Anthropic’s Claude AI has traced the origins of five cryptographic seeds used in NIST elliptic curve standards to a pseudorandom number generator initialized with Unix timestamps from 1997 and 1998. The reconstruction reproduces the published seeds exactly, offering a technical explanation for a longstanding mystery surrounding the generation of cryptographic parameters used to secure internet communications.
The discovery addresses questions that have persisted for decades about how the National Security Agency (NSA) selected the original numbers used to construct the P-192, P-224, P-256, P-384 and P-521 elliptic curves. Although the mathematical procedures used to generate the curves were publicly verifiable, the origins of their initial seeds remained unexplained, prompting speculation that the selection process might have concealed a cryptographic weakness.
The controversy centered on the possibility that the NSA could have chosen parameters that appeared legitimate but contained a hidden vulnerability known only to the agency. Cryptographers Neal Koblitz and Alfred Menezes examined the issue in their 2015 paper, “A Riddle Wrapped in an Enigma.” No practical backdoor was demonstrated, but uncertainty over the seeds’ origins continued to raise questions about the transparency of the standards-generation process.
The prevailing explanation had been that NSA mathematician Jerry Solinas generated the seeds by hashing English-language phrases. However, the precise phrases were reportedly lost, and attempts to reconstruct the original process proved unsuccessful. The resulting uncertainty eventually led cryptographer Filippo Valsorda to offer a bounty in October 2023 for an explanation of the seeds’ origins. The challenge was later associated with a potential payout of $36,864 through a matching arrangement.
According to Anthropic’s account published on October 16, Claude approached the problem by examining the mathematical structure of the seeds rather than relying on the established secret-phrase theory. The model identified an unusual pattern: several seeds contained groups of numbers with consistently zeroed high-order bits. The supplied research estimated that this pattern had approximately a one-in-5,810 probability of occurring randomly, making it a useful clue for investigating the generation process.
The pattern pointed toward lrand48, a pseudorandom number generator commonly available in Unix-era computing environments. Such generators produce deterministic sequences from an initial state, meaning that the output can be reproduced when the starting conditions are known. Claude worked backward through the relevant mathematics, recovered the generator’s internal states and reproduced the published cryptographic seeds.
The decisive finding was that the recovered starting values corresponded to Unix timestamps from 1997 and 1998. The timestamps provided a plausible explanation for how the original seeds had been generated: a program could initialize the pseudorandom generator with a timestamp, produce candidate values, test those values against the mathematical requirements for a curve and retain an acceptable result.
The reconstruction reportedly matched all 160 bits of the published seeds. For P-256, the accepted seed appeared at candidate 1,842, while P-224 required 7,026 candidates. The reported timestamps also placed the five curves’ seed-generation events between May 1997 and April 1998. Cryptographer Filippo Valsorda independently reproduced the results using Go, and Anthropic released code to support further verification.
These exact matches provide strong evidence for the proposed generation method. They do not, however, establish every detail of the original process, including who operated the software, why particular candidates were rejected or whether the reconstructed procedure precisely reflects the full historical workflow.
The security implications are significant because the discovery offers a less suspicious explanation for the seed selection than the possibility of deliberate manipulation. If the seeds were generated through a relatively constrained timestamp-based procedure, the available freedom to select cryptographic parameters may have been substantially narrower than some hypothetical backdoor scenarios assumed.
Anthropic’s researchers estimated approximately 30 bits of selection freedom under generous assumptions, compared with roughly 70 bits contemplated in one proposed weakness-selection scenario. That comparison weakens the case for this particular theory of deliberate parameter manipulation, although it does not constitute a universal proof that the curves are free of every possible weakness.
The distinction matters for internet security because elliptic curve cryptography underpins a range of systems that require secure digital communication, including website connections, financial transactions and government communications. Greater clarity about how standardized cryptographic parameters were generated can improve confidence in the historical integrity of those standards.
The finding does not break elliptic curve cryptography or invalidate the affected NIST curves. It also does not directly establish a security impact on Bitcoin or Ethereum, which use the different secp256k1 elliptic curve. The central result concerns the provenance of five specific seeds, rather than a new cryptographic attack against the broader class of elliptic curve systems.
The discovery also prompted discussion about the role of AI in complex technical research. Bitcoin developer Gregory Maxwell reportedly questioned the publicity surrounding Claude’s achievement after describing an earlier attempt by a friend’s AI agent to investigate the same problem without success. Maxwell suggested that the difference might reflect how the model was directed and raised questions about potential differences in model performance. His comments, as presented in the supplied account, do not dispute the mathematical reconstruction itself.
The bounty associated with the challenge is set to benefit the Internet Security Research Group, the organization behind Let’s Encrypt. Valsorda characterized the result as a contribution to cryptographic history that reinforces confidence in important cryptographic primitives.
Some questions remain unresolved. Researchers have not fully explained why certain mathematically acceptable candidates were discarded during the original process, and the origin of the B-163 curve’s seed remains unexplained. Those gaps mean the findings should be treated as a substantial resolution of the five-seed mystery rather than a complete account of every historical parameter-generation decision.
The next step is independent scrutiny of the released reconstruction, particularly the assumptions behind the candidate-selection process and the estimated limits on selection freedom. If further analysis confirms those conclusions, the work could provide a clearer historical basis for evaluating the trustworthiness of these cryptographic standards.
For now, the strongest conclusion is that a deterministic computer routine and ordinary timestamps offer an explanation for numbers that had attracted decades of suspicion. Claude’s contribution demonstrates how AI-assisted mathematical investigation can help reconstruct undocumented technical processes, while independent verification remains essential when the findings concern foundational internet security.
