Claude traces the mysterious NIST elliptic-curve seeds to 1990s timestamps

An internal Anthropic research model found in under half an hour that the seeds behind the NIST P-192, P-224, P-256, P-384 and P-521 elliptic curves were not hashes of a phrase but output of the C library's lrand48 random-number generator, seeded with Unix timestamps, Anthropic said on 16 October 2026 [1].

Where did the NIST curve seeds come from?

NIST adopted the curves in 2000 in FIPS 186-2, and the NSA supplied the seeds without explanation [1]. Each seed is hashed to set a curve coefficient, so an unexplained seed left room to suspect a deliberately weakened curve [1][2].

The long-told story was that NSA employee Jerry Solinas hashed a joke sentence he later forgot. Solinas died in 2023 [1][2]. Anthropic says several employees had chased that lead without success before an employee asked the model without pointing at the clue [1].

The model found that every initialisation behind the ten prime-curve seeds, five NIST and five from ANSI X9.62, was a timestamp between May 1997 and April 1998 [1]. The P-256 seed is candidate 1,842 of a run started on 16 August 1997 [1].

Recovering the generator's state from truncated output is a textbook lattice problem, solved with LLL basis reduction, Anthropic says [1]. We ran Anthropic's published script and it reproduced the P-256 seed C49D360886E704936A6678E1139D26B7819F7E90.

What is still unexplained?

Four NIST binary-curve seeds fit if the program halved the clock, which Anthropic presents as a tentative reading [1]. The fifth binary seed, B-163, fits nothing the model tried, and the base points for P-224, P-256, P-384 and P-521 remain unexplained [1].

Some viable curves were skipped: for P-256, candidate 876 of the same run would also have worked [1]. Anthropic says it does not know what criteria were used, or whether it was an unintentional artifact [1].

Who gets the bounty?

Cryptographer Filippo Valsorda, who organised the bounty, said the Anthropic team claimed it on 15 October 2026 at 01:07:51 UTC and chose to donate it to ISRG, tripling its value to $36,864 [2]. Valsorda describes the generator as drand48; Anthropic's code reads lrand48 output from the same generator family [1][2].

Our read

Opinion: The most useful AI science result this week is a boring one. A model closed a 25-year trust question with code anyone can rerun, which is the right standard for AI research claims.

What we could not verify

• We reproduced only the P-256 seed; we did not rerun the lattice search or check the binary-curve reading.
• Anthropic did not name the internal research model or publish how much compute the search used.