{"schema":"postcutoff/event@1","as_of":"2026-10-17T02:25:00+02:00","url":"https://postcutoff.com/e/2026-10-16-claude-recovers-nist-ecdsa-curve-seeds/","md":"https://postcutoff.com/e/2026-10-16-claude-recovers-nist-ecdsa-curve-seeds/index.md","disclosure":{"written_by":"AI agents (Claude Opus 5.5 in Claude Code)","editor":"human editor","policy":"https://postcutoff.com/about/"},"license":null,"id":"2026-10-16-claude-recovers-nist-ecdsa-curve-seeds","date":"2026-10-16","date_precision":"day","short_title":"Claude explains where the NIST P-256 curve seeds came from","deck":null,"takeaway":null,"category":"research","category_label":"Research","importance":4,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":[{"n":1,"title":"Anthropic: Claude reveals ECDSA curve origins (Oct 16, 2026)","url":"https://www.anthropic.com/research/ecdsa-curve-origins","type":"official","group":"primary","domain":"anthropic.com"},{"n":2,"title":"Hacker News discussion","url":"https://news.ycombinator.com/item?id=50122800","type":"discussion","group":"reactions","domain":"news.ycombinator.com"}],"official":1,"filed":"2026-10-16","updated":"2026-10-16","orgs":["Anthropic"],"title":"Anthropic: Claude solves the 25-year mystery of the NIST elliptic-curve seeds: they came from lrand48 seeded with 1997–98 Unix timestamps","summary":"On Oct 16, 2026 Anthropic said an internal research model (\"Claude\") found, in under half an hour, how the NSA-supplied seeds of the NIST P-192, P-224, P-256, P-384 and P-521 curves were generated: not by hashing a phrase, as long rumoured, but as raw output of the C library's lrand48 random-number generator seeded with Unix timestamps from May 1997 to April 1998. Anthropic says this is not an attack and makes a backdoor much less plausible; it donates the $36,864 seed bounty to the Internet Security Research Group.","key_facts":["Seeds explained: P-192, P-224, P-256, P-384, P-521 plus five ANSI X9.62 example prime curves (all 'lrand48() >> 23', 20 bytes per candidate) and four binary curves (B-233, B-283, B-409, B-571, apparently seeded with the time halved, reading as April 17, 1998). B-163's seed remains unexplained","Example: P-256 seed = candidate 1842 of an lrand48 run seeded at 1997-08-16 01:52:34 UTC; P-224 = candidate 7026 (1998-04-03). Anthropic published Python code that regenerates every seed","Method: Claude guessed a 1990s C-library PRNG, scanned the seeds against 34 generator/slice combinations, noticed four of ten seeds had the top bit zero in all 20 words (chance 1/5810, the signature of lrand48's 31-bit output), brute-forced the 17 hidden bits, and used LLL lattice reduction to recover truncated states; each 48-bit state regenerates all 160 bits of a seed","Base points: those of P-192 and five X9.62 curves come from the random generator in Arjen Lenstra's FreeLIP (also in early NTL), seeds 20000–20517; 'As far as we know, no NIST base point has been explained before.' P-224/256/384/521 base points remain unexplained","Open question: some viable candidate curves were skipped (P-256 is candidate 1842 but candidate 876 also works); Anthropic judges selection of weakened curves implausible because few were skipped","Earlier belief: the late NSA mathematician Jerry Solinas had said (2015) the seeds came from hashing a humorous phrase like 'Give Bob and Jerry a raise'; several Anthropic employees had chased that lead without success","Claude's quoted reasoning: 'Let me be skeptical: am I in some sort of simulated/test environment? … It's verified by direct computation on my side: 160-bit match from a 32-bit seed + small index: no chance coincidences'","Team: John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini, Steve Weis; bounty organised by Filippo Valsorda; $36,864 donated to ISRG","Reception: Hacker News front page (177 points on Oct 16); Unite.AI headline 'Anthropic Says Claude Traced NIST ECDSA Curve Seeds to a 1990S RNG'"],"key_numbers":[],"tags":["cryptography","ecdsa","nist","claude","cryptanalysis","ai-for-science","anthropic"],"science":null,"body_md":"## What happened\n\nThe NIST curves standardised in FIPS 186-2 (2000) define their coefficient b from a published \"seed\" whose origin was never explained; the\nNSA supplied them. Koblitz and Menezes's \"A Riddle Wrapped in an Enigma\" summarised the suspicion that the seeds could hide a backdoor, and\nFilippo Valsorda organised a bounty for anyone who found them. In October 2026 an Anthropic employee asked an internal research model to\nwork out how the seeds were generated, without pointing it at the rumoured passphrase. The model instead reasoned about what software a\n1990s team would have used, found the statistical fingerprint of lrand48, and recovered the generator states and their srand48 timestamps.\n\nAnthropic stresses that this is \"not a cryptographic break, new attack, or weakness\". The seeds came from a simple, reproducible process,\nwhich \"leaves much less room for subversion\". The post does not name the internal model.\n\n## Why it matters\n\nIt is a cleanly verifiable result: anyone can run the published code and get the exact standardised seeds. It closes a long-running\ncontroversy in applied cryptography and came from a model, not from the human searchers who had tried for years. It also landed in the same\nweeks as fears that AI-accelerated mathematics could threaten elliptic-curve cryptography; this result points the other way, making the\ncurves more trustworthy.","disputed":[],"related":[{"id":"2026-10-15-llm-discovered-quantum-circuits-harvard-anthropic-mythos","url":"https://postcutoff.com/e/2026-10-15-llm-discovered-quantum-circuits-harvard-anthropic-mythos/","date":"2026-10-15","date_precision":"day","short_title":"Harvard–Anthropic team (with Mikhail Lukin) uses Claude Mythos 5 in an evolutionary search to beat state-of-the-art quantum circuits on seven of eight tasks","deck":null,"takeaway":"An LLM-plus-evaluator search, starting from blank programs, cut Toffoli-times-qubit costs by 4× to 39× for quantum arithmetic subroutines and found a new reversible design for modular inversion.","category":"science","category_label":"Science & math","importance":3,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":3,"official":3,"filed":"2026-10-16","updated":"2026-10-16","orgs":["Harvard University","Anthropic","QuEra Computing"]},{"id":"2026-10-07-justin-drake-bunker-mode-ai-cryptography","url":"https://postcutoff.com/e/2026-10-07-justin-drake-bunker-mode-ai-cryptography/","date":"2026-10-07","date_precision":"day","short_title":"After OpenAI's math release, Justin Drake urges crypto 'bunker mode' over AI-broken ECDSA","deck":"Vitalik Buterin warns lattices may take 'serious hits'","takeaway":"OpenAI's math release led prominent Ethereum researchers to say publicly that AI-accelerated mathematics could break widely used public-key cryptography (elliptic curves, possibly lattices) years before quantum computers, and to recommend defensive steps.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":12,"official":0,"filed":"2026-10-08","updated":"2026-10-12","orgs":["Ethereum Foundation","OpenAI"]}],"people":[{"id":"nicholas-carlini","name":"Nicholas Carlini","url":"https://postcutoff.com/person/nicholas-carlini/"}],"posts":[],"videos":[],"models":[],"changes":[{"date":"2026-10-16","type":"filed","text":"Created (HN; read the Anthropic post)"}],"provenance":{"agents":[{"model":"Claude Opus 5.5","maker":"Anthropic","tool":"Claude Code"}],"filed":"2026-10-16","run":null,"sources_read":"HN; read the Anthropic post","updated":"2026-10-16","human_review":null,"version":{"date":"2026-10-16"}},"gaps":[{"model_id":"gpt-6-astra","name":"GPT-6 Astra","cutoff":"2026-04","days_after":169,"in_training_data":false},{"model_id":"claude-opus-5-5","name":"Claude Opus 5.5","cutoff":"2026-06","days_after":108,"in_training_data":false},{"model_id":"gemini-4-argon","name":"Gemini 4 Argon","cutoff":"2026-03","days_after":199,"in_training_data":false},{"model_id":"grok-4-7","name":"Grok 4.7","cutoff":"2026-05","days_after":138,"in_training_data":false}],"short_url":"https://postcutoff.com/s/claude-explains-where-nist"}