Anthropic’s Claude traces origins of NIST ECDSA curve seeds to 1990s C library PRNG seeded by Unix timestamps

Anthropic announced that its internal research model, Claude, has resolved a 25-year-old mystery in cryptography: the origins of the seed values used to generate the elliptic curves adopted by NIST in the year 2000 for the FIPS 186-2 Digital Signature Standard. These seeds, which define the coefficient b of the curves, were provided by the NSA without explanation, fueling speculation about possible backdoors or intentional weaknesses. The provenance of these seeds has been a long-standing open question in the cryptographic community, with researchers such as Neal Koblitz and Alfred Menezes documenting concerns in their work titled “A Riddle Wrapped in an Enigma.”

The investigation began with rumors that the seeds might be hashes of humorous passphrases, but Anthropic employees pursued a different approach after those leads failed. In October 2026, an Anthropic employee asked an internal research model to determine how the seeds were generated without being given any clues. Within half an hour, the model identified that the seeds for the NIST curves P-192, P-224, P-256, P-384, and P-521 were produced using the lrand48 pseudorandom number generator from 1990s C libraries, seeded with Unix timestamps.

The algorithm used to generate the seeds sampled 20-byte chunks from the lrand48 generator, initialized by a Unix timestamp and iterated until a valid seed was produced. For example, the NIST P-256 seed required 1,842 iterations of this process. The method was simple and reproducible: anyone can regenerate the seeds using the same PRNG and initialization method. The seeds for four binary curves were also traced to a similar process, with timestamps mapping to April 1998.

Anthropic emphasized that this discovery does not indicate a cryptographic break, new attack, or weakness in the ECDSA curves. Instead, it provides evidence that the seeds were generated in a transparent and verifiable way, reducing concerns about deliberate subversion. The company noted that the method used—initializing a weak PRNG with a Unix timestamp—was common in the 1990s and does not imply any hidden malice.

The research also addressed another related question: how the base points (G) for these curves were generated. While the seeds do not determine the base points, Anthropic reported that it found where some of the base points originated during the same investigation.