Claude cracks the NSA's 25-year NIST curve mystery: the seeds were just random numbers seeded by a 1997 clock
What happened? Anthropic says Claude has explained one of cryptography's longest-running mysteries: where the NSA-supplied "seeds" behind the NIST elliptic curves (P-192, P-224, P-256, P-384 and P-521) came from. They were not hashes of a forgotten English phrase, as long rumoured, but plain output of a standard C-library random-number generator (lrand48, per Anthropic; cryptographer Filippo Valsorda describes it as the POSIX drand48 family) seeded with the computer's Unix clock. The timestamps date the runs to between May 1997 and April 1998; P-256's seed, for example, comes from a run started on 16 August 1997 and was the 1,842nd candidate drawn.
According to Anthropic's writeup (16 October 2026), an employee asked an internal research model to work out how the seeds were generated without steering it toward the passphrase rumour, and Claude found the answer in under half an hour. It spotted a statistical fingerprint of the old generator in the seed bits, recovered the generator's internal state using lattice (LLL) techniques, and rewound it to the clock values used in 1997–98. The work was done at Anthropic by a team of ten: John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini and Steve Weis. Claude also explained the base points of six curves, which came from Arjen Lenstra's FreeLIP library. One binary-curve seed (B-163) and the base points of P-224, P-256, P-384 and P-521 are still unexplained.
The bounty: Valsorda launched the NIST Elliptic Curves Seeds Bounty on 5 October 2023. It started at $8,192 and grew to $12,288 with matching contributions from Amir Omidi, Chris Palmer, Colm MacCárthaigh, David Adrian, David Anderson, Jeff Hodges, Matt Green, Matthew McPherrin, Paul Kehrer, Ryan Sleevi and Soatok. The prize tripled if the winners gave it to charity. Valsorda says the Anthropic team claimed the full bounty on 15 October 2026 at 01:07:51 UTC, after he reimplemented the algorithm in Go to check it. The team chose the charity option, so $36,864 goes to the Internet Security Research Group (ISRG), the non-profit that runs Let's EncryptDealroom has a profile for this one. Try Dealroom →.
Why it matters: The NIST curves, especially P-256 and P-384, secure much of the web's TLS certificates and government cryptography. Because the NSA never explained the seeds, they fed 25 years of backdoor suspicion, especially after the Dual_EC_DRBG scandal. Valsorda writes that the findings "completely rule out" the seed-manipulation technique that Daniel Bernstein and Tanja Lange had proposed, leaving the NSA "barely 30 bits of freedom", which is not enough to plant a backdoor. He now personally recommends the NIST curves over Curve25519. Anthropic stresses that this is not a cryptographic break and that no one needs to change anything. It also shows frontier AI models moving from benchmarks to settling long-open research questions, which matters for Anthropic's pitch to security and research customers.
Sources: Anthropic, "Claude reveals ECDSA curve origins" (16 Oct 2026); Filippo Valsorda, "The NIST Elliptic Curves Seeds Bounty Has Been Claimed" (16 Oct 2026); Filippo Valsorda, "Announcing the $12k NIST Elliptic Curves Seeds Bounty" (5 Oct 2023).
Image: Filippo Valsorda (words.filippo.io)
