Anthropic's Claude Solves the NSA Elliptic Curve Seed Mystery in 30 Minutes

Written by Daii

Conclusion first: Claude did not break elliptic curve cryptography, did not compute anyone's private key, and did not render TLS or Bitcoin suddenly obsolete. What it cracked was a piece of cryptographic history—how the NSA originally generated several public "seeds" it provided to standards organizations.

This distinction is important. Calling it "AI breaks into global crypto in half an hour" is wrong; dismissing it as insignificant digital archaeology underestimates it.

This discovery simultaneously illustrates four points: one, the likelihood that the most commonly used set of NIST elliptic curves was intentionally backdoored has significantly decreased; two, the "verifiable randomness" in standards still only verifies half the trust chain if the origin of the initial input cannot be explained; three, state-of-the-art models can now chain together literature comprehension, hypothesis generation, code writing, statistical testing, and lattice algorithms into a single autonomous research effort; four, the more realistic cryptographic impact of AI is not today’s sudden breaking of 256-bit private keys, but rather the ability to inexpensively examine protocols, implementations, and legacy systems that have long been neglected by auditors.

Elliptic curves can be roughly understood as a common "lock design." Each user has their own private key, but those using the same curve share a set of public parameters. For curves over prime fields, the standard equation is written as:

`y² = x³ + ax + b (mod p)`

The true standard also specifies parameters such as the finite field `p`, coefficients `a` and `b`, the base point `G`, the order of the base point `n`, and the cofactor `h`. The private key is not among these parameters; it is a secret number generated independently by the user within this set of public rules.

The FIPS 186-2, released in 2000, included curves such as P-192, P-224, P-256, P-384, and P-521. The NSA provided the curves along with 160-bit seeds, and the standard specified that curve coefficients be derived from the seeds using steps such as SHA-1. Anyone with the seed can recalculate to verify that "this seed indeed produces these coefficients."

The issue is: why is the seed itself 160 bits?

It's like a lottery organization has published the winning numbers and the drawing algorithm, but hasn't shown which set of balls was originally placed into the machine, or why that particular set was chosen. If the designer tested countless seeds and ultimately selected one curve with a hidden vulnerability, subsequent observers who only verify that "the seed can generate the curve" cannot rule out such selection.

Cryptography refers to parameters derived through defined steps from π, the natural constant, or public text as "nothing-up-my-sleeve numbers": the point is not that these numbers are more sacred, but that the selection process has no hidden knobs. The seed for NIST curves is public, but its origin is not explained, so it is formally "verifiably random" yet auditably opaque.

This distrust did not arise out of nowhere. After 2013, the Dual_EC_DRBG random number generator, which the NSA was involved in promoting, was widely regarded as having a backdoor risk exploitable by those who掌握 special parameter relationships, leading NIST to withdraw it. Dual_EC_DRBG is not the same as the NIST P curves discussed here, but it fundamentally shifted public tolerance for the notion of “trust the parameter selectors.” Neal Koblitz and Alfred Menezes systematically reviewed the controversy in their 2015 paper A Riddle Wrapped in an Enigma; in 2023, cryptographers including Filippo Valsorda established a bounty to identify the seed’s origin.

The most widely circulated clue came from NSA mathematician Jerry Solinas: the seed might have been a hash of a humorous phrase like “give Bob and Jerry a raise.” Anthropic employees tried following this lead but were unsuccessful. Solinas passed away in 2023, and the original program and archives have not been found, leaving the puzzle seemingly destined to remain in oral history.

In October 2026, an Anthropic employee submitted a problem to an internal research model without disclosing its specific version or providing the clue “joke phrase.” According to Anthropic’s research note issued on October 16, the model found a way to generate the output in less than half an hour.

The key isn't brute-forcing all English sentences, but changing the question: What software would a 1997 engineer most likely have used to generate these seemingly random bytes?

Claude examined 34 combinations of legacy pseudorandom number generators and output slices, sliding bit by bit along the seed to look for patterns in consecutive outputs. It found that for certain seeds, the most significant bits of several 32-bit words were consistently 0. This is not a security proof, but it resembles the tooth marks left by a machine: the POSIX/C library function `lrand48()` outputs only the upper 31 bits of its 48-bit internal state at a time, exactly producing this pattern.

For seeds that retained many output bits, brute-forcing the 17 hidden low bits can recover the internal state. More challenging are the five NIST prime curves and the five ANSI X9.62 curves: the generating program retained only the fragment `lrand48() >> 23`. Claude reformulated the problem as "state recovery of a truncated linear congruential generator" and used the LLL lattice reduction algorithm to find short vectors satisfying multiple approximate linear relationships.

In simple terms, it’s like only seeing a few digits of an old-fashioned odometer each time it turns. A single reading isn’t enough; but multiple consecutive readings, combined with the gear mechanism’s rules, are sufficient to reconstruct the hidden digits. Here, LLL isn’t breaking elliptic curves—it’s efficiently piecing together many truncated arithmetic constraints.

After restoring the 48-bit state, the linear congruential generator `lrand48` can be computed both forward and backward. Claude reversed the state to the point where, after `srand48(t)` initialization, the lower 16 bits were fixed at `0x330E`, then interpreted the higher bits as a Unix timestamp. The result was not a vague era, but a set of specific UTC moments falling between 1997 and 1998:

| Curve | UTC time of `srand48` | Which 20-byte candidate was hit |

|---|---:|---:|

| P-192 | 1997-05-18 14:45:34 | 139 |

| P-521 | 1997-08-08 01:12:04 | 1,136 |

| P-256 | 1997-08-16 01:52:34 | 1,842 |

| P-384 | 1997-08-30 14:50:08 | 2,688 |

| P-224 | 1998-04-03 12:52:07 | 7,026 |

Taking P-256 as an example, initializing the generator with the timestamp `871696354` and proceeding through the byte retrieval method until the 1,842nd candidate yields the full 160-bit seed `C49D3608 86E70493 6A6678E1 139D26B7 819F7E90` as specified in the standard—not merely "similar," but bit-for-bit identical.

This kind of match is hard to explain away as coincidence. More importantly, the bounty initiator Valsorda independently rewrote and reproduced the generation process in Go, confirming that these timestamps and candidate numbers can regenerate the published seed. In other words, the discovery points to an internal model from Anthropic, but the conclusion does not require the public to believe the model’s own claims.

The most confusing in the news are three completely different "random numbers".

The first is the seed for the curve parameters. It is public design material used to determine which "lock" everyone adopts. This is what was just recovered. The `lrand48` seeded by a clock in 1997 was weak, but here the output was public from the start; attackers predicting it would not gain any user private keys.

The second is the random number for the user's private key. If a wallet truly generated private keys using `lrand48` combined with a timestamp, they could potentially be reversed, and funds might be stolen. However, this discovery does not indicate that NIST curve users generated private keys in this manner.

The third is the nonce used in each ECDSA signature. Repeating or predictable nonces can leak private keys — a serious vulnerability that has occurred in the real world; modern implementations commonly use deterministic or additional-randomness-enhanced signing methods to reduce this risk. It is also not the curve seed found in this case.

Thus, “seeds come from a weak PRNG” and “the curve cryptography is broken by a weak PRNG” may sound only slightly different, but their security implications are exactly opposite. Here, the reversibility of the weak generator helped researchers reconstruct the historical process; it did not weaken the discrete logarithm problem of the curve, nor did it reduce the difficulty of searching for existing private keys.

The most important cryptographic implication of this discovery is that it narrowed the design choices available to the creators at the time.

A hypothetical "select-curve backdoor" does not require placing a visible door in the equation. The designer could possess knowledge of how to identify a certain class of extremely rare weak curves and then secretly test numerous seeds until selecting one that only they know how to exploit. Daniel J. Bernstein and Tanja Lange described a scenario: if the selector has approximately 70 degrees of freedom, they might target a hypothetical class of weak curves with a size of about `2⁶¹`.

The reproducible timeline compresses the space so much. Valsorda’s conservative estimate is that even if designers were allowed to pick any moment within each second between 1997 and 1998, and then select one from the first 16 qualified candidates, there would be only about 30 bits of selection freedom. Thirty bits is not zero, but it is far too few to perform the targeted selection of 70 bits described above. This does not logically prove that the NSA could not have known any mathematics unknown today in 1997, but it eliminates the most specific and most discussable class of selection mechanisms, making the claim that a NOBUS backdoor was inserted via exhaustive seed searching much more difficult.

Three footnotes still need to be retained.

First, the program skipped some candidates that appeared to meet the criteria. A prime-order curve satisfying known conditions appeared at the 876th candidate for P-256, yet the final selection was the 1,842nd; similarly, P-224 skipped three candidates. The team identified one additional filtering rule, but another remains unclear. Skipping a small number of candidates does not imply a backdoor—hitting an extremely rare weakness by chance with so few selections would require weak curves to be common—but the complete history has not yet been reconstructed.

Second, the seed determines the curve coefficient `b`, but not the base point `G`. Claude identified the sources of the base points for P-192 and several ANSI example curves, yet still did not explain how the base points for P-224, P-256, P-384, and P-521 were selected.

Third, the B-163 seed in the binary field curve has not yet been recovered, while several other binary field curves may have used a "time divided by two" initialization method. Therefore, the most accurate statement is not that "all mysteries surrounding NSA curves have been solved," but rather: the origins of the seeds for the five core NIST prime curves have been reproducibly explained, the primary suspicion of a seed backdoor has significantly diminished, and some details of parameter selection remain open questions.

There is a connection, but not as the background material claims—that “these seeds are the foundation of Bitcoin’s TLS digital signatures.” This sentence conflates three distinct concepts.

TLS is the protocol used by browsers, servers, and other systems to establish secure connections. NIST P-256 (also known as secp256r1) has long been used in TLS for key exchange or ECDSA certificate signing, so this discovery does involve a curve widely deployed across the internet. The takeaway is increased confidence, not an urgent need to replace certificates; Anthropic has explicitly stated that no action is required from users.

Bitcoin uses a different curve, secp256k1. Although it shares a similar name and belongs to the same family of elliptic curves as NIST P-256/secp256r1, it is not the same curve and was not generated from the NSA seed recovered in this instance. SEC 2 standard expresses the equation of secp256k1 in its minimal form: `y² = x³ + 7`; BIP 32 also explicitly specifies that Bitcoin uses secp256k1. Traditional Bitcoin transactions use ECDSA on this curve, while Taproot employs Schnorr signatures on the same curve.

Therefore: this discovery does not affect Bitcoin private keys, does not explain why Satoshi chose secp256k1, nor does it change the long-term issue that quantum computers may one day use Shor’s algorithm to threaten elliptic curve cryptography. Equating “elliptic curve” with “Bitcoin has been broken” is like finding the design blueprints for a specific lock and declaring all doors using metal keys compromised.

If you only look at the answer, “It’s just a timestamp” seems too simplistic. What truly matters is the path that led to the answer.

Claude did not simply retrieve a pre-existing fact from its training memory. According to Anthropic’s account, it formulated a hypothesis contrary to popular belief, wrote a scanner to compare the output structures of dozens of old PRNGs, identified `lrand48` through statistical anomalies, invoked LLL for truncated output, reconstructed its state, backtracked to its initialization form, and verified the result using a full 160-bit match. Subsequently, human researchers compiled, reviewed, and released runnable code, which was independently verified by external cryptographers.

This is a "small-scale research loop":

Read the problem → Form a hypothesis → Design a test → Build a tool → Handle failures → Solve mathematically → Cross-validate → Provide a reproducible experiment

Previous models could often explain what LLL is and write a linear congruential generator; this time, the improved capability lies in knowing when to connect the two in the absence of a standard solution path. It shows that state-of-the-art models are shifting from “answering existing questions” to “generating new evidence within tool environments.” This ability will deliver real productivity gains in software archaeology, malicious sample analysis, protocol fuzzing, formal proof assistance, and standard audits.

But “half an hour” must be interpreted correctly. Cryptographers have not been brute-forcing this problem continuously for 25 years, eight hours a day. Humans have already established standards, proposed backdoor models, saved seeds, invented LLL, implemented computational software, and packaged the problem as a public bounty. The model stands atop this entire body of knowledge and toolchain, rapidly finding combinations that no one had seriously tested before. It compresses the marginal time of a research search—not magically replacing 25 years of scientific accumulation.

Meanwhile, the public materials do not provide the exact version of the internal model, the full original conversation, failed branches, computational cost, or details of human intervention within half an hour. Thus, it is certain that the generation method and results—these have been reproduced in code; the narrative of “fully autonomous, under half an hour” primarily comes from Anthropic itself and is insufficient as a rigorous, reproducible model benchmark. Distinguishing between verifiable outcomes and vendor claims about capabilities is the most fundamental discipline in evaluating AI research.

This incident does not imply that AI will violently compute P-256 private keys tomorrow. Under classical computing, the security of mature elliptic curves stems from the enormous discrete logarithm problem; being able to write code and use LLL does not equate to overcoming exponential complexity.

More recent changes have occurred elsewhere: security systems contain numerous black boxes with mathematics that are not inherently flawed but have obscure origins, outdated implementations, and complex compositions. These have gone unexamined for years not because they are unsolvable, but because documentation is scattered, testing spaces are cumbersome, and the returns are uncertain, making it difficult to sustain the attention of top researchers. AI capable of reading old papers, generating probing code, and running tools for extended periods will significantly reduce the cost of such audits.

This is a double-edged sword. Defenders can batch-review standard parameters, search for weak random number fingerprints, and inspect historical code in the supply chain; attackers can also more quickly uncover vulnerabilities in obscure protocols, firmware, and enterprise-specific cryptography. What is most likely to be "broken" first is rarely AES, TLS 1.3, or mainstream curves with thorough public audits—but rather systems relying on secret implementations, ambiguous parameters, and those "untouched for decades."

The correct response is not to panic and abandon NIST curves, but to make standard designs easier for machine auditing:

1. Parameter generation must originate from public, non-manipulable entropy sources or pre-committed data, with full scripts, versions, and selection rules provided;
2. Security proofs, reference implementations, and test vectors should allow anyone to reproduce the entire process end-to-end, not just verify the final step;
3. For AI discoveries, preserve complete execution logs, distinguishing between model-completed tasks, human prompts, and post-hoc organization;
4. Apply the model for defensive heritage audits, while constraining its network and execution capabilities through isolated environments, access controls, and responsible disclosure;
5. Continue advancing the post-quantum migration, but do not conflate the quantum threat with this seed溯源.

This is not a cryptographic disaster, but a reconciliation of a ledger of trust.

For the past 25 years, it was known that NIST curves could resist public analysis, but it was unclear why the initial strings of numbers were there. Today, a runnable chain—from the 1997 Unix clock, `srand48`, candidate numbers, to the standard seed—has transformed “trust the NSA didn’t tamper” into “you can reproduce how it was likely generated.” The most valuable advances in cryptography often aren’t about increasing trust, but about reducing what must be trusted.

For AI, this is a more significant signal than "solving an Olympiad problem": the model is now capable of generating new, independently verifiable evidence on real, open-ended questions with unknown answers. Today, it provides sources for a piece of crypto history; tomorrow, the same capability will be used to discover vulnerabilities—and to prove that systems lack the vulnerabilities people fear.

So what this really means is not that "AI has broken cryptography," but that the shelf life of black boxes in the cryptographic world—maintained solely by history, authority, or lack of scrutiny—is rapidly shortening.