Anthropic AI Reconstructs NSA Origin of Five NIST Elliptic Curve Seeds

An internal Claude model determined that the 25-year-old cryptographic mystery stems from standard C generators, not secret backdoors or passphrases.

Threat Times Intrusion DeskOctober 18, 20262 min read

Share LinkedIn Reddit

Illustration: A sleek black laptop sits on a wooden desk, its screen displaying complex geometric wireframes and abstract blue nodes. — AI-generated illustration: Threat Times

Key points

Anthropic’s research model identified lrand48 as the source of five NIST elliptic curve seeds.
The generator was initialized with Unix timestamps from mid-1997 to mid-1998, according to the report.
The finding confirms public parameter derivation methods and finds no evidence of cryptographic weakness.

Anthropic released findings on October 16 showing that an internal Claude research model reconstructed the generation process for five National Security Agency-provided elliptic curve seeds in under thirty minutes. This work resolves a cryptographic question that has persisted since the National Institute of Standards and Technology adopted these curves in the year 2000.

The model determined that the seeds originated from a standard C pseudorandom number generator called lrand48. Rather than using secret passphrases or hidden inputs, the generator was initialized with Unix timestamps ranging from May 1997 to April 1998. This reconstruction reproduces the specific seeds for curves P-192, P-224, P-256, P-384, and P-521.

Historical Context and Methodology

NIST published these seeds to allow verification of curve parameter derivation, but their origins remained unclear for twenty-five years. Previous theories suggested the seeds might derive from humorous phrases linked to NSA mathematician Jerry Solinas. Anthropic’s model instead analyzed programming patterns common in 1990s C libraries and identified the linear congruential generator.

The model scanned published seeds against thirty-four generator-and-output-slice combinations. It found that four binary-curve seeds contained five 32-bit words with consistently zero high bits, matching lrand48’s 31-bit output. By enumerating hidden state bits and checking subsequent outputs, the model recovered candidate generator states that matched the known seeds.

For prime-curve seeds, which exposed fewer bits per call, Claude applied the Lenstra–Lenstra–Lovász lattice basis reduction algorithm. This technique reconstructed internal states from truncated outputs. Five NIST seeds and five ANSI X9.62 example seeds matched a construction that collected bytes from lrand48() shifted right by twenty-three bits.

Impact on Current Deployments

Anthropic emphasizes that this discovery concerns public curve parameters, not private keys or signature secrets. The company describes the work as historical reconstruction and reports no cryptographic break, new attack vector, or reason to change current deployments. As Threat Times reported on October 17, this finding dispels long-standing fears of deliberate backdoors in the curve selection process.

The reconstructed initialization values correspond to specific dates, such as August 16, 1997 for the P-256 seed. The standardized seed appeared as candidate 1,842 in the sequence generated by that timestamp. This level of detail confirms that the generation process was deterministic and based on available system time rather than classified input.

What should you do?

Security teams should review their reliance on NIST-recommended elliptic curves to ensure they understand the distinction between seed derivation and key generation. While the seeds are now explained, the curves themselves remain secure against the methods described in this study. Organizations should monitor vendor communications for any updates regarding cryptographic standards, though no immediate action is required based on this finding.

What to do and how to stay safe

Verify that systems use current implementations of elliptic curve cryptography that rely on secure random number generators for private key creation, not the historical seed values.
Review organizational cryptographic policies to ensure they distinguish between public curve parameters and secret key material, as this finding only affects the former.
Monitor official channels from NIST and major security vendors for any guidance updates, although Anthropic states no changes to deployments are needed.
Ensure that any custom cryptographic implementations do not reuse weak seeding methods similar to the timestamp-initialized generator identified in this study.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.