A mystery spanning decades about the origins of widely used cryptographic standards has been resolved by Claude, an AI model developed by Anthropic. The discovery addresses long-standing concerns about ECDSA (Elliptic Curve Digital Signature Algorithm), one of the most widely deployed cryptographic standards globally.
ECDSA was adopted by NIST in 2000 as part of the FIPS 186-2 Digital Signature Standard, which specifies a set of elliptic curves used for digital signatures. These curves include parameters called “seeds” whose origins had never been publicly explained. The NSA provided these seeds without justification, fueling decades of speculation about whether they contained intentional backdoors or weaknesses. According to the research, the NIST P-256 curve seed—SEED = C49D3608 86E70493 6A6678E1 139D26B7 819F7E90—appeared with no information about its derivation.
In October 2026, an Anthropic employee asked Claude to determine how the seeds were generated. In under half an hour, Claude discovered that the NIST P-192, P-224, P-256, P-384, and P-521 seeds were generated using the C library’s lrand48 random-number generator, seeded with Unix timestamps—not hash functions as previously theorized.
Claude’s approach involved recognizing patterns in the seed outputs. The algorithm tested whether adjacent chunks of data were consecutive outputs from 1990s-era generators. Claude noticed that for some seeds, the top bits were all zero—a signature of lrand48, which only returns the top 31 bits of a 48-bit state. This pattern would occur by chance with probability 1/5810.
To recover the internal generator state, Claude used the Lenstra–Lenstra–Lovász (LLL) lattice basis reduction algorithm, a standard mathematical technique for solving such problems. The recovered states revealed that the prime-curve seeds came from lrand48() >> 23, with each recovered 48-bit state regenerating all 160 bits of its seed.
Running the generator backwards, Claude traced each initialization to Unix timestamps between May 1997 and April 1998. The binary-curve initializations mapped to April 17, 1998, approximately two weeks after the P-224 run.
According to Anthropic, this finding is not a cryptographic weakness or security vulnerability. Instead, it strengthens confidence in NIST’s curve selection. The simple, transparent method used—a basic pseudorandom generator seeded with the system clock—makes deliberate backdoors much less plausible. For years, the unexplained origins of these parameters had raised suspicions about potential weaknesses. The discovery shows the seeds were generated through a trivial, reproducible method available to anyone, leaving limited room for subversion.
Key facts
- Claude discovered the NIST elliptic curve seeds originated from the lrand48 random-number generator seeded with Unix timestamps
- The discovery resolves a 25-year-old mystery about the origins of cryptographic standards adopted by NIST in 2000
- Unix timestamps indicate the seeds were generated between May 1997 and April 1998
- The finding does not represent a cryptographic weakness but rather increases confidence that NIST curves contain no intentional backdoors
- Claude identified the pattern by recognizing that certain seeds had all-zero top bits, a signature characteristic of lrand48