Claude cracks the decades-old mystery of where the NIST curve seeds came from

The NIST curves P-192, P-224, P-256, P-384 and P-521 were published in FIPS 186-2 in 2000 and now sit under a huge share of the internet's signatures and key exchanges. Each curve's parameters were derived by hashing a 20-byte seed, but the NSA handed over those seeds with no account of how they were picked[1]. That gap fed years of suspicion that the curves could have been chosen to carry a hidden weakness.

The best-known explanation came from NSA cryptographer Jerry Solinas, who recalled hashing a humorous phrase along the lines of "Give Bob and Jerry a raise". Solinas died in 2023, and the trail went cold[1]. Filippo Valsorda set up a public bounty for the answer three years ago[2].

Several Anthropic staff had chased the passphrase story without luck. This month an employee asked an internal research model to figure out how the seeds were generated, without pointing it at that clue[1].

Claude guessed the software had used one of the weak random number generators that shipped with 1990s C libraries, then wrote a scanner to test whether chunks of each seed looked like consecutive outputs from such a generator. It noticed that, written as 32-bit words, four seeds had a zero top bit in every word, a pattern with odds of about 1 in 5,810 by chance and a fingerprint of lrand48[1]. For the prime-curve seeds, which kept fewer bits of each output, it recovered the generator's internal state with LLL lattice reduction, a textbook technique for this kind of problem[1].

Stepping each recovered state backwards led to starting values that decode as Unix timestamps between May 1997 and April 1998. P-256's published seed is the 1,842nd 20-byte candidate from a run started at 01:52:34 UTC on 16 August 1997[1]. Anthropic published the Python to reproduce it; we ran it and got P-256's seed back exactly.

Valsorda says he reimplemented the algorithm in Go to verify the claim. In his words, the seeds are "not the hash of some saucy sentence, but the output of drand48 seeded with the time"[2].

Yes, and arguably safer-looking than before. Anthropic says this is not a break, attack or weakness, and that seeds drawn from an ordinary, reproducible generator leave "much less room for subversion"[1]. Its framing is that readers should treat it as a "fun closing chapter", with nothing to change.

There are loose ends. Some candidate seeds that would have produced valid curves were skipped; for P-256, candidate 876 of the same run also works. Anthropic says the number of skips is too small to make deliberately weakened curves plausible, but it doesn't know the selection rule[1]. Valsorda identified one extra rejection rule and says a second still escapes them, roughly halving the valid seeds[2]. The B-163 seed remains unexplained, as do the base points of P-224, P-256, P-384 and P-521, though Claude did trace the base points of P-192 and five ANSI example curves to the random generator in Arjen Lenstra's FreeLIP library[1].

The team claimed the bounty on 15 October and donated it to ISRG, the non-profit behind Let's Encrypt, tripling it to US$36,864[2].

The cryptography result is reassuring rather than urgent. The bigger signal is the method: a model that wasn't told where to look formed its own hypothesis about 1990s tooling, built the statistical tests, ran a lattice attack and checked its own work, closing a question humans had picked at for years. Expect more of this kind of archaeology on old standards, protocols and codebases where the original authors are gone.