seeds with no explanation, which fuelled years of speculation about deliberate weaknesses. Filippo Valsorda even organised a bounty for anyone who could find their origin.

The best-known story came from former NSA employee Jerry Solinas, who said the seeds were hashes of a humorous phrase along the lines of “Give Bob and Jerry a raise”. Solinas died in 2023 and the question stayed open (Anthropic).

What Claude found

Several Anthropic employees had chased the phrase theory without success. In October, a colleague asked an internal research model without pointing it at that clue. In under 30 minutes, Claude traced the seeds of P-192, P-224, P-256, P-384 and P-521. None are hashes: all are lrand48 output seeded with a Unix timestamp. The program drew 20-byte candidates in sequence; P-256's seed was candidate 1,842 from a run dated August 16, 1997 (UTC).

The approach: Claude assumed the weak generators shipped with 1990s C libraries leave recognisable output. It wrote a scanner covering 34 generator and output combinations, then noticed that four of the ten seeds had a zero top bit in every 32-bit word, a 1-in-5,810 chance. That is lrand48's fingerprint, since it returns only 31 bits of its 48-bit state. For the prime curves the output was truncated, so it recovered the generator state with LLL lattice reduction. Every recovered initialisation turned out to be a timestamp between May 1997 and April 1998.

Along the way it also explained the base points of six curves, which came from the generator in Arjen Lenstra's FreeLIP library with small integer seeds (20000 for P-192). Still unexplained: the B-163 seed and the base points of P-224, P-256, P-384 and P-521.

Anthropic included Claude's own reasoning. It first wondered whether it was in a test environment, then concluded: “Wow, it's a real discovery.”

What it means for security

Anthropic stresses this is not a break or a new attack, and nobody needs to do anything. If anything it is reassuring: the seeds came from a simple process anyone can now reproduce, leaving little room for subversion. The reproduction code is published under CC0.

One oddity remains. The generation skipped a few viable candidates; for P-256, candidate 876 would also have produced a suitable curve. Nobody knows why. Anthropic argues the small number of skips makes deliberate selection of a weakened curve implausible.

What the bounty organiser says

Filippo Valsorda confirmed that the Anthropic team claimed the full bounty in the early hours of October 15 (UTC), and he reimplemented the algorithm in Go to verify it. He says the result completely rules out the technique Bernstein and Lange described in 2017 for deliberately selecting a weak curve. Even if the NSA had been free to pick any 1997–98 timestamp and any of the first 16 candidates, it would have had barely 30 bits of freedom, not enough for a backdoor (Filippo Valsorda).

Valsorda calls this the completion of the NIST curves' “rehabilitation arc” and says he would now personally recommend them over Curve25519, just as they are about to be retired in favour of post-quantum signatures.

The $36,864 bounty has been donated to the Internet Security Research Group, the nonprofit behind Let's Encrypt.