Claude Traced NIST's ECDSA Curve Seeds to a 1990s PRNG, Closing a 25-Year Backdoor Question

Since 2000, the elliptic curves behind most of the web’s ECDSA signatures have carried five unexplained seed values, handed down by the NSA with no justification, and the cryptography world has spent 25 years wondering whether they hid a backdoor. That question now has an answer. Anthropic reported on October 16 that an internal research model, asked to investigate with no hints, reconstructed the origin of the NIST curve seeds in under 30 minutes: they are outputs of the C library’s lrand48 linear congruential generator, seeded with plain Unix timestamps from 1997 and 1998. The finding comes three years after Filippo Valsorda posted a public bounty (originally $12,288, tripled to $36,864 for charity) for exactly this result, and the bounty money now goes to the Internet Security Research Group.

What the seeds turned out to be

The seeds for P-192, P-224, P-256, P-384, and P-521 were never hashes at all, which upends the most popular folk theory that they encoded a joke passphrase like “Give Bob and Jerry a raise.” Each seed is candidate N from a srand48(unix_time) run whose 20-byte outputs come from lrand48() >> 23. P-256’s seed, for example, is candidate 1,842 from a run seeded at 1997-08-16 01:52:34 UTC. The team recovered run dates for every prime curve: May 15 and 18, 1997, August 8 and 30, 1997, April 3, 1998 for P-224 (candidate 7,026). The binary curves (B-233 through B-571) apparently came from the same generator with the timestamp halved, pointing to runs on April 17, 1998. Even the base points have an origin story: six of them came from the FreeLIP integer library’s RNG using small seed integers like 20000 and 20517, discarding seven outputs, then testing x-coordinates until one landed on the curve.

How a language model found it

The attack the model ran is the kind a cryptographer would sketch on a whiteboard and then not bother attempting, because the search space looked hopeless. Claude scanned the seeds bit-by-bit across 34 generator-and-slice combinations and noticed that the top bits of 20 consecutive 32-bit words were zero, a signature of lrand48’s 31-bit outputs with probability 1 in 5,810 of appearing by chance. From there it brute-forced the hidden bits for the binary curves and used LLL lattice reduction to recover truncated PRNG states for the prime curves, then ran the generator backwards into srand48 form (recognizable by the low 16 bits equaling 0x330E). Anthropic’s writeup notes the model’s own reasoning included a skepticism check: “160-bit match from a 32-bit seed + small index: no chance coincidences.” Verification is complete, not statistical: all ten prime-curve seeds plus five ANSI X9.62 seeds regenerate bit-for-bit from the recovered states, and the team released reproducible CC0-licensed Python code.

What it means for the backdoor question

This is not a break in the curves; nothing about their security changes. What changes is the provenance story. A deliberate backdoor requires choosing curve parameters with hidden structure. Seeds that fall out of a clock-seeded toy PRNG at predictable candidate indices are the opposite of that: anyone can now regenerate every one of them from a handful of timestamps. The residual caveat is real but narrow, and Anthropic states it plainly: the NSA could in principle have searched over timestamps to select a special curve, but the authors call weakened-curve selection implausible given what was actually done. The more human detail is the posthumous credit Anthropic’s post gives to Jerry Solinas, the NSA mathematician long associated with the curves, who died in 2023 without ever publicly explaining the seeds.

What remains open, and why this matters beyond crypto

The mystery is not fully closed. Some viable candidate curves were skipped during generation (P-256’s run skipped candidate 876 for reasons unknown), B-163’s seed is still unexplained, and the base points of P-224, P-256, P-384, and P-521 remain unrecovered. Those loose ends are exactly why the result is credible: a fabrication would have cleaned them up. The broader lesson lands on AI capability rather than cryptography. A 25-year-old open problem, with a funded bounty and years of expert attention, fell to a model in half an hour because it could hold the whole shape of the problem in context and test 34 hypotheses at once. As we saw with quantum chemistry routing at SandboxAQ and NVIDIA’s Ising-model calibration work, the pattern is consistent: the productive AI research targets are not novel physics but vast, mechanical search spaces where a good hypothesis generator changes the economics. Expect the next Valsorda bounty to be written with that in mind.