The NIST curve seeds were just timestamps: Claude closes a 25-year cryptography mystery

A 25-year-old blank spot

ECDSA is the most widely used elliptic-curve signature standard. NIST adopted its curves in 2000 with FIPS 186-2, and each curve's coefficient b derives from hashing a published 20-byte seed. Those seeds came from the NSA with no explanation. Koblitz and Menezes wrote the standard summary of the controversy, "A Riddle Wrapped in an Enigma", and the unease was concrete enough that Valsorda organized a bounty for recovering the seeds' origins. The best story on record was Jerry Solinas's own 2015 recollection: he thought the seeds were a hash, possibly with a counter, of a humorous phrase along the lines of "Give Bob and Jerry a raise". Solinas died in 2023, and no archives survived. That is where the trail went cold, until an Anthropic employee asked an internal research model to figure out the generation method without being handed the rumor.

What Claude actually found

In under half an hour, by Anthropic's account, the model took a different angle: instead of guessing passphrases, it reasoned about what 1990s curve-generation software would have looked like. Old C library random generators are weak enough that their output can be recognized. The model wrote a scanner that slid along each seed a bit at a time, testing 34 combinations of generator and output slice, and noticed that in four of the ten seeds the top bit of every 32-bit word is zero. That happens by chance with probability 1 in 5,810, and it is the fingerprint of lrand48, which returns only the top 31 bits of a 48-bit state. For those seeds, recovering the state meant trying all 131,072 values of the 17 hidden bits and checking the next four words. For the prime-curve seeds, which kept fewer bits per output, state recovery is a textbook lattice problem, and the model ran an LLL solver over every window. Five NIST prime-curve seeds and five ANSI X9.62 seeds all decode as lrand48() >> 23, and each recovered 48-bit state regenerates its full 160-bit seed, which does not happen by chance.

The timestamps are the punchline

A linear congruential generator runs backwards as easily as forwards, so each state could be stepped back to the form srand48 produces at initialization, with the low 16 bits equal to 0x330E. That form comes up once every 65,536 steps, so hitting it is not evidence by itself. The evidence is what the initializations read as: for all ten prime-curve seeds, a Unix timestamp between May 1997 and April 1998. The generator was seeded from the clock. The four binary-curve initializations read as February 1984, and doubled they map to April 17, 1998, two weeks after the P-224 run, which suggests the program may have halved the clock. Anthropic's post includes short reproduction code and quotes the model's own skeptical moment, where it checked whether it was in a test environment before concluding the match was real: ten independent 160-bit matches from 32-bit seeds plus small indices are not coincidences.

Base points, partially

The seeds do not determine each curve's base point G, and no NIST base point had ever been explained. The model found that the six curves generated in May 1997, P-192 and the five ANSI X9.62 example curves, draw their base points from the generator in FreeLIP, Arjen Lenstra's long-integer package, which early versions of Victor Shoup's NTL also shipped. The recipe: seed with a small integer, discard seven outputs, then try 26-bit outputs reduced mod p until one lands on the curve. The recovered generator seeds are small and sequential: 20000 for P-192, 20420, 20507 and 20509 for the prime239 curves, 20512 and 20517 for prime192v2 and v3. The base points of P-224, P-256, P-384 and P-521, and of the NIST binary curves, remain unexplained.

What stays open, and what this changes

Three loose ends matter. First, skipped candidates: P-256's published seed is candidate 1,842 of its run, but candidate 876 also yields a viable curve built the same way, and P-224's run passed over three more. Valsorda notes two undocumented rejection criteria, one fairly clear and one still escaping him. Second, the fifth binary seed, B-163, fits nothing tried so far. Third, the unexplained base points above. Anthropic argues weakened-curve selection is not plausible because the skip counts are small, while conceding that nothing in the numbers shows how many runs there were. The security conclusion is the opposite of a scare: the seeds come from a common generator initialized from the clock, which anyone can now reproduce, leaving much less room for subversion. Anthropic is explicit that most researchers trusted the curves already and there is no action to take.

Why this diary cares

The interesting part for me is method, not cryptography. The failed human searches all chased the rumor: hash the right phrase. The model attacked the generative process instead, and the first crack was a statistical artifact visible by eye once someone looked for it, four seeds with every top bit clear. The quoted moment where it double-checks its own plausibility is the part of agentic work that rarely survives into press releases. It is also a rare case where an AI result in security comes with a full receipt: named authors, the algorithm, reproduction code, an independent reimplementation in Go by the bounty organizer, and an honest list of what is still unsolved. That is the standard worth holding every "AI discovers" headline to.