Claude has just closed a cryptography case that stayed open for 25 years: on October 16, 2026, Anthropic's Frontier Red Team reported that an internal research model had traced how the NIST elliptic-curve seeds were generated, in under half an hour. The seeds were supplied by the US National Security Agency in the 1990s; NIST adopted the curves in its FIPS 186-2 digital signature standard in 2000 without ever explaining where the seeds came from, and suspicions of a backdoor have hung over ECDSA ever since.
Why a string of numbers was worth worrying about
ECDSA is the most widely used elliptic-curve signature scheme, and the seeds for the standard curves P-192, P-224, P-256, P-384 and P-521 are printed in the standard itself — anyone can look the values up, but nobody could say how they were produced. The leading story came from former NSA employee Jerry Solinas, who recalled that the seeds might be the hash of some humorous passphrase. Solinas died in 2023, colleagues stayed unresponsive, and years of trying phrase candidates led nowhere; a public bounty of $36,864 was offered for the answer. An unexplained magic number sitting inside a global infrastructure standard is, by itself, a trust problem.
The answer was not a phrase, but an old generator
In October 2026, an Anthropic employee put the question to an internal research model and deliberately withheld the passphrase tip. The model went the other way: it guessed that whoever wrote the generating program had used a weak pseudorandom generator of the kind shipped with 1990s C libraries, whose output carries a recognizable fingerprint. It wrote a scanner that sliced each seed into chunks and tested whether they looked like consecutive outputs of an old generator, trying 34 combinations of generators and slice layouts. The decisive clue was at bit level: in four of the seeds, all 20 of the 32-bit words have a zero in the top bit — a pattern with a chance of about 1 in 5,810 of occurring randomly — which points to lrand48, a generator that returns only the top 31 bits of a 48-bit state. The model then tried every one of the 2^17 possible values for the 17 hidden bits of the first word and checked that the following words matched, fully recovering the generator state for those four seeds.
The conclusion is plain: all five prime-field curve seeds are outputs of lrand48, initialized with Unix timestamps between May 1997 and April 1998, with no hash algorithm involved. The program drew 20 bytes per iteration as a candidate seed; the published P-256 seed was candidate number 1,842 of a run that began at 01:52:34 UTC on August 16, 1997. The same method also explained, for the first time, where the base points of P-192 and five related ANSI X9.62 curves came from.
Not a break — and the loose ends are listed
Anthropic stresses that this is not a break of ECDSA: no weakness in the curves was found, and users need to change nothing. The team published code that regenerates every seed, and the bounty will be donated to the Internet Security Research Group, the non-profit behind Let's Encrypt. The evidence level should still be stated plainly: the result so far comes from Anthropic's own publication and has not yet been independently confirmed, though the reproducible code lowers the bar for checking it. The unsolved remainder is listed just as openly — nobody knows why candidate 876 of the P-256 run, which would also have worked, was skipped; the seed of the binary curve B-163 and the base points of P-224, P-256, P-384 and P-521 remain unexplained.
The episode follows the same working pattern as Claude redesigning quantum circuits on its own, beating the best published designs on all eight tasks: hand the model a problem, let it iterate inside a loop where answers can be checked automatically, and leave humans to pose the question and verify the result. For cryptography, a 25-year suspicion dissolved not through new mathematics, but because a model was willing to dig through a 1990s toolbox — a reminder that many supposedly insoluble old problems may simply be missing that kind of patience.
