Claude explains where the NIST P-256 curve seeds came from
Confirmed
Importance: major (4 of 5)Status
- Claim
Confirmed
- Our reporting
- High confidence
- Importance
- Major (4 of 5)
- Last verified
- 16 October 2026
Your AI and this story
- GPT-6 Astra169 days after its cutoff
- Claude Opus 5.5108 days after its cutoff
- Gemini 4 Argon199 days after its cutoff
- Grok 4.7138 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 108 days before it.
Key facts
- Seeds explained: P-192, P-224, P-256, P-384, P-521 plus five ANSI X9.62 example prime curves (all ‘lrand48() >> 23’, 20 bytes per candidate) and four binary curves (B-233, B-283, B-409, B-571, apparently seeded with the time halved, reading as April 17, 1998). B-163’s seed remains unexplained
- Example: P-256 seed = candidate 1842 of an lrand48 run seeded at 1997-08-16 01:52:34 UTC; P-224 = candidate 7026 (1998-04-03). Anthropic published Python code that regenerates every seed
- Method: Claude guessed a 1990s C-library PRNG, scanned the seeds against 34 generator/slice combinations, noticed four of ten seeds had the top bit zero in all 20 words (chance 1/5810, the signature of lrand48’s 31-bit output), brute-forced the 17 hidden bits, and used LLL lattice reduction to recover truncated states; each 48-bit state regenerates all 160 bits of a seed
- Base points: those of P-192 and five X9.62 curves come from the random generator in Arjen Lenstra’s FreeLIP (also in early NTL), seeds 20000–20517; ‘As far as we know, no NIST base point has been explained before.’ P-224/256/384/521 base points remain unexplained
- Open question: some viable candidate curves were skipped (P-256 is candidate 1842 but candidate 876 also works); Anthropic judges selection of weakened curves implausible because few were skipped
- Earlier belief: the late NSA mathematician Jerry Solinas had said (2015) the seeds came from hashing a humorous phrase like ‘Give Bob and Jerry a raise’; several Anthropic employees had chased that lead without success
- Claude’s quoted reasoning: ‘Let me be skeptical: am I in some sort of simulated/test environment? … It’s verified by direct computation on my side: 160-bit match from a 32-bit seed + small index: no chance coincidences’
- Team: John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini, Steve Weis; bounty organised by Filippo Valsorda; $36,864 donated to ISRG
Show 1 more
- Reception: Hacker News front page (177 points on Oct 16); Unite.AI headline ‘Anthropic Says Claude Traced NIST ECDSA Curve Seeds to a 1990S RNG’
What happened
The NIST curves standardised in FIPS 186-2 (2000) define their coefficient b from a published “seed” whose origin was never explained; the NSA supplied them. Koblitz and Menezes’s “A Riddle Wrapped in an Enigma” summarised the suspicion that the seeds could hide a backdoor, and Filippo Valsorda organised a bounty for anyone who found them. In October 2026 an Anthropic employee asked an internal research model to work out how the seeds were generated, without pointing it at the rumoured passphrase. The model instead reasoned about what software a 1990s team would have used, found the statistical fingerprint of lrand48, and recovered the generator states and their srand48 timestamps.
Anthropic stresses that this is “not a cryptographic break, new attack, or weakness”. The seeds came from a simple, reproducible process, which “leaves much less room for subversion”. The post does not name the internal model.
Why it matters
It is a cleanly verifiable result: anyone can run the published code and get the exact standardised seeds. It closes a long-running controversy in applied cryptography and came from a model, not from the human searchers who had tried for years. It also landed in the same weeks as fears that AI-accelerated mathematics could threaten elliptic-curve cryptography; this result points the other way, making the curves more trustworthy.
Sources
2 sources from 2 sites. Numbers match the chips in the text.
2 sources: 1 primary, 1 reaction
Primary
- Anthropic: Claude reveals ECDSA curve origins (Oct 16, 2026)anthropic.com, official
Reactions
- Hacker News discussionnews.ycombinator.com, discussion
Changes
- Filed (HN; read the Anthropic post)