Anthropic says its internal Claude research model has solved a cryptography mystery that remained unexplained for more than 25 years, tracing the origins of five elliptic curve seeds supplied by the National Security Agency (NSA) to a basic random-number generator. The discovery, published on October 16, 2026, identifies an ordinary software process behind parameters used in widely adopted cryptographic standards. The investigation took less than 30 minutes, according to Anthropic, and does not reveal private keys or break encryption.
The research focuses on the seeds behind five National Institute of Standards and Technology (NIST) elliptic curves: P-192, P-224, P-256, P-384 and P-521. These curves support public-key cryptography and digital signature systems that help verify the authenticity and integrity of digital information. Although the seeds were publicly available, the NSA never explained how they had been generated, leaving researchers questioning whether the parameters could have been deliberately chosen to introduce hidden weaknesses.
NIST adopted the Elliptic Curve Digital Signature Algorithm (ECDSA) in its FIPS 186-2 Digital Signature Standard in 2000. The standard specified a process using a seed and a cryptographic hash to determine a curve parameter, but it did not document the origin of the original seed values. That missing explanation fuelled years of speculation, particularly after revelations about the NSA’s involvement in other controversial cryptographic standards.
One theory suggested that the seeds were generated by hashing a humorous phrase. Former NSA mathematician Jerry Solinas recalled phrases such as “Give Bob and Jerry a raise” in a 2015 account, but researchers were unable to establish the exact wording or reproduce the published values. Solinas died in 2023, leaving the question unresolved. A public bounty eventually grew to $36,864 for anyone who could identify the seeds’ origins.
Instead of pursuing the phrase theory, Claude examined random-number generators commonly available in software during the 1990s. It built a scanner that tested 34 combinations of generators and output formats against the published seed values. The investigation uncovered a distinctive pattern in several seeds: their 32-bit words consistently had a zero in the highest bit, matching the output characteristics of lrand48, a pseudorandom number generator found in older C libraries.
The generator maintains a 48-bit internal state but produces 31-bit random-number outputs. Claude recovered candidate internal states by testing the hidden bits and checking whether subsequent outputs matched the published values. For the prime-field curves, the task was more complicated because the seeds preserved only part of each generator output. Claude used the Lenstra–Lenstra–Lovász (LLL) lattice-reduction algorithm to reconstruct the missing information.
According to Anthropic’s technical report, the five NIST prime-curve seeds and five additional seeds from the ANSI X9.62 standard all matched the same construction, using selected bits from successive lrand48 outputs. Each recovered internal state reproduced the corresponding 160-bit seed, providing a mathematical explanation for values that had remained mysterious for decades.
By reversing the generator’s operations, Claude traced the initial states of the ten prime-curve seeds to Unix timestamps between May 1997 and April 1998. The P-256 seed, for example, was the 1,842nd candidate generated from a run initialized on August 16, 1997, at 01:52:34 UTC. The process generated candidates in 20-byte batches, with the standardized P-256 seed appearing at the identified position.
The research also uncovered evidence about four binary-curve seeds. Their recovered initializations appeared to correspond to dates in February 1984, but doubling those timestamp values placed them on April 17, 1998, roughly two weeks after the P-224 generation run. Anthropic said the results suggest the original software may have halved the clock value, although that explanation remains unconfirmed.
Claude also traced the generation of several elliptic-curve base points to FreeLIP, a long-integer arithmetic package. The discovery covers the base points for P-192 and five ANSI X9.62 example curves. Base points are fixed mathematical starting points used in elliptic-curve calculations, and their origins are separate from those of the curve seeds. Anthropic has not explained the base points for P-224, P-256, P-384 and P-521 or the corresponding NIST binary curves.
The investigation has not resolved every question. Researchers identified candidate seeds that appeared to produce suitable curves but were skipped in the original selection process. For P-256, candidate 876 produced a curve with similar characteristics, yet the published parameters came from candidate 1,842. Anthropic said it does not know why these alternatives were passed over, although it considers the small number of skipped candidates insufficient to make deliberate selection of weakened curves plausible. The B-163 binary-curve seed also remains unexplained.
The findings do not mean ECDSA has been broken or that systems using the affected NIST curves need to replace their cryptographic parameters. The seeds were public from the beginning, and reconstructing how they were generated does not reveal anyone’s private signing keys or allow attackers to forge digital signatures. The result instead provides a reproducible account of how the values were produced, making the theory of a deliberately introduced weakness in these particular parameters less plausible.
Bitcoin was not directly affected by the discovery because it uses the secp256k1 elliptic curve rather than the five NIST curves investigated by Claude. As CoinDesk reported, the separate security questions surrounding future quantum-computing attacks on cryptocurrency keys remain unrelated to the origin of the NSA-supplied seeds.
Anthropic has published code that allows other researchers to reproduce the calculations and verify the recovered values. The $36,864 bounty will be donated to the Internet Security Research Group, the nonprofit organization behind Let’s Encrypt. The company says no changes to deployed systems are required because of this discovery alone.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The research offers a notable example of AI-assisted cryptography investigation. Rather than discovering an exploitable vulnerability, Claude combined pattern recognition, mathematical techniques and automated testing to solve a historical problem that had resisted years of investigation. The result provides a clearer explanation of the origins of several widely used cryptographic parameters while leaving a handful of questions open.
Anthropic’s Claude Solves 25-Year Mystery Behind NSA Elliptic Curve Seeds
