Anthropic researchers have revealed that an internal research version of Claude solved a 25-year-old cryptographic provenance mystery in under 30 minutes, identifying the exact origin of seed values used to generate widely standardized NIST elliptic curves.
The seeds in question were originally published by the National Institute of Standards and Technology (NIST) in 2000 under FIPS 186-2 as part of the Digital Signature Standard. For decades, the provenance of these parameters remained unexplained by the National Security Agency (NSA), sparking persistent speculation across the cryptography community that the parameters might contain hidden trapdoors or backdoors.
Anthropic's analysis proves that the seeds were not generated using secret passphrases or cryptographic hash loops. Instead, they were produced by a standard 1990s C library pseudorandom number generator, lrand48, initialized using Unix timestamps from 1997 and 1998.
The 25-Year Provenance Void
When NIST standardized elliptic curve cryptography, it published specific seed values used to compute curve coefficients. For example, the standardized NIST P-256 curve included a 160-bit seed string (SEED = C49D3608 86E70493 6A6678E1 139D26B7 819F7E90) with no documentation regarding how the number was chosen.
In 2015, cryptographers Neal Koblitz and Alfred Menezes documented the history and community concerns in their paper, "A Riddle Wrapped in an Enigma." The prevailing informal theory came from late NSA mathematician Jerry Solinas, who suggested the seeds were generated by hashing an unrecorded humorous passphrase. However, decades of brute-force dictionary attacks against suspected phrases yielded no matches.
How Claude Reconstructed the Seeds
Rather than searching for passphrases, Anthropic prompted an internal Claude research model to evaluate how late-1990s software implementations operated. The model hypothesized that the original engineers relied on the standard pseudorandom number generators bundled with Unix C libraries of that era.
Claude executed a structured investigation using the following methodology:
- Bit-Pattern Scanning: The model scanned published seed strings across 34 combinations of generator algorithms and bit slices. It detected that four of ten standardized seeds contained leading zeros across all 32-bit words, a signature indicating the output of
lrand48, which returns only the upper 31 bits of a 48-bit internal state. - Lattice Reduction State Recovery: Because the prime-curve seeds discarded several bits per iteration, recovering the internal 48-bit generator state required solving a truncated linear congruential generator problem. Claude applied the Lenstra-Lenstra-Lovasz (LLL) lattice basis reduction algorithm across sliding bit windows, successfully extracting the 48-bit state for five NIST prime curves and five ANSI X9.62 standard curves.
- Timestamp Stepping: Linear congruential generators are reversible. Stepping the recovered states backward revealed initialization states matching the format produced by
srand48(where the lowest 16 bits equal0x330E). - Unix Epoch Matching: The reconstructed initialization values corresponded directly to Unix timestamps recorded between May 1997 and April 1998.
For NIST P-256, the published seed represents candidate index 1,842 from a generator run initialized on August 16, 1997.
Base Points and Mathematical Libraries
Claude also uncovered the origin of previously unexplained curve base points (). For six curves generated in May 1997 (including P-192 and ANSI X9.62 example curves), the base points were derived from the pseudorandom generator within FreeLIP, a long-integer arithmetic package developed by Arjen Lenstra and distributed in early releases of Victor Shoup's NTL library.
The generator was initialized with small sequential integers (such as 20000 for P-192, and 20420, 20507, and 20509 for prime239 variants), discarded seven initial outputs, and generated candidate coordinates reduced modulo until a valid curve point was reached.
Cryptographic Impact and Remaining Questions
Anthropic emphasized that this finding is not a cryptographic break, vulnerability, or attack against ECDSA. Existing digital signatures and deployments do not require modification.
Instead, the discovery provides empirical evidence that the standardized seeds were generated via mundane pseudorandom sampling rather than adversarial parameter selection, substantially lowering the probability of deliberate government backdoors in these curves.
A few open questions remain:
- Binary Curve B-163: The B-163 binary curve seed did not match the
lrand48patterns and remains unresolved. - Higher-Order Base Points: The base points for P-224, P-256, P-384, and P-521 do not match the FreeLIP recipe.
- Candidate Filtering: In several runs, the generator skipped mathematically viable candidate curves before selecting the published seed (for example, P-256 skipped valid candidate index 876).
The $36,864 community bounty previously offered for solving the seed origins will be donated to the Internet Security Research Group (ISRG).
