Anthropic's Frontier Red Team said on October 16, 2026 that Claude has explained where the seeds behind the NIST elliptic curves came from, a question cryptographers have argued about for roughly 25 years. The curves, adopted in 2000 in the FIPS 186-2 Digital Signature Standard and used by ECDSA, were derived from seed values the NSA supplied without explanation. According to Anthropic, the seeds for P-192, P-224, P-256, P-384 and P-521 were not hashes of a phrase at all. They were output from the C library's lrand48 pseudorandom number generator, initialised with Unix timestamps.
The provenance mattered because each published seed is hashed to produce the curve's coefficient b. With no account of how the seeds were chosen, some researchers suspected that curves might have been selected with hidden weaknesses. The best-known explanation came from longtime NSA employee Jerry Solinas, who said in 2015 that the seeds came from hashing a humorous passphrase. Solinas died in 2023, and Anthropic says several of its own employees had chased that lead without success.
The breakthrough came quickly once the clue was set aside. In October, an Anthropic employee asked an internal research model to work out how the seeds were generated, and Claude solved it in under half an hour. It reasoned that the generating software probably used a weak 1990s C-library generator whose output could be recognised, and wrote a scanner covering 34 combinations of generator and output slice. It then spotted that in four of the ten seeds the top bit of every 32-bit word was zero, a pattern with a chance probability of about 1 in 5,810 and a signature of lrand48, which returns only the top 31 bits of a 48-bit state. Brute-forcing the 17 hidden bits recovered those states. For the prime-curve seeds, which keep fewer bits of each output, Claude treated state recovery as a lattice problem and solved it with LLL basis reduction. Five NIST prime-curve seeds and five from the ANSI X9.62 standard all matched the same pattern, and each recovered 48-bit state regenerates all 160 bits of its seed.
Because this generator runs backwards as easily as forwards, Claude stepped each state back to the form produced by srand48 initialisation. For the ten prime-curve seeds, those initial values read as Unix timestamps between May 1997 and April 1998. The four binary-curve values decode to February 1984, but doubled they land on April 17, 1998, two weeks after the P-224 run, which suggests the original program may have halved the clock. The published P-256 seed was the 1,842nd candidate drawn in its run.
Claude also explained some base points, the fixed point every ECDSA public key is a multiple of. Anthropic says the base points of six curves generated in May 1997, P-192 and five ANSI X9.62 example curves, come from the random number generator in Arjen Lenstra's FreeLIP library, seeded with small integers such as 20000 for P-192. As far as Anthropic knows, no NIST base point had been explained before. The base points of P-224, P-256, P-384 and P-521 remain unexplained, as does the seed of the binary curve B-163.
Anthropic is explicit that this is not a break, a new attack or a weakness in the curves, and that nobody needs to change anything. Its reading is that the finding makes a deliberate backdoor much less plausible, since the seeds came from a simple, reproducible process. One open question remains: some candidate seeds that would also have produced valid curves were skipped, for example candidate 876 in the P-256 run. Anthropic judges the number too small to suggest weakened curves were selected, but says the selection criteria are unknown.
The analysis is published as a blog post rather than a peer-reviewed paper, and no independent reproduction by outside cryptographers was found at publication, although the method is deterministic and described in enough detail for others to check.