Anthropic’s Claude Solves 25-Year-Old NSA Cryptography Seed Mystery

Anthropic’s internal Claude research model has solved a cryptography mystery that persisted for roughly 25 years regarding the origins of National Security Agency-supplied elliptic curve seeds. According to a report published by Cyber Security News on October 16, 2026, the AI traced the source of five specific seeds in under 30 minutes, providing a clear explanation for how these public security parameters were originally chosen.

The discovery reveals that the seeds used to generate NIST curves P-192, P-224, P-256, P-384, and P-521 came from lrand48, a standard C library random-number generator. The generator was initialized with Unix timestamps falling between May 1997 and April 1998. This finding directly contradicts a long-standing theory that the values were derived from hashing humorous phrases, a suggestion previously made by late NSA employee Jerry Solinas.

Context and Background

NIST adopted the Elliptic Curve Digital Signature Algorithm in its FIPS 186-2 standard in 2000, publishing seeds used in a SHA-1-based process to derive curve parameters without explaining their origin. The lack of transparency regarding how the NSA selected these starting values fueled suspicion among researchers that the curves might contain hidden weaknesses or deliberate backdoors. Although no demonstrated attacks against these curves existed, the missing history left the cryptographic community without a definitive account of their selection process.

According to The Decoder, Claude identified the pattern by noting that lrand48 outputs only 31 bits, which caused the top bits in some seeds to be systematically zero. The AI built a scanner covering 34 combinations of generators and output slices to find patterns inside the published seeds. For binary-curve seeds, the consistent zero in the highest bit of 32-bit words matched the lrand48 output structure, allowing Claude to recover candidate states by testing hidden bits.

For prime-curve seeds, which retained only eight bits from each generator output, Claude employed the Lenstra–Lenstra–Lovász lattice reduction algorithm to recover internal states from these partial values. This method successfully matched five NIST seeds and five ANSI X9.62 example seeds to the same construction. Anthropic stated that this origin makes the existence of deliberate backdoors far less likely, as the seeds appear to be the result of standard software tools rather than covert manipulation.

Who Is Affected

The resolution of this mystery impacts the broader trust framework for digital signatures, which verify data integrity and signer identity. Cyber Security News noted that Apple’s PQ3 iMessage protocol uses ECDSA with P-256 for message authentication, illustrating how these shared parameters underpin widely used services. Understanding the historical selection of these curves helps explain why trust in their generation matters across the industry, even though the finding does not expose secret keys or break existing encryption.

Anthropic is donating the $36,864 bounty, which had been offered for solving the mystery, to the Internet Security Research Group. The donation underscores the collaborative nature of the research community in addressing long-standing cryptographic questions. The result provides closure to a debate that had attracted amateur sleuthing efforts and academic scrutiny for decades, replacing speculation with a verified technical account of the seed generation process.

What should you do?

Security professionals should monitor vendor communications for any updates regarding the implementation of these specific elliptic curves in their systems. Since the finding confirms the seeds were not backdoors, existing implementations of P-256 and other NIST curves remain secure against the specific threat of hidden weaknesses in their generation. Organizations should continue to follow standard cryptographic hygiene, ensuring that keys are generated using approved, unpredictable random number sources rather than legacy or simple generators like lrand48.

What to do and how to stay safe: Anthropic

• Review internal documentation to ensure random number generators used for key generation are cryptographically secure and not based on simple legacy libraries.
• Verify that systems implementing ECDSA are using NIST-approved curves and that the implementation follows current best practices for key management.
• Monitor security advisories from vendors like Apple or cloud providers for any changes to their cryptographic protocols based on this new historical context.
• Educate development teams on the importance of using unpredictable seeds for cryptographic operations to avoid similar transparency issues in the future.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did this discovery break ECDSA encryption?

No, the finding explains how public parameters were chosen and does not expose secret keys or break the encryption algorithm itself.

What was the previous theory about the seeds?

Former NSA mathematician Jerry Solinas suggested the seeds were hashes of humorous phrases, but this theory was proven incorrect by the AI analysis.

Why did the NSA provide seeds without explanation?

The source material states that NIST published the seeds in 2000 without explaining their origin, which led to long-standing suspicion and the bounty.