Claude traces the origins of NIST’s elliptic-curve seeds to 1990s timestamps

For decades, the origins of the seed values used in widely deployed elliptic-curve cryptography were an open question: the NSA supplied the values to NIST without explaining how they had been generated. Anthropic says Claude has now traced most of them to a mundane source—the output of a 1990s C-library random-number generator initialized with Unix timestamps.

The seeds are part of the specifications for the NIST curves used with the Elliptic Curve Digital Signature Algorithm, or ECDSA. In October 2026, an Anthropic employee asked an internal research model to investigate their provenance without steering it toward the old rumor that the values came from a hashed joke. Anthropic reports that Claude identified the origins of five NIST prime-curve seeds in under half an hour.

The model’s proposed explanation was that software generated candidate seeds using lrand48, a pseudorandom-number generator, with its state initialized from a timestamp. It recovered timestamp-based states for the five NIST prime-curve seeds and four of the five binary-curve seeds. Anthropic also found the same pattern in five ANSI X9.62 prime-curve seeds. The company has published code intended to reproduce the results.

Anthropic says the finding is not a cryptographic break and does not require users to change anything. The company argues that a simple, reproducible generation process makes deliberate backdoors less plausible than critics had feared. That is the researchers’ interpretation of the evidence, not a proof of every step in the original selection process.

Significant gaps remain. Anthropic could not explain the B-163 binary-curve seed, nor determine how the base points for P-224, P-256, P-384 and P-521 were generated. It also found that some viable candidate curves were skipped during the apparent generation runs, but says it does not know why. The company says the small number of skipped candidates does not make intentional weakening plausible, while acknowledging that the published numbers do not show how many runs were made.

The work offers a partial answer to a controversy that had included speculation about NSA backdoors and a bounty for recovering the seeds. Anthropic says the $36,864 bounty will go to the Internet Security Research Group. It also credits Claude with tracing the base points of six curves dating to May 1997 to a random-number generator in the FreeLIP arithmetic package, while leaving the origins of other base points unresolved.