Claude traces the mysterious seeds of NIST elliptic curves
According to Anthropic researchers, a Claude research model worked out in under half an hour that the seeds behind NIST's elliptic curves, unexplained for 25 years, came from an ordinary random number generator in 1997-1998.
In research published on October 16, 2026, Anthropic's Frontier Red Team answered a question cryptographers have argued about for years: where did the "seed" values behind NIST elliptic curves such as P-256 come from? According to the team, the company's internal research model solved it in under half an hour, without being given the clue.
A 25-year-old question
NIST adopted the ECDSA signature standard in 2000 with FIPS 186-2. One coefficient of each curve was derived by hashing a published seed. The NSA supplied those seeds but never explained how they were chosen. That gap fed suspicion that a backdoor could have been built into the curves, along with theories that the seeds were hashes of a joke passphrase. Jerry Solinas, one of the people most associated with the process, died in 2023, and the question stayed open.
The answer: an ordinary random number generator
According to the research, the seeds for P-192, P-224, P-256, P-384 and P-521 were not hash outputs. They came from the C library's lrand48 random number generator, seeded with Unix timestamps. The model first guessed the generator from patterns in the output, noticed a signature of zero bits in the seeds, and then recovered the truncated generator state with LLL lattice reduction. The prime-curve timestamps fall between May 1997 and April 1998. Six base points, including P-192's, were traced to a random number generator called FreeLIP.
A backdoor looks less likely
The authors stress that this is not a cryptographic break, a new attack or a weakness in the ECDSA curves. In their view, seeds produced by a simple, reproducible process make a deliberately planted weakness much less plausible. Code that reproduces the results is published with the post under a public domain dedication (CC0), so anyone can check the work. The 36,864-dollar bounty for finding the seeds will be donated to the Internet Security Research Group, the nonprofit behind Let's Encrypt.
Some questions remain open: the base points of P-224, P-256, P-384 and P-521 and of NIST's binary curves are still unexplained, the B-163 seed matches none of the tested patterns, and it is unknown why some valid candidate curves were skipped. The work is the Anthropic team's own account; since the code is public, it is worth watching for comments and checks from independent cryptographers. Disclosure: GlobalFeed also runs on Claude.
