Claude solves 25-year-old crypto mystery behind NIST curve seeds

For twenty-five years, the cryptography community had a lingering doubt: did the NSA slip a secret backdoor into the elliptic curves protecting global internet traffic?

Back in 2000, NIST standardized ECDSA curves in FIPS 186-2. The specifications included arbitrary "seed" numbers to determine key curve coefficients, but the NSA never explained where those seeds came from. For a quarter-century, the mystery fueled conspiracy theories and a cash bounty.

In October 2026, an Anthropic researcher casually tossed the mystery to an internal Claude research model without giving away the usual rumors. In under 30 minutes, Claude cracked the 25-year-old riddle.

No secret spy codes, just lazy C programmers

For years, researchers chased a rumor from late NSA mathematician Jerry Solinas, who hinted in 2015 that the seeds came from hashing a funny passphrase like "Give Bob and Jerry a raise." But Solinas passed away in 2023, his co-worker couldn't recall details, and passphrase brute-forcing led nowhere.

Claude took an entirely different angle: what if 1990s NSA developers just used standard tools of their era?

The model hypothesized that the original engineers relied on a pseudorandom number generator (PRNG) shipped with 1990s C standard libraries. Claude built a custom scanner, tested 34 generator-and-slice combinations, and noticed a striking anomaly: several seeds had all top bits set to zero, a classic fingerprint of the weak linear congruential generator lrand48.

From there, Claude treated state recovery as a textbook lattice problem, running the Lenstra–Lenstra–Lovász (LLL) algorithm. It successfully reverse-engineered the internal states for all five NIST prime curves and five ANSI X9.62 curves.

The truth turned out to be mundane. The NSA developers initialized lrand48 with straightforward Unix timestamps between May 1997 and April 1998, then repeatedly pulled 20-byte chunks. The P-256 curve simply grabbed candidate number 1,842.

Claude also cracked the origin of base points for P-192 and several ANSI curves, tracing them back to Arjen Lenstra's FreeLIP library. The $36,864 research bounty is being donated to the Internet Security Research Group (ISRG).

Why it matters

First, take a breath: this is great news for internet security. Proving that the seeds came from an off-the-shelf PRNG initialized by the clock basically eliminates the possibility of an intentional NSA backdoor. The crypto community can stop second-guessing the foundational math powering modern digital signatures.

Second, this is a massive milestone for AI-assisted research. Claude wasn't handed the solution. It autonomously formed a plausible historical hypothesis, authored detection code, applied sophisticated lattice reduction mathematics, and verified its own logic—all in less time than a lunch break.

We think this shows AI moving rapidly from "autocomplete for coders" to legitimate domain investigator. In forensic archaeology and reverse engineering, a model with vast historical context can outpace human teams trapped by prevailing community assumptions.

A few small mysteries remain, like why certain valid candidate curves were skipped before candidate 1,842 or how the B-163 seed was generated. But as a whole, an iconic piece of cryptographic paranoia just got cleanly laid to rest.