Anthropic: Claude traced the NIST ECDSA curve seeds to lrand48

01What happened

Anthropic published the result on October 16, 2026. The post says a curious Anthropic employee asked an internal research model in October 2026 how the NIST elliptic curve seeds were generated, without passing on the rumored clue, and that in under half an hour Claude had the origins of the P-192, P-224, P-256, P-384 and P-521 seeds. Ten Anthropic staff are named on the work, including Nicholas Carlini and Steve Weis.

02How it works

None of the prime-curve seeds were the output of a hash algorithm, according to the post. Claude wrote a scanner that slid along each published seed one bit at a time looking for consecutive outputs of a 1990s-style generator, then spotted zero top bits, the signature of lrand48, which returns only the top 31 bits of a 48-bit state. Anthropic puts the chance of that pattern appearing at random at 1/5810, and says Claude recovered the generator's internal state for the prime curves with LLL lattice reduction. For the prime curves each srand48 call was seeded with a Unix timestamp between May 1997 and April 1998, and a published seed is one 20-byte chunk in that stream: for P-256 it is candidate 1842, and candidate 876 of the same run also gives a prime-order curve.

03Who is affected

Nobody running ECDSA on the NIST curves is exposed by the finding. Anthropic states that the work is not a cryptographic break, new attack, or weakness in the ECDSA curves, and argues the findings make a deliberate backdoor much less plausible, because the seeds came from a simple reproducible process. Several seeds and base points remain unexplained, listed below.

04What to do

Anthropic says there is no action to be taken or things to do differently.

Questions people ask

Do the NIST curve seed findings mean I should stop using ECDSA P-256?

ECDSA on P-256 needs no change, according to Anthropic, which states the work is not a cryptographic break, new attack, or weakness in the ECDSA curves. The post says there is no action to be taken or things to do differently. Anthropic's argument runs the other way: knowing the seeds came from a simple reproducible process makes a deliberate backdoor much less plausible.

Which NIST curve seeds and base points are still unexplained?

The B-163 seed remains unexplained, Anthropic reports, along with the base points for P-224, P-256, P-384, P-521 and the NIST binary curves. Claude did recover the base points for P-192 and five ANSI X9.62 example curves, using a generator derived from FreeLIP. The seeds Anthropic says it explained cover the five NIST prime curves and four binary curves, listed above.

Which model found the NIST curve seeds, and how long did it take?

Anthropic names only an internal research model, not a released Claude version, and says an employee asked it in October 2026 without supplying the rumored passphrase clue. Under half an hour later the model had the origins of the P-192, P-224, P-256, P-384 and P-521 seeds. Ten Anthropic staff are credited, including Nicholas Carlini and Steve Weis.

What did researchers believe about the NIST curve seeds before this?

Stephen A. Weis set out the open question in a 2023 essay: Alfred Menezes told him that Jerry Solinas of the NSA supplied the seeds in 1997, and several sources said they were SHA-1 hashes of a lost English phrase. Solinas died in early 2023 without explaining the method. Anthropic's finding is that the seeds were not hash outputs at all.

Sources 3 links, all fetched

1. 1anthropic.comAnthropic Post
2. 2saweis.netThe Open Question
3. 3words.filippo.ioSeeds Bounty